SIEMENS SINEC CP 143 TF with NCM COM 143 TF Manual 6GK1970 1AC43-0AA1 Release 01 Volume 2 of 2 SINEC is a trademark of Siemens AG Siemens Aktiengesellschaft Introduction C79000-B8976-C049/01 The TF Model and the TF Services The TF Interface on the CP 143 TF TF Variable Services TF Domain and PI Services implementing a CIM Network Supplementary Services Non-Open Services for Serial Transfer Congiguring and Testing the TF Interface PGLOAD REQUEST EDITOR Example Programs Appendix TF Error Numbers Protocol implementation Conformance Statements (PICS) Abbreviations Index List of Further Reading HOHE BEBE EREEBEESSIEMENS Wir haben den Inhalt der Druckschrift auf Uberein- stimmung mit der beschriebenen Hard- und Soft- ware geprift. Dennoch knnen Abweichungen nicht ausgeschiossen werden, so daB wir fur die vollstan- dige Ubereinstimmung keine Gewahr iibernehmen. Die Angaben in der Druckschrift werden jedoch re- gelmaBig Uberprift. Notwendige Korrekturen sind in den nachfolgenden Auflagen enthalten. Fur Verbes- serungsvorschlage sind wir dankbar. We have checked the contents of this manual for agreement with the hardware described. Since de- viations cannot be precluded entirely, we cannot guarantee full agreement. However, the data in this manual are reviewed regularly and any necessary corrections included in subsequent editions. Sugge- stions for improvement are welcome. Technical data subject to change. Nous avons vrifi la conformit du contenu du prsent manuel avec le matriel et le logiciel qui y sont dcrits. Or, des divergences ntant pas exclu- eS, NOUS Ne pouvons pas nous porter garants pour la conformit intgrale. Si l'usage du manuel devait rvler des erreurs, nous en tiendrons compte et apporterons les corrections ncessaires ds la pro- chaine dition. Veuillez nous faire part de vos sugge- stions. Nous nous rservons le droit de modifier les ca- ractristiques techniques. Technische Anderungen vorbehalten. Weitergabe sowie Vervielfaltigung dieser Unterlage, Verwertung und Mitteilung ihres Inhalts nicht gestat- tet, soweit nicht ausdriicklich zugestanden. Zuwi- derhandiungen verpflichten zu Schadenersatz. Alle Rechte vorbehalten, insbesondere fir den Fall der Patenterteilung oder GM-Eintragung. Copyright Siemens AG 1993 All Rights Reserved The reproduction, transmission or use of this docu- ment or its contents is not permitted without express written authority. Offenders will be liable for dama- ges. All rights, including rights created by patent grant or registration of a utility or design, are reser- ved. Copyright Siemens AG 1993 All Rights Reserved Toute communication ou reproduction de ce support d'informations, toute exploitation ou communication de son contenu sont interdites, sauf autorisation ex- presse. Tout manquement a cette rgle est illicite et expose son auteur au versement de dommages et intrts. Tous nos droits sont rservs, notamment pour le cas de la dlivrance dun brevet ou celui de lenregistrement d'un modle d'utilit. Copyright Siemens AG 1993 All Rights Reserved Siemens Aktiengeselischaft Elektronikwerk Karlsruhe Printed in the Federal Republic of GermanySIEMENS SINEC CP 143 TF with NCM COM 143 TF Description C79000-B8976-C049-01Note We would point out that the contents of this product documentation shall not become a part of or modify any prior or existing agreement, commitment or legal relationship. The Purchase Agreement contains the comple- te and exclusive obligations of Siemens. Any statements contained in this documentation do not create new warranties or restrict the existing warranty. We would further point out that, for reasons of clarity, these operating instructions cannot deal with every possible problem arising from the use of this device. Should you require further information or if any special problems arise which are not sufficiently dealt with in the operating instructions, please contact your local Siemens representative. General This device is electrically operated. In operation, certain parts of this device carry a dange- rously high voltage. Failure to heed warnings may result in serious physical injury and/or material damage. WARNUNG ! Only appropriately qualified personnel may operate this equipment or work in its vicinity. ! Personne! must be thoroughly familiar with all warnings and maintenance measures in ac- cordance with these operating instructions. Correct and safe operation of this equipment requires proper transport, storage and assembly as well as careful operator control and maintenance. Personnel qualification requirements Qualified personnel as referred to in the operating instructions or in the warning notes are defined as persons who are familiar with the installation, assembly, startup and operation of this product and who posses the relevant qualifications for their work, e.g.: - Training in or authorization for connecting up, grounding or labelling circuits and devices or systems in accordance with current standards in saftey technology; Training in or authorization for the maintenance and use of suitable saftey equipment in accordance with current standards in safety technology; ~ First Aid qualification.Contents Contents 1 Introduction 1-1 1.1 Significance of the SINEC Technological Functions 1-3 1.2 Notes on Using the Manual and Overview of the Contents of Volumes 1 and2 = 1-5 1.2.1 Chapter Overview - Volume 2 1-5 1.2.2 Conventions Used in the Manual 1-9 1.2.3 User Groups and Topics 1-10 2 The TF Model and the TF Services 2-1 2.1 The Range of Performance of SINEC TF 2-2 2.1.1 Communication Requirements 2-2 2.1.2 Overview of the TF Services in SINEC H1-TF 2-3 2.2 SINEC TF Communication Model 2-5 2.2.1 Overview of the Architecture 2-5 2.2.2 The TF View of the Programmable Logic Controller 2-7 2.2.3 The Virtual Manufacturing Device (VMD) 2-9 2.2.4 Domain 2-10 2.2.5 Program Invocation (PI) 2-11 2.2.6 Variable 2-12 2.2.7 Application Association 2-15 2.2.8 Client and Server Associations 2-19 2.3 Selecting TF Services 2-21 2.3.1 VMD Services 2-21 2.3.2 Domain Services 2-23 2.3.3 Program Invocation (Pl) Services 2-28 2.3.4 Variable Services 2-30 2.3.5 Application Association Management 2-34 2.3.6 Clock Services 2-36 2.3.7 Serial Transfer 2-37Contents 3.1 3.1.1 3.2 3.2.1 3.2.2 3.3 4.1 4.1.1 4.1.2 413 4.2 4.2.1 4.2.2 4.2.3 4.2.4 4.2.5 4.2.6 43 4.3.1 43.2 44 The TF Interface on the CP 143 TF The Principle of the TF Link PLC - CP Using the Handling Blocks on the CP General Client Interface for Calling TF Services Job Buffer Sequence on the Client Interface General Server Interface TF Variable Services Basics of the Variable Services Description and Management of Variables Scope of Variables in a SIMATIC S5 Programmable Logic Controller Checklist for the Application Service Description Read Variable (Client) Read Variable (Server) Write Variable (Client) Write variable (server) Information Report (Client) Information Report (Receiver) Read and Write Variable with the Option of Addressing via a Free Format Address Client Interface Server Interface TF Data Types in SIMATIC S5 3-6 3-6 3-10 3-14 4-1 4-2 4-2 4-4 4-9 4-10 4-10 4-16 4-17 4-25 4-26 4-32 4-33 4-34 4-39 4-40Contents 5 TF Domain and PI Services Implementing a CIM Network5-1 5.1 Domain Services 5-2 5.1.1 Load Domain Content 5-8 5.1.2 Store domain content 5-15 5.1.3 Delete Domain Content (Client) 5-20 5.1.4 Get Domain Attributes (Client) 5-22 5.1.5 Domain Services (Server) 5-28 5.2 Program Invocation Services 5-29 5.2.1 PLC Program Structure, Status Transitions 5-30 5.2.2 General Sequence of a Status Change 5-37 5.2.3 Interface of the PLC Program to the PI Services on the Server 5-39 5.2.4 Start-up, Installation 5-45 5.2.5 Create Program Invocation (Client) 5-46 5.2.6 Create Program Invocation (Server) 5-50 5.2.7 Delete Program Invocation (Client) 5-51 5.2.8 Delete Program Invocation (Server) 5-54 5.2.9 Start, Stop, Resume, Reset, Kill Program Invocation and Local Program Stop (Client) 5-55 5.2.10 Start, Stop, Resume, Reset, Kill a Program Invocation (Server) 5-58 5.2.11. Points to Note when Starting and Stopping the PLC using the System Pl 5-59 5.2.12 Get Program Invocation Attributes (Client) 5-60 5.2.13 Get Program Invocation Attributes (Server) 5-64 6 Supplementary Services 6-1 6.1 Application Association Management 6-2 6.1.1 Definition of Application Associations 6-2 6.1.2 Connection Establishment 6-5 6.1.3 Connection Termination 6-8 6.1.4 Special Connections 6-9 6.2 VMD Services for Virtual Manufacturing Devices 6-10 6.2.1 Status of the Virtual Device (Client) 6-11 6.2.2 Status of the Virtual Device (Server) 6-13 6.2.3 Unsolicited VMD Status (Initiator) 6-17Contents 6.2.4 6.2.5 6.2.6 6.3 6.4 6.4.1 6.4.2 6.4.3 6.4.4 6.4.5 6.4.6 6.4.7 6.4.8 6.4.9 7.1 7.2 7.3 74 7.5 76 77 7.74 7.7.2 Unsolicited VMD Status (Receiver) identify Virtual Manufacturing Device (Client) Identify VMD (Server) Configuration Jobs Clock Services Network Topology, Clock Master/Slave Functions Accuracy How the Clock Functions Several CP 143 TFs on One SINEC H1 Bus without a SINEC Time Transmitter CP 143 TF on a SINEC H1 Bus with SINEC Time Transmitter Setting and Reading the Time in the Programmable Logic Controller Setting and Reading the Time with COM 143 Restrictions / Tips Accuracy Non-Open Services for Serial Transfer Overview of the Functions and Services Read Byte String (Client) Write Byte String (Client) Read/Write Byte String (Server) Transparent Data Exchange (Client) Transparent Data Exchange (Server) Addendum to Transparent Data Exchange Status Word of the TRADA on the Server Example of a Program for Evaluating the Bits of the ANWZ on the TRADA 6-18 6-19 6-21 6-23 6-28 6-31 6-35 6-36 6-38 6-39 6-40 6-45 6-48 6-49 7-7 7-13 7-17 7-21 7-24 7-24 7-25Contents 8.1 8.2 8.2.1 8.2.2 8.2.3 8.2.4 8.3 8.3.1 8.3.2 8.3.3 8.3.4 8.4 8.4.1 8.5 8.5.1 8.5.2 8.5.3 8.5.4 9.1 9.1.1 9.2 9.3 9.3.1 9.3.2 9.3.3 9.3.4 Configuring and Testing the TF Interface Overview Configuring the TF interface Edit | ... | Application Associations Edit | VMD Variables Edit | Fileserver AA Edit | VMD Configuration Documenting the Configuration Application association list VMD list Server list All Transferring Configured Data Transfer | Transfer Database Testing the TF interface Quitpuiting Status All Output Single Status Trace Functions Job Test PGLOAD Overview Adapting Programmable Logic Controllers to the Process with PGLOAD Range of Functions Description of the Tool Functional Description System Configuration and Device Functions Configuring Links and Selection Functions Transfer Functions Host Computer Functions 8-1 8-2 8-3 8-3 8-17 8-20 8-21 8-23 8-23 8-23 8-23 8-23 8-25 8-25 8-26 8-27 8-33 8-34 8-35 9-1 9-2 9-4 9-5 9-7 9-8 9-9 9-11Contents 9.4 9.4.4 9.4.2 9.4.3 9.4.4 9.4.5 10 10.1 10.1.1 10.1.2 10.2 10.3 10.4 10.4.1 10.4.2 10.4.3 10.4.4 10.4.5 10.4.6 10.4.7 10.4.8 10.5 10.6 10.7 10.7.1 10.7.2 10.7.3 PGLOAD - Application PGLOAD | Initialization Link Configuration / Server Selection Link Configuration / PLC links Using Transfer Functions Using Host Computer Functions Request Editor User-Friendly User Interface for Generating Job Buffers Overview Mode of Operation and Requirements Meaning of the Job Buffer Description of the Request Editor Request Editor | Init Specifying the Job Buffers for TF Services Create Job buffer Type Selection Screen Form for TF and Other Services Variable Services Domain Services Program invocation services VMD Services Transparent Data Exchange (non-open services) Other Jobs Displaying and Evaluating the Job Buffer Overview Delete Data Block Documenting Job Buffers Documentation | All Documentation | Overview Documentation | Job Buffers 9-13 9-13 9-15 9-18 9-20 9-23 10-1 10-2 10-2 10-3 10-5 10-7 10-9 10-9 10-12 10-16 10-30 10-37 10-48 10-53 10-61 10-70 10-73 10-73 10-73 10-73 10-73 ViContents 11 Example Programs 11.4 Overview and Requirements 11.2 Example 1: Using Variable Services 11.2.1 Task 11.2.2 Defining Variables 11.2.3 TF Services Required 11.2.4 Creating the Client Configuration File 11.25 Creating the Server Configuration File 11.2.6 Creating the Job Buffers with the Request Editor 11.2.7. PLC Programs 11.28 Starting Up 11.2.9 Monitoring the Process at the PG 11.3 Example 2: Using the Domain and Program Invocation Services 11.3.1 Task for the Domain Services 11.3.2 Tasks for the Program Invocation Services 11.3.3 Preparing Programs and Data 11.3.4 Executing Domain and P! Services ' 11.4 Example 3: Transparent Data Exchange with Acknowledgement (T-DQ) Appendix A TF Error Numbers used by the CP 143 Ad Preface A2 Errors Arranged According to Service Groups A.2.1 Non-Service Dependent Errors (NONS) A.2.2 Errors in the General Services (GEN) A.2.3 Errors in Application Association Management (APPL) A.2.4 Errors in the Variable Services(VAR) A.2.5 Errors in the Domain Services (DOM) A.2.6 Errors in the Program Invocation Services 11-1 44-4 11-3 11-3 11-5 11-7 11-9 11-13 41-17 11-25 11-41 11-41 11-42 11-42 11-43 11-45 11-61 11-67 A-12 A-15 VIIContents A.2.7 A.28 Errors during Serial Transfer(SER) Errors during Configuration (CONF) Protocol implementation Conformance Statements (PICS) Abbreviations Index Further Reading A-17 A-18 VillB 8976049/01 Introduction 1 Introduction The second volume of the "CP 143 TF with COM 143 TF" manual describes the protocol and the services for open, heterogeneous communication with the CP 143 TF communications processor. The CP 143 TF communications processor implements the connection of SIMATIC S5 programmable logic controllers to the cell and area network SINEC H1/H1FO. Within industrial automation, the protocol for the application layer (layer 7) of the OSI reference model is fixed uniformly in the SINEC communications system for all automation systems; the SINEC technological functions. The manual describes the services and scope of the SINEC technological functions (SINEC TF) for SIMATIC S5 programmable logic controllers. Following this, the implementation of SINEC TF on the CP 143 TF and the interface to the S5 user programs are explained in detail. This second volume contains information on the following topics: The SINEC technological functions (TF) model > Criteria for selecting the TF services > General client and server interface on the CP 143 TF. > Detailed description of the individual TF services > Configuring and testing the CP 143 TF with the COM 143 TF configuration tool. > PG support of TF domain and PI services with the PGLOAD tool. > User-friendly formulation of TF jobs with the PG tool TF REQUEST EDITOR > Examples of incorporating the TF services in SIMATIC S5 user programs 1-1 Volume 2Introduction B 8976049/01 Volume 2 of the manual builds on the information from volume 1 which describes the basics of communication with the CP 143 TF and the basics of configuration with the COM 143 TF configuration tool The introduction to Volume 1 also contains a simple example of using the TF services. Volume 2 1-2B 8976049/01 Introduction 1.1. Significance of the SINEC Technological Functions Overview The SINEC technological functions (TF) form the application protocol for communication in a heterogeneous automation network. They provide the user with services to allow problem-free interaction between different automation components (e.g. PLC, NC controls, robots, open-loop controllers, PCs, mini-computers and host computers etc.) in the cell and area network SINEC H1/H1FO. TF services also allow the exchange of information (messages) using a standard language. The standardization is intended to permit the implementation of open systems, reducing the time and expense required for the software engineering. Definition based on MMS The basis on which the TF services are defined is the only international standard for application protocols in the area of industrial automation: ISO 9506, MMS (Manufacturing Message Specification). CIM is supported The SINEC technological functions are a further step in the direction of CIM (Computer Integrated Manufacturing), i.e. computer controlled, fully automatic manufacturing, since the integration of automation components in a CIM network is impossible without communication. Advantages of SINEC TF The uniform, standardized language for exchange of information has the following advantages: > The use of TF services for the exchange of information makes the job of the programmer much easier. The protocol "hides" the specific characteristics of the end system behind a standardized, uniform representation of the system and the data. This means that negotiations between programmers regarding system structures and methods of representation are no longer necessary. The programmer can concentrate on implementing his own particular tasks. > The simple integration of components of other manufacturers is made possible by TF. 1-3 Volume 2Introduction B 8976049/01 > The protocol is independent of the underlying communication system: SINEC L2, SINEC H1 or SINEC MAP. This provides flexibility in program development (the system grows with the requirements of the user) and also means a reduction of training costs. > Gateways can be implemented without problems. > By using TF, the time and expense of software development can be greatly reduced. Volume 2 1-4B 8976049/01 Introduction 1.2 Notes on Using the Manual and Overview of the Contents of Volumes 1 and 2 1.2.1. Chapter Overview - Volume 2 Chapter 2 The TF model and the TF services This chapter describes the model underlying the SINEC technological functions. It illustrates the uses of defining an abstract model for a programmable logic controller, the virtual manufacturing device known as VMD. The chapter also introduces the TF services in sufficient depth for you to select the services you require for your task. Chapter 3 The TF interface on the CP 143 TF This chapter describes the modelling of the TF services on the CP 143 TF. You will also learn how to use the TF interface of the CP 143 TF. Chapter 4 TF variable services This chapter contains a description of the interface for the TF variable services both for the client and server functions of a PLC. Chapter 5 TF domain and PI services: services for implementing a CIM network This chapter describes the use of the TF services for controlling, monitoring and supplying data to the PLC. 1-5 Volume 2Introduction B 8976049/01 Chapter 6 Supplementary services This chapter describes the handling of application associations on the CP 143 TF and the VMD services with which information can be obtained about a PLC. Additional functions such as configuration jobs and the clock functions are also described. Chapter 7 Non-open services for serial transfer Serial data transfer is available for simple communication tasks. This chapter describes the interface for these services. Chapter 8 Configuring and testing the TF interface In this chapter you will find a description of the configuration, test and documentation functions required for initiating and operating application associations and the TF services via these associations. Chapter 9 The PGLOAD tool The PGLOAD tool provides user-friendly and nevertheless simple functions for addressing programmable logic controllers (PLCs) via the MMS standard TF interface. PGLOAD is also required to structure a PLC within the framework of the TF services with domain and program invocation objects. This chapter explains how to use the PGLOAD tool for the following purposes: Volume 2 1-6B 8976049/01 introduction > to supply PLCs with programs using the TF domain services directly or via the file server to match the PLC to the current tasks in the process > to monitor and control PLCs using TF program invocation services Chapter 10 The REQUEST EDITOR tool The REQUEST EDITOR tool supports you when creating the job buffer you require to program TF communication services on your SIMATIC programmable logic controller. This chapter explains the functions and how to use the tool. It is also suitable as an introduction for first-time users and as a reference work when configuring various TF services. Chapter 11 Examples of programs This chapter will familiarize you with the TF interface on the SINEC H1 bus system as designed for SIMATIC S5. The services and assignment of parameters to the CP 143 using the COM 143 software package are dealt with in detail. Appendix A TF Error Numbers B Protocol Implementation Conformance Statement PICS C Abbreviations D Index E Further Reading 1-7 Volume 2Introduction B 8976049/01 Overview of Volume 1: Description of basic CP configuration, the CP transport interface and general information about the construction, installation and operation of the CP 143 TF. "COM 143 TF Configuration Tool" Supplement An overview of the functions and screens. Volume 2 1-8B 8976049/01 Introduction 1.2.2 Conventions Used in the Manual The manual uses the following symbols in the text: v This character indicates an action for you to undertake. iS This character highlights important notes and dangers. mm Dimensions in diagrams and scale drawings are specified in millimetres. This note in the margin indicates the screen number which you can refer to the in the "COM 143 TF Configuration Tool" supplement. Prior requirements To understand the examples you should have > STEP 5 programming experience and > basic knowledge of using handling blocks (HDBs). A description of the HDBs can be found in the manual for your programmable logic controller or in separate descriptions for the programmable logic controllers. Training courses Siemens provides comprehensive training opportunities for SINEC users. For more detailed information contact your Siemens office. 1-9 Volume 2Introduction B 8976049/01 1.2.3 User Groups and Topics The CP143 TF with COM143 TF manual is intended for the following users: > Users wishing to configure SINEC H1/H1FO cell and area networks with SIMATIC S5 stations > Programmers of communicating application programs for SIMATIC S5 programmable logic controllers > Personnel installing SINEC H1FO cell and area networks with SIMATIC $5 stations The manual contains the information required for the following: > Assigning parameters to the CP 143 > Configuring links on the transport layer and application layer > Configuring communication objects such as variables, domains and program invocations > Operating the interfaces supported by the CP 143 > Configuring job buffers in the user programs of the SIMATIC S5 programmable logic controller for communication on the application layer > Configuration of host computer functions for domain and program invocation services on the programming devices Volume 2 1-10B 8976049/01 The TF Model and the TF Services 2 The TF Model and the TF Services To allow you to use the TF services of the CP 143 TF, this chapter explains the communications model and the range of services of the SINEC technological functions. lf you are familiar with the TF communication model, you can skip this chapter. The description of the TF services will nevertheless be useful in helping you to select the services for your tasks. At the end of this chapter you will have learnt about the following: > the architecture of the communication system > the model of SINEC TF with its objects > the TF services supported by the CP 143 TF > the terminology used in the TF model > the uses of the TF services > the TF services you will be able to use for your task. Note: Only TF specifications actually implemented on the communications proces- sor are described. 2-1 Volume 2The TF Model and the TF Services B 8976049/01 2.1 The Range of Performance of SINEC TF 2.1.1 Communication Requirements Message-oriented communication, Within industrial communication, a distinction is made between data-oriented and message-oriented communications protocols. While data-oriented protocols handle pure bit or byte streams, message-oriented protocols handle the content. The receiver of a message must perform a service described in the protocol. Message-oriented communication therefore goes beyond the simple transfer of data Open communication The basic idea behind open communication is to allow programmable logic controllers of different manufacturers to communicate with each other. By using a common specification, devices from different manufacturers can be integrated into one system. The TF specification describes how the message is exchanged. It also specifies certain types of message to allow uniform and comprehensible transfer of service requests. "Openness" is guaranteed by standardizing services, objects, attributes, parameters and statuses with SINEC technological functions (TF). The SINEC protocols allow SIEMENS subnetworks to be integrated in networks with the international manufacturing automation protocol (MAP) architecture therefore allowing an open system. An example A measured value is an object belonging to the class of variables. This object can be addressed using the variable services read variable" and write variable". The TF services ensure an understandable transmission of the object regardless of its format and analysis in the end system. Volume 2 2-2B 8976049/01 The TF Model and the TF Services 2.1.2 Overview of the TF Services in SINEC H1-TF SINEC TF is made up of the services conforming to MMS and to the open services. The latter are only available in the SINEC AP protocol architecture described here. TF services: > VMD services With the services for the Virtual Manufacturing Device (VMD), information about the characteristics and the status of a VMD can be requested (which services the device can perform, which objects exist etc.). > Domain services Domains are task-oriented program or data areas. Using the domain services, programs and data can be transmitted. The transmission can also be initiated by a third party, for example to transfer programs from a fileserver and load them on a PLC. > Program invocation services The program invocation models an executable program section. Services are specified for creating, starting, stopping and deleting program invocations. > Variable services Variable services are services for writing and reading the values of variables. These data can range from simple (integer) to complex (structures). A uniform syntax is defined to describe data structures so that language barriers occurring in the data type description are avoided (in the example: ihe $5 data block can be read in the host computer). > Application association management Applications wanting to communicate with each other can_ initiate, maintain and terminate a logical link, known as an_ application association. 2-3 Volume 2The TF Model and the TF Services B 8976049/01 Additional services only available for SINEC H1 (non-open services): > Clock services The time on the clock chip on the CP can be set and synchronized. The time can also be transmitted as a SINEC synchronization frame. > Serial transfer For simple data transfer, the serial transfer services are available. Data is transferred without address information and without structure information. As explained in the introduction, this transfer is data-oriented as opposed to message-oriented. Volume 2 2-4B 8976049/01 The TF Model and the TF Services 2.2 SINEC TF Communication Model 2.2.1 Overview of the Architecture The diagram below illustrates the architecture of the communication system with the application above it. The meaning of the layers of the model is explained in the introduction in Volume 1 of this manual. The description in Volume 2 involves the access to communication via the TF interface. As can be seen in the diagram, not only the application pro- gram in the programmable logic controller, but also the programming device uses the communications access via the TF interface with special services (PGLOAD). PG LOAD Automation program of the SIMATIC S5 PLC Access to TF interface Access to transport interface 7 (TF interface SINEC TF = MMS SINEC AP protocol Transport interface 4 Transport protocol (ISO 8073 3) 3 empty 2b LLC protocol (IEEE 802.2) 2a MAC protocol 1 and networking acc. to IEEE 802.3 (Ethernet) Fig. 2.1 Interface and Protocol Profile of the Communications Processor SINEC CP143 TF 2-5 Volume 2The TF Model and the TF Services B 8976049/01 Key to Figure 2.1 (for descriptions refer to the introduction in Volume 1) TF: Technological Functions The SINEC TF interface handles the encapsulation and processing of the TF PDUs and the service-oriented execution of a job or an acknowledgment /4/. The SINEC TF interface is designed so that it has no application protocol-specific elements which cannot be modelled on the MAP 3.0/MMS application protocol. This means that the user software also runs identically on the MAP protocol stack providing conformity rules are adhered to. PGLOAD for > Loading/deleting the PLC > Host computer functions AP: Automation Protocol SINEC AP handles the protocol for layers 5-7 /3/. Transport: Transport layer for SINEC H1 based on the ISO transport protocol. MAC: Media Access Control Volume 2 2-6B 8976049/01 The TF Model and the TF Services 2.2.2 The TF View of the Programmable Logic Controller Intention This section explains the view adopted by the application when using the TF communication model and which possible methods of device communication result. In this respect, the functions, model and terminology used are important. Programmable logic controllers consist of objects A real programmabie logic controller is modelled on a virtual manufacturing device (VMD) and its objects with the intention of uniform task-oriented communication. The device and its services are only available using communication with these objects. The following objects are defined: > VMD (Virtual Manufacturing Device): This is the programmable logic controller (PLC) itself > Domain This is a loadable data or program area on the device (PLC) > Program invocation (Pl) This is an executable, controllable task on the device (PLC) > Variable This is a data area on the device (PLC) that can be read or written to > Application association This is the communication channel between two applications The following sections explain these objects and how they are modelled on the SIMATIC S5 programmable logic controller. TF objects can be addressed using services During communication between an application process and an application process on a different device, the locally existing objects must be made available to the other device using services. Services are operations that can be performed on the objects listed above. Example: a measured value is an object belonging to the class of variables. Defined services for this class are read variable", "write variable", and information report". 2-7 Volume 2The TF Model and the TF Services B 8976049/01 Communications partner requesting service (HUtUOtt VMD _ services services Application association management Data ara: for. N lorocess data... Fig. 2.2 The TF/VMD View of the Real PLC Types of object The communications objects in TF can either be static or can be created dynamically due to the communication. Static means that ithe communication objects must be configured. Dynamic objects are created through the communication. > Static types of object Static communications objects are created when the device starts up. These structures remain unchanged in the application area during operation. They can neither be modified nor deleted during operation (see VMD-specific objects). > Dynamic types of object Dynamic communications objects are created while the device is operating. These objects can be loaded, modified and deleted during operation. Access to these objects therefore depends on them existing (see domain and link-specific objects). TF services and object classes The following sections describe the object classes assigned to the individual TF services. Volume 2 2-8B 8976049/01 The TF Model and the TF Services 2.2.3. The Virtual Manufacturing Device (VMD) Purpose The virtual manufacturing device (VMD) represents a standardized model or simulation of the physical device. It is described by the objects it contains and the characteristics of the physical device which it models with a standardized view. It therefore provides an interface via the VMD services for standardized interrogation of the device status and device characteristics. SIMATIC S5 and VMD The essential function of the communications processor (CP) is to model the VMD on the programmable logic controller. The conversion of the functions (required by the protocol) of the VMD on the programmable logic controller (PLC) is therefore performed in the communications processor. Within SIMATIC $5, each communications processor along with its programmable controller (the PLC in which the communications processor is plugged in) is considered as a single VMD. A VMD always contains a communications processor and (in the case of multiprocessor PLCs) up to four CPUs. Regardless of the number of CPUs, it is, however, possible to use several CPs in a PLC rack. Since the communications processors all operate independently of each other, each can be considered as a VMD itself. 2-9 Volume 2The TF Model and the TF Services B 8976049/01 2.2.4 Domain Purpose A domain is the model of programs, program sections or program data used for communication. Domains can be loaded and are therefore normally generated by transferring them to the programmable controller. The names of the domains are unique within a VMD. For the SIMATIC S5 PLCs, this means: Domains can be the following: Logical management units for variables A domain as a logical management unit defines a scope (area of validity) for variables. The name of a variable then consists of the domain name and variable name. Containers for program code and/or data A domain can consist of program code or data. In the context of TF, these contents are transparent, i.e. there meaning is only known to the applications which use the domain (e.g. not to a fileserver). SIMATIC S5 and domains A domain normally consists of "STEP 5" blocks, stored by the user in a program file using the S5-DOS programming package LAD, CSF, STL". Additional variables can also be assigned to a domain (see Variable). In addition to these loadable domains, there are also "static" domains. Static domains can neither be loaded nor deleted . Up to eight domains can be loaded on a SIMATIC S5 programmable logic controller. Volume 2 2-10B 8976049/01 The TF Model and the TF Services 2.2.5 Program Invocation (PI) Purpose A program invocation is the grouping of all domains into an executable program. The domains can either be loaded ("loadable" domains) or they are always present ("static" domains). Program invocations are therefore logical units capable of controlling user programs (put together in a Pl) via PI services. They can, for example, be started or stopped. Pls have statuses PI objects are characterized by their statuses and the status changes brought. about by the PI services and by running the program. Identification and assignment to domains Program invocations are identified uniquely within the VMD by names. Program invocations existing simultaneously can, if necessary, use the same domain(s). SIMATIC S5 and Pls SIMATIC S5 PLCs distinguish between a system PI and a user Pl. The system PI is by definition always present. By addressing this Pl, start/stop instructions can be issued to the PLC. By means of the user Pl, a user program loaded on the PLC is addressed. This user program is formed by the loaded domains. It is also possible, if the domain services are not used, to address the PLC user program as a user PI. 2-11 Volume 2The TF Model and the TF Services B 8976049/01 2.2.6 Variable Purpose Variables are objects that model the data of a user program. Variables are identified by names and contain a description of their structure. The description allows a standardized representation of the data, uniform throughout the system. The structure of ithe data can be either simple or complex. Via the communications system, variables can be read or written to. Variable characteristics Variables are identified by the following characteristics: > Variable name: Each variable has an identifier (ASCII string), with which the object is accessed. > Variable description The structure description of a variable is entered in an object description. > Scope: Variables are assigned to a particular scope. Scope means the assignment of a variable to a VMD, to an application association or to a domain which represents a form of "cocoon around the variable. Access is only possible to the variable by specifying the name of the cocoon. Within a scope, variable names must be unique. > Access rights: Both read and write access is possible via the network. This means that the values of variables can be modified by another station on the network. If this is undesirable, the write access can be disabled. Volume 2 2-12B 8976049/01 The TF Model and the TF Services SIMATIC S5 and variables In a SIMATIC S5 PLC, data of a STEP 5 user program is accessed via variables that have a name. The following features are used for managing and handling variables in the S5 PLCs: > S5 address: A variable in the SIMATIC PLC is always at a fixed S5 address. This address must be located in the data block area (or extended data block area). > Status word address: Each variable in the SIMATIC S5 device is assigned a status word (condition codeword) address. This address contains information about access to the variable via the network. in the SIMATIC PLC, it is also possible to prevent access to the variable at certain times by manipulating the status word. > Interface number: This attribute specifies which interface number must be used on the communications processor to be able to access the variable. In multiprocessor PLCs, this allows the variables to be distributed on various CPUs. > Local and remote variables With the attributes listed above, local variables can be defined and specified. Local variables are objects which exist in the local station. Other stations can access these objects via the network. Remote variables are variables on a different device which the local device can read or write. Structure information must be stored for this access. The definition of local and remote variables is therefore supported by the configuration tools. > Static and dynamic variables Static local variables are programmed with the COM 143 TF configuration tool ("VMD variable editor"). Dynamic variables generated as a result of communication are known as domain-specific variables (i.e. variables whose existence depends on the existence of a domain). These are defined using the PGLOAD tool (component of COM 143 TF). 2-13 Volume 2The TF Model and the TF Services B 8976049/01 Variants of variable structures The following variants in the structure description of variables must be distinguished: > Variable with standard data type: these elements are of a predefined data type. > Variable record: a list of differently structured components of any type. > Variable array: a list of elements with the same structure. Access protection mechanisms for variables In automation systems, access protection is often necessary for the safe operation of equipment. The CP 143 TF provides the following types of access protection: > explicit protection with a R/W identifier for each individual variable set when configuring variables > implicit protection using the scope of a variable > temporary protection by means of the variable status word. Volume 2 2-14B 8976049/01 The TF Model and the TF Services 2.2.7 Application Association Purpose From the point of view of the user, communication with the application processes of the communications partners takes place via logical channels (application associations). These application associations define the view of the communications partner and its automation task. VMD objects can be addressed only via application associations. Prior to the communication, the user must specify which automation task is to be addressed via which application association. The PDUs therefore contain the meaning of the message as well as the address information allowing the simulation on the application on the server side. Initiation, use and conclusion of application associations During the initiate phase, a link request is indicated to the remote application process (initiate service). The link establishment request includes the services to be used in the data transfer phase, the maximum frame size, the number of parallel services (context) and the required type of link as well as any other options required on the link. If the remote application process agrees to the link establishment request, it sends a confirmation of the link establishment request to the issuer of the job. Following this, both application processes are in the data transfer phase and can communicate with each other according to the agreed restrictions (context). An existing link can be monitored for availability by the link supervision. The specified supervision times must be the same on both the local and remote end points. A link is cleared by a link termination function. Following termination, data exchange can only be resumed fallowing a new link establishment. SIMATIC S5 and application associations With SIMATIC S5 PLCs the communication path between two applications is described by the application association. 2-15 Volume 2The TF Model and the TF Services B 8976049/01 The name of an application association must be unique within the network. When an application association is configured, the specification of the link name is supporied by the configuring tool. This makes use of the fact that the access to communication with SIMATIC $5 is via the interface number and job number. This procedure is familiar from the transport interface of the CP 143 TF. TF link (Application association) MPX address (Multiplex address) TSAP TSAP TSAP TSAP, TSAP address P 4 (Transport address) l Pneumatic post () Transport connection Network address 08000601__ __ 08000601_ _ (Ethernet address) SINEC Hi Fig. 2.3 Application Associations - Access to the Transport Services Volume 2 2-16B 8976049/01 The TF Model and the TF Services An application association between two CP 143 TF communications processors of stations X and Z with transport access points A and H and the application access Mn is described uniquely in both stations using the following parameters: Application 1 Application n in station X in station Z local station address X Zz 1 remote station address Zz Py MUX address Mn Mn local TSAP A H [A a MN, remote TSAP H A Fig. 2.4 Parameters for an Application Association Just as the transport links, these parameters are stored in the data link blocks and SYSID blocks on stations X and Z. The following figure illustra- tes the parameter storage for application associations: Data link block SYSID block Appl. ass. parameters local parameters local station address remote station address SSNR local TSAP remote TSAP MUX address A-NR Fig. 2.5 Data Link Block and SYSID Block with TF Links 2-17 Volume 2The TF Mode! and the TF Services B 8976049/01 Handling application associations with SIMATIC S5 In the client and server role, the CP 143 provides the following TF services: > initiate application association > abort application association In the server role, the following service is provided: > conclude application association The TF services for managing application associations are executed via the CP 143 in the main without being triggered by the user program. The required parameters for executing the services are entered with COM 143 when defining the application associations and saved on the communications processor. Depending on the type of link (static or dynamic), the application associations are initiated when the modules are started or when a job is initiated for productive communication. An explicit client interface for initiating and concluding application associations by the PLC user program is not provided. The PLC user program can only abort an existing application association by calling the CP handling block "RESET". Volume 2 2-18B 8976049/01 The TF Model and the TF Services 2.2.8 Client and Server Associations The principle The use of application associations with SINEC TF is based on the client/server principle. This principle defines two communications partners: > For communication purposes, a client is an application process which uses the functions of a_ virtual manufacturing device (VMD) of a remote application process. > The server is the application process that makes the functions of its virtual manufacturing device (VMD). available to the client. The service can be requested or may be provided spontaneously (process values may be "reported" depending on the technological process). Example A host computer requests the transfer of a process value in a PLC using the read variable TF service. It uses the application association to the PLC process in device Y. The PLC process in device Y is the server which provides the read variable service to the host computer. Changing roles of a process An application process can function both as client and server. This means that the process can request services (client) and provide services (server). This reflects the typical integration of manufacturing devices in the hierarchi- cal organization of a CIM network. 2-19 Volume 2The TF Model and the TF Services B 8976049/01 The following figure illustrates the layers of a CIM network. Communication between devices takes place both within a layer and between the different layers. CIM Network Management level =a Control level AP _ System level ai = 3 a "Process level Client / rer function Job/data flow Feld level L c- : Le S f \ Fig. 2.6 Hierarchical Structure of a CIM Network; Devices with Client and Server Role Client and server functions with SIMATIC S5 The TF communications functions of SIMATIC S5 devices are designed to support client and server functions. For your application, the following is available: > the client interface, to formulate service requests within the PLC program > the server functions for communications services provided in the form of a CP program io be able to execute TF service requests Volume 2 2-20B 8976049/01 The TF Model and the TF Services 2.3. Selecting TF Services 2.3.1. VMD Services Meaning The VMD object forms a cocoon around the other objects of a VMD and its services. Externally, it must be considered the central access point via which information about the characteristics and statuses of the device can be obtained. In keeping with this, the services are primarily information functions. The general TF services for virtual manufacturing devices allow a client to request information about the status or attributes of a virtual manufacturing device (VMD) on the server. In some circumstances, the server can report the status to a client without a request. The information can be processed further on the client, for example to provide an overview of the whole system status in a control room. Overview The CP 143 can process the following general services for virtual manufacturing devices (VMD) both in the role of client and server. > Get the status of a virtual device (status) > Report the status of a virtual device (unsolicited status) > Identify virtual device The following general services can only be processed by the CP 143 TF in the role of server: > Get name list and > Get capability list 2-21 . Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) Description of the VMD services Status (get the status of a virtual device) Using the "Status" service, a client requests information about the physical and logical status of the virtual manufacturing device managed on the server. The server sends the requested information (e.g. whether the "real" manufacturing device or the communications processor of the server is in the RUN or STOP mode or whether the PLC and CP are not synchronized) in the acknowledgment. Unsolicited status (of the virtual device) With this job, a server program can report the logical and physical status of the VMD on its own initiative. The CP 143 can receive this spontaneously transmitted information (client function) or send the information (as server). Identify (virtual device) A client can request information about the attributes of a virtual manufacturing device (VMD) using the "Identify" service. These attributes can, for example, include the identifier of the vendor of the manufacturing device, the device ID (for the CP 143 the module ID) and the version of the communications processor. Get name list and get capability list The TF services "Get name list" and "Get capability list" are only provided by the CP 143 in the server role, since the client role requires mass memory. The information requested with these services is sent to the client automatically by the CP 143 without support of the S5 program. The reply information sent by the CP 143 might include, for example, a list of all communications objects (Pl, domain, variable) defined on the server and managed by it. Volume 2 2-22B 8976049/01 The TF Model and the TF Services Criteria for Selecting MMS/TF Services (continued) 2.3.2 Domain Services Meaning A CIM network requires not only the transmission of pure data or variable objects.. The domain services make the VMD (the PLC) a flexible device which can be adapted to the task in hand. This means that programs and data areas can be exchanged online. Objects (domains) of the device can be loaded on the device via the communications networks and, if necessary, saved. The services are kept so flexible that the data must not necessarily be on the coordinating device (the client) but that a fileserver can also be included as a "third party communications partner. The TF services for handling domains and Pls on the CP 143 allow the incorporation of SIMATIC S5 programmable controllers and programming devices in a CIM network via the SINEC H1 bus system. Overview The following TF domain services are supported by the CP 143 TF: > Download (server role) > Upload (server role) > Load_domain_content (client and server role) > Store_domain_content (client and server role) > Delete_domain_content (client and server role) > Get_domain_attributes (client and server role) Initiative The PLC can initiate a load or store service on its own initiative or at the instigation of a third party. All the TF domain services can also be used on the local station. In this case the SIMATIC S5 PLC acting as the client triggers the loading of domains from a TF fileserver to itself using a special job number (ANR 205). These local services can, however, only be executed by the master CPU. 2-23 Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) Variables in the domain scope Variable objects with a domain-specific scope are also generated or deleted when a domain is loaded or deleted. Notes on applications Several configurations are possible for the SIMATIC S5 system: 1.) Downloading or uploading from the PG. In the simplest case, the domain services are triggered by a SIMATIC programmer . The S5-DOS program file (name: xxxxxxST.S5D) contains the blocks to be loaded and to be handled as a domain. Using the supplementary PG package, PGLOAD, this S5-DOS program file is transferred to the programmable controller as a load file using the TF domain services. Loaded domains can also be saved for archiving purposes, i.e. transferring them back from the programmable controller to the programmer. These services can also be used to delete domains. C $5-PLC| p L__| swing cable" SINEC bus CP PG Fig. 2.7 Domain Services with the PG - Download/Upload Volume 2 2-24B 8976049/01 The TF Model and the TF Services Criteria for Selecting MMS/TF Services (continued) 2.) Third party association with PG and fileserver A second configuration can be achieved if a station with a large memory is used in the network as an archive computer. This archive computer, known as the "TF fileserver" stores the files that will be loaded later as domains. Cc $5 -PLC} p swing cable SINEC bus CP CP TF file server PG Fig. 2.8 Third Party Association with PG and File Server The SIMATIC programmer can now request the SIMATIC CP to load a particular file from the TF fileserver into the programmable controller. During this procedure, information about the domain is stored on the communications processor. The programmer can also request the SIMATIC PLC to save a loaded domain on a fileserver or to delete the domain. File transfer (S5-DOS program files) from SIMATIC programmers to the TF fileserver can be requested at the PG using the TF services. The files can, however, also be transferred from other data media (e.g. with a diskette). This configuration is known as a third party association" since the PG requ- ests the manufacturing device to load data from a third station. 2-25 Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) 3.) Third party association with host computer and fileserver The third configuration replaces the SIMATIC programming device with a host computer. If this host computer can handle the TF protocol, it can trigger loading and archiving procedures with the TF domain services between a SIMATIC PLC and TF fileserver. A SIMATIC S5 programmable controller can also be used as the host computer. In this case, the program files are transferred to the TF fileserver as in the second configuration. $5 - PLC C Host computer L_ 4 CP "swing cable" SINEC bus CP TF file server Fig. 2.9 Third Party Association with any Host and File Server Volume 2 2-26B 8976049/01 The TF Model and the TF Services Criteria for Selecting MMS/TF Services (continued) Description of the domain services Download A host computer (not an S5 PLC) uses this job to download a domain file to an $5 PLC. Upload A host computer (not an S5 PLC) uses this job to upload a domain file from an S5 PLC, for example for archiving purposes. Load domain content With the TF "ioad domain content" service, a client requests a server to load a domain. The domain is located in a file stored on the TF fileserver. Store domain content With the TF store domain content service, a client requests a server to save a loaded domain in a file on the TF fileserver. Delete domain content With the TF "delete domain content" service, a loaded domain is deleted in a server. All the variables belonging to the domain are also deleted. Get domain attributes A client can request the characteristics of a domain, i.e. its attributes, with the TF service get domain attributes". The server sends the information back to the client in the acknowledgement (e.g. whether the domain can be deleted or whether it is used by a program invocation). 2-27 Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) 2.3.3 Program Invocation (Pl) Services Meaning The PI services provide a view of the programs of the VMD to be executed. They allow the task-oriented grouping and use of domains. The effects of the services in the real device depend on the device-specific or operating system-specific response in terms of the management of programs. PI objects are characterized by their statuses and by the status changes brought about by the PI services and program execution. When controlling programs using PI services, two aspects must be taken into account: > System Pl: The -services control the status of the programmable controller (PLC STOP-RUN) > User Pl: The services control and monitor the application loaded on the programmable controller. Overview The following TF-PI services are supported by the CP 143: > Create program invocation > Delete program invocation > Start, stop, reset, resume, kill program invocation (PI) and local program stop > Get program invocation attributes Volume 2 2-28B 8976049/01 The TF Model and the TF Services Criteria for Selecting MMS/TF Services (continued) The role of the SIMATIC S5 PLC PI services can be executed by a local programmable logic controller both on itself and on a remote partner. The programmable logic controller transfers the parameters required for the job to the communications processor when the service is initiated. lf the Pl services are triggered by the programmabie controller on itself, then a special job number must be used (ANR 205). These local services can, however, only be executed by the master CPU. The task of the CP 143 TF The modelling of the PI services on the SIMATIC S5 PLC is implemented by the communications processor. Descriptions of the Pl services Create PI With the "create PI" TF service, a client requests a server to generate a program invocation. Delete Pl With the "delete PI" TF service, a client requests a server to delete a program invocation. Start, stop, reset, resume, abort Pl and local program stop A client uses the "start, stop, reset, resume, abort PI and local program stop TF services to control the status of the program invocation in a server. Get PI attributes A client requests the characteristics of a program invocation, i.e. its attributes using the "get Pi attributes" TF service. The server sends this information back to the client in the acknowledgement (e.g. whether the program invocation can be deleted or the current status of the program invocation). 2-29 Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) 2.3.4 Variable Services Meaning With the variable services and with the standardized transfer of variable objects (simply known as variables), SINEC TF provides a neutral view of end system-dependent variables. By using the TF variable services, variable data can be exchanged independent of the end system. The standardized representation of the data types must not be confused with standardization of the data contents, i.e. the semantics. The standardization simply involves a conversion of variables to the format of the end system, both on the client and on the server. Overview The following variable services are available: > Read variable > Write variable > Information report > Get variable attributes Client and server view in the variable services The variable services have the following characteristics: > Client: The SIMATIC S5 programmable logic controller functions as the client wanting to access variables defined on another station. For the SIMATIC S5 to access a variable (SIMATIC S5 as client), the name and the description of the object are required. These are transfer- red to the communications processor as parameters when the service is activated. Complex descriptions may be configured as remote definitions. > Server: The SIMATIC S5 programmable logic controller functions as the server, and manages the variable defined locally on it. Volume 2 2-30B 8976049/01 The TF Model and the TF Services Criteria for Selecting MMS/TF Services (continued) The variables are managed by the communications processor. The va- riable attributes (name, scope, description of the variable etc.) are confi- gured for the CP 143 TF and stored on the CP. The assignment of a variable to the real object in the server (e.g. data block) is made on the SIMATIC S5 by configuration with the COM 143 package or with the additional PG package, PGLOAD. The conversion when the variable is accessed is the responsibility of the communications processor in the role of server. Variable service descriptions Read Variable With the "read variable" TF service, a client requests the value of a variable from the server. The server sends this value in the acknowledgement. Client Server t Read job 4 | | Read acknowledgment Fig. 2.10 Read Variable 2-31 Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) Write Variable With the "write variable" TF service, the client transfers data to a server. The server overwrites the variable specified in the job with the value transferred by the client. The service is acknowledged by the server. The acknowledgement tells the client whether the service was successful or not. Client Server t Write job 4 | | | Write acknowledgment Fig. 2.11 Write Variable Information Report With the information report" TF service, the server sends descriptions of variables and values of variables to the client without an explicit request. This job is not logically acknowledged (by layer 7). When using this job, remember that when the service is called in the PLC program, the communications processor accesses a local object that must be configured with the COM 143 package Client Server Information report | p Bus Fig. 2.12 Information Report Volume 2 2-32B 8976049/01 The TF Model and the TF Services Criteria for Selecting MMS/TF Services (continued) With the get variable attributes" service the client requests the server to send information about the attributes of a particular variable (e.g. scope, description of the variable etc.) in the acknowledgement. This service is only available from the SIMATIC S5 side with the PLC operating as a server. The PLC program cannot request this service. The communications processor can, however, process a job and return the attributes of a variable defined on it (configured in COM 143) in the acknowledgement. 2-33 Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) 2.3.5 Application Association Management Meaning The TF services for managing application associations supply the infrastructure required for communication at the application layer according to the OSI reference model. Overview The CP 143 TF provides the following services when functioning as either client or server: > initiate application association > abort application association The following service is provided in the server role: > conclude application association Initiative The TF services for managing application associations are executed by the CP in most cases without being triggered by the user program. The parameters required to execute the services are entered when the application associations are defined using COM 143 TF and stored on the communications processor. Depending on the type of link (static or dynamic), the application relations are initiated when the modules are started or after a job for the application relation is triggered. An application association can only be initiated after the corresponding "pneumatic post (transport) link" has been set up. When initiating the application association, a series of parameters are transferred which are significant for a heterogeneous communications network. These indicate whether non-open services (serial transfer) or variables with a certain nesting level are supported. Volume 2 2 - 34B 8976049/01 The TF Model and the TF Services Criteria for Selecting MMS/TF Services (continued) The role of the user program An explicit client interface for initiating and concluding application associations by the PLC user program is not provided. An existing application association can simply be aborted by the PLC user program by calling the CP handling block "RESET". 2-35 Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) 2.3.6 Clock Services Meaning Apart from the already mentioned TF services, the CP 143 TF also provides clock services. The integrated clock chip can access a system clock synchronized via the network. The programmable controller accesses the system clock via a special job number (218) using the CP handling blocks SEND and RECEIVE to write or read the time. Synchronization The clock function can be synchronized by the CP 143 TF (clock master) or by another station, for example the SINEC clock transmitter. Reliability For the CP clock master function the CP 143 has a redundant design to maintain synchronization if the clock master fails. Volume 2 2-36B 8976049/01 The TF Model and the TF Services Criteria for Selecting MMS/TF Services (continued) 2.3.7 Serial Transfer Meaning For simple data transfer, the CP 143 provides the TF services of the function class "serial transfer". This function class is distinguished by the following characteristics: Data is exchanged between the client and server without address information or parameters relating to the meaning of the data. The serial transfer services are known as non-open services". They are not included in the scope of functions of the international standard (MMS standard) and can therefore not be modelled on MMS services. Advantages and Restrictions The serial transfer services allow the greatest freedom in configuring application associations. The users must, however, negotiate the meaning and further processing of the data. Compared with direct use of layer 4, when using the serial transfer services, the user can make use of the TF infrastructure. This ensures for example increased reliability with the logical acknowledgment of messages, the timed and logical monitoring of TF jobs and the possibility for better utilization of a transport connection by multiplexing at the application layer. Overview The following services are available for data transfer: > read byte string > write byte string > transparent data exchange with and without acknowledgment 2-37 Volume 2The TF Model and the TF Services B 8976049/01 Criteria for Selecting MMS/TF Services (continued) Service descriptions of serial transfer Read/write byte string The byte string services are used for "unidirectional" data transfer, i.e. data are transmitted in only one direction: with the read byte string" service in the acknowledgement frame, and in the write byte string" service with the request frame. When the Read byte string" service is called, the client requests data from the server. The request frame itself does not contain any data. The client receives the data from the server in the acknowledgment. With the "Write byte string service, the client transfers data to a server. The client can decide whether the received data should be acknowledged or not. Transparent data exchange With the transparent data exchange service, data exchange can be bi-directional. Data can be transmitted both in the request frame and in the acknowledgement. The client can decide whether or not = an acknowledgement is required. STF service Job PDU Acknowledgment PDU | T Read byte string Data request frame . Acknowledgment frame without 7 with requested data data ' | Write byte string Data frame - Acknowledgment frame without data or no acknowledgment data exchange with or without data | | Transparent Data frame TT Acknowledgment frame | or no acknowledgment Fig. 2.13 Overview of the Serial Transfer Services a Volume 2 2 - 38B8976049/01 The TF Interface on the CP 143 TF 3 The TF Interface on the CP 143 TF This chapter explains the use of the TF services integrated on the CP 143 TF. The chapter describes aspects important for the use of all TF services. Information for specific services can be found in the following chapter. The chapter explains the following: > how to use handling blocks for the TF services > the differences between the client/server view on the TF interface > the significance of configuring the CP 143 TF with the COM 143 TF configuration tool > the aspects covered by programming on the PLC > which non-service dependent parameters are transferred or requested on the TF interface With this information, you will be able to use the next chapter as a reference section to locate the service descriptions you require for your task. 3-1 Volume 2The TF Interface on the CP 143 TF B8976049/01 3.1. The Principle of the TF Link PLC - CP Intention Chapter 4, Volume 1 explains the basics of the PLC-CP link. This section expands the information in terms of the TF interface. The CP is addressed using handling blocks (HDBs) Control of the CP by the STEP 5 user program is via the dual-port RAM (DPR) using handling blocks (HDBs). Overview The following system calls (i.e. HDBs) are used for the TF services: > SEND-direct Transfers data to the CP > SEND-ALL Transfers data from the PLC to the CP > RECEIVE-ALL Data is accepted by the PLC from the CP > RESET Resets an application association > CONTROL Requests the status of a job > SYNCHRON Synchronizes start-up between the PLC and CP Address information All these handling blocks must be supplied with an interface number and a job number (exception: the SYNCHRON HDB only requires an interface number). Essentially, the main link between the STEP 5 user program and a particu- lar action on the CP is a combination of SSNR/ANR. To prevent the system responding incorrectly, make sure that an SSNR/ANR combination is only assigned once in an S5 PLC. Volume 2 3-2B8976049/01 : The TF Interface on the CP 143 TF Exclusion The STEP 5 user cannot access the CPs directly (by avoiding use of the handling blocks). TF jobs A TF function is called by an application program using the job buffers. These job buffers are referenced in the handling blocks and transferred via the dual-port RAM to the CP. HDB Parameters: SSNR FB Handling block ANR SEND ANZW PAFE $5-ADD. Job Buffer Fig. 3.1 Principle of Referencing the TF Job Buffer - Extended status word The status word for the TF interface is extended by a third word for TF error recognition. The meaning of the first two status words remains unchanged (for selecting the status word, refer to the detailed description in the Section "Description of the HDB Call Parameters", Page 11). Note: details of the handling blocks of the individual programmable logic controllers, particularly when the blocks are integrated in the operating sy- stem, can be found in the descriptions of the specific programmable logic controllers. 3-3 Volume 2The TF Interface on the CP 143 TF B8976049/01 3.1.1. Using the Handling Blocks on the CP This section describes the use of the handling blocks for transferring TF jobs to the CP. Further information about this topic can be found in Volume 1 of this manual; particularly the processing of the RESET, SYNCHRON and CONTROL HDBs. Processing Send/Receive Example of a TF job - read and write variable The description of a write and read job illustrates how this functions. Using the SEND-DIRECT HDB, the user transfers the job buffer to the CP. This informs the CP 143 TF that the user wants to send a data record (write job) or that it is ready to receive a message (read job) and also where the received data should be stored. Once the job buffer arrives on the CP, the PDU for the particular job is created automatically by the CP, at the same it makes sure that no further job can be triggered with the SEND-DIRECT HDB for this ANR (ANZW=sjob active=00X2u). Write Variable Job With a write job, the data for transmission are requested from the PLC using the background communication (SEND-ALL), entered into the PDU and sent to the remote partner. When the data arrives, it is compared with the configured data description. Following this, the data is made available to the PLC by the background communication (RECEIVE-ALL) and transferred to the appropriate data block in the PLC. The job is then acknowledged. The initiator of the service evaluates the acknowledgement and terminates the job accordingly: > Positive acknowledgment: ihe job was completed successfully and "job complete without error is entered in the SEND-DIRECT ANZW= 00X4u, allowing the job to be triggered again. > Negative acknowledgment: the job could not be executed. Job complete with error is entered in the SEND-DIRECT ANZW and remote error =09X8H, can be found in the Volume 2 3-4B8976049/0 1 The TF Interface on the CP 143 TF TF error status word (ERRCLS/ERRCOD). The job can then be triggered again. Read Variable Job With the read job, the PDU for the specific job is transmitted to the remote partner. The remote CP evaluates the PDU and requests the data from the PLC via the background communication (SEND-ALL). Once the PDU contains the required data, it is transmitted with a_ positive acknowledgement to the caller (service initiator), The data is then transferred to the PLC using the background communication (RECEIVE-ALL). > Positive Acknowledgment: After successful transfer of the data, "job complete without error" (=00X4H) is entered in the SEND-DIRECT ANZW and the job can be triggered again. > Negative Acknowledgment: If a negative acknowledgement is received from the remote partner or if the data cannot be transferred to the PLC, "job complete with error" is entered in the SEND-DIRECT ANZW and remote error (= 09X8u) is set. The detailed error ID can then be read from the TF error status word (ERRCLS/ERRCOD). Following this, the job can be triggered again. 3-5 Volume 2The TF Interface on the CP 143 TF B8976049/01 3.2. General Client Interface for Calling TF Services 3.2.1. Job Buffer Meaning A TF function is called by an application program using the "job buffers". These job buffers are transferred via the dual-port RAM to the communications processor using standard handling blocks. The job buffer itself is used to transfer the parameters required to execute the service correctly on the communications processor. Location and Formats Job buffers must be located in data block or extended data block areas and are restricted to a maximum length of 256 bytes. Each job buffer consists of a general section and a service-specific section. Support With the REQUEST-EDITOR, the S5 user has a tool to support the creation of job buffers. Using this tool ensures the syntactical correctness of the job buffers. Structure Figure 3.2 illustrates the basic structure of a job buffer using the example of the variable services. The general section applies to all TF services. (open and non-open services). The structure of the service-specific section of the job buffer differs depending on the TF service. A detailed description can be found in the section describing the individual services. The same applies to the services for simple data transfer supported by the communications processor (non-open AP services). Volume 2 3-6B89 76049/01 The TF Interface on the CP 143 TF (KS: . i Gen. Opcode 4 bytes (ASCII) section KF: Timeout Residence time of the LL reserved job in the CP in 0.1 sec ~~ ge KS: identifier SIMATIC S5 address KY: 0 | DB no. identifier KF: DW no. Data . ype spec. Specification of the Service- data type of the variables specific KS: Scope KY: [Box ID. | Length KS: Var./box a 7 name 7] KY: [_tength Length of the domain name KS: Domain = LL name C Data _ As an option, the job - TT buffer can also contain data Fig. 3.2 Structure of the Job Buffer based on the Example of the Variable Services Special Features lt is nevertheless possible to generate job buffers without using the TF editor. It is also possible to define certain parameters in the memory card of the CP (local and remote definition, see Configuring, Test) instead of in the job buffer (PLC program). If you configure a variable completely, the job buffer only needs to contain the scope and the object name. The parameters specified in the job buffers always have priority over the parameters programmed in COM 143 or in the COM 143 too! PGLOAD. 3-7 Volume 2The TF interface on the CP 143 TF B8976049/01 Description of the General Section The following descriptions are based on Figure 3.2 Opcode: 2 words, format: KS In the opcode, the user encodes the required TF service. The coding is made using four ASCIl characters and can be seen in the following table. V-RE Read variable V-WR Write variable V-IN Information report D-LO Load domain content D-ST Store domain content D-DE Delete domain content D-GE Get domain attributes P-CR Create Pl P-ST Start Pl P-RE Resume PI P-SP Stop Pl P-RS Reset P| P-AB Kill Pl P-HL Local program stop P-GE Get PI attributes P-DE Delete Pl M-ST Status M-SU Unsolicited status M-ID Identify VMD B-RQ Read byte string B-WQ Write byte string with acknowledgment B-wWO Write byte string acknowledgment B-WI Request byte string length T-DQ Transparent data exchange with acknowledgment T-DO Transparent data exchange without acknowledgments A-CF Configure ANZW [local] The meaning of the individual services and how they are modelled on the SIMATIC PLC is described in the relevant section of this manual. Volume 2 3-8B8976049/01 Timeout: reserved: The TF Interface on the CP 143 TF 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum residence time of the job in the interface module). This is specified in multiples of 0.1 sec. If the job is completed within the specified time, the parameter is irrelevant. If the residence time of the job elapses without an acknowledgement arriving, the following actions are initiated by the interface module: 1. The job status is set to job complete with error" (can be obtained with a Control call in the PLC). Error number in status word: D TF error number: 2041 (see Appendix) 2. If the acknowledgment arrives later it is destroyed. 3. Link terminated and static link automatically re-established. 1 word, not available to the user. 3-9 Volume 2The TF Interface on the CP 143 TF B8976049/01 3.2.2 Sequence on the Client Interface Parameters for the HDB The configured job buffer for a TF job is transferred by calling a SEND-direct job in the S5 user program. The call parameters are as follows: SSNR FB ANR SEND ANZW $5-ADD. PAFE Fig. 3.3 Call Parameters "SEND Direct" Support by the Request Editor After the job buffers have been configured, the COM 143 tool TF-REQUEST-EDITOR supplies the parameters for calling the SEND-direct job. Sequence and messages After transferring the buffer, the status of the job (status byte in the dual-port RAM) is set to job active" by the CP 143. Depending on the service, the communications processor requires data from the PLC or must transfer data to the PLC. To allow for this data transfer, the jobs are processed by the background communication between the PLC and CP. This background communication is implemented by calling the SEND-ALL or RECEIVE-ALL handling block. When the job is completed, the status is set by the communications processor to "job complete with/without errors. Note: The exact sequence of a service is described in detail in the individual chapters. Segmentation of the data which may be necessary with the all" calls is not discussed in these chapters, but is supported by the communications processor whenever necessary. Volume 2 3-10B8976049/01 The TE Interface on the CP 143 TF Description of the HDB Call Parameters The following parameter descriptions are based on Figure 3.3. SSNR: 0 ... 255, the correct base interface number must be set on the hardware of the CP ANR: 1... Max_ANR Max_ANR : 127 Only odd job numbers are permitted for TF jobs (see "Configuring, Test"). The following job numbers have a special significance: 205: configuration of the local VMD (local job) 203/204: reserved 218: clock functions ANZW: Status word as specified in the HDB description, however, extended to three words:: 1st and 2nd word: same significance as in the description of the CP handling blocks 3rd word: if the status "job completed with error" is entered in the 1st word and the error number remote error occurred is indicated, the 3rd word is valid and specifies the TF error in greater detail. Error numbers are normally taken from the reply (ERRCLS/ERRCOD). Additional unique codes were also defined for several errors. 15 1st word | free Error Data Status management management management 2nd word Length word 3rd word TF error (ERRCLS/ERRCOD) 3-11 Volume 2The TF Interface on the CP 143 TF B8976049/01 ANZW: The TF error number is valid when (continued) Status = Job completed with error The following are distinguished in the error codes a) Error in the local protocol handler b) Error in the remote protocol handler c) Error for all function classes d) Error for special function classes (e.g. serial transfer) In addition to these errors defined in TF, there are also the following: e) Errors on the client side (e.g. after analysis of the job buffer) f) Errors that are specified in more detail for the variable services in the "access result" parameter . {errcls = 82H, errcod = 4xH) The possible error codes and the causes of errors are described in the Appendix in Volume 2 of this manual. Selecting the status word The status word specified in the SEND-direct HDBs should match the status word selected during the configuration of an application association. If these status words do not match, the entry in the ANZW of the HDB is incomplete after the job has been processed. The information about data management, the transmitted length and the SINEC TF error word are missing (this information is then in the ANZW of the configured link). Instead of configuring the status word, this can be stipulated using a configuration job (refer to the section on supplementary services and the section describing the request editor). Volume 2 3-12B8976049/01 The TF Interface on the CP 143 TF S5-ADD.: Source address of the job buffer: Source identifier: DB/DX DB/DX no.: 1...255 DW no.: 0... 2042 Length: max. 256 bytes (128 words) PAFE Parameter assignment error byte The possible error codes and the causes of errors are described in Appendix C in Volume 1 of this manual. is In the following descriptions, the term "data block" means a DB or if permitted DX. 3-13 Volume 2The TF Interface on the CP 143 TF B8976049/01 3.3 General Server Interface The Principle of Activating the Server Function The TF server functions are handled on the CP 143 largely without support of the CPU on the programmable logic controller. TF jobs are interpreted by the CP 143 and executed with the PLC via the background communication, so that only a "SEND-ALL" and "RECEIVE-ALL" handling block call is required. This applies to the following: > all TF variable services > domain services > program invocation services (Pl services) > general services for virtual manufacturing devices. Configuring Local Variables Local variables (i.e. variables managed on the CP 143 in the server role and which can be read or written) must be configured with the configuration tool COM 143 TF: > for link-specific variables in the application associations screen > for VMD-specific variables using the VMD variable editor or with the COM 143 tool PGLOAD > for domain-specific variables Service-specific selections The server interface is explained for the specific service. Special features when using domain and PI services are described in the section "TF Services for implementing a CIM Network". Volume 2 3-14B8976049/01 The TF Interface on the CP 143 TF Special features with serial transfer In contrast to the services mentioned above, with the non-open service transparent data exchange", the service request must be transferred to the programmable logic controller on the server side, since the data can only be interpreted there. This "general interface" is explained in the section "Serial Data Transfer". For this reason, a configuration job is necessary on the server side for the non-open service "Read/write byte string. 3-15 Volume 2NotesB 8976049/01 TF Variable Services 4 TF Variable Services This chapter contains the information you require to use the variable services. You can use this chapter in two ways: > as a tutorial for configuring and programming variables and variable services (Section 4.1 Basics with checklist) > as a source of reference when programming variable service jobs (Section 4.2 Service Description) You can decide which services you require for your task based on the description in Chapter 2 "The TF Model and the TF Services. Overview of the services: The following services are described for the initiator: > Read variable and how to configure remote variable definitions > Write variable and how to configure remote variable definitions > Information report and how to configure local variables > Read and write variable with free format addresses For the server, the scope-specific configuration of variables (local variables) is described. 4-1 Volume 2TF Variable Services B 8976049/01 4.1 Basics of the Variable Services 4.1.1. Description and Management of Variables Definition Variables are unstructured or freely structured data objects of the application system which can be read or written with the variable services. Describing variables The structure of these data objects must be formulated in a type description. The type description is required both on a client and on the server in a network. > PLC is server: The type description is stored on the CP by configuring with the COM 143 TF tool. Configuring involves the local variables since the source of the variable to be read or the destination of the variable to be written is on the local device. The real variables themselves or the buffer for the variables must be available in the data area of the application program. > PLC is client: The type description is either transferred to the CP in the job buffer or is stored by configuring with the COM 143 TF tool. Configuring involves remote variables, since the source of the variables to be read or the destination of the variables to be written is on the partner. A buffer must be available for the read or written data in the user pro- gram (DB, DX block). Volume 2 4-2B 8976049/01 TF Variable Services Description and Management of Variables (continued) Special feature of the information report service When reporting a variable, the initiator of the transfer is the device on which the variable object was configured as a local object. The initiator of the job is therefore the device with the "server" role. To be able to receive reported variable values, the variable must be configured as a remote object on the receiver. Client: significance of the job buffer for the variable description In the job buffers, only simple types (basic data types) and arrays of simple types are supported. These can be coded in four words. If more complex variables are involved, the user must configure this in COM 143 TF (TF definitions). If the variable is configured, the four words in the job buffer have the value 0. The following more complex data types are supported but must be configured for the client access: > Structures with components of the basic data type > Structures with components containing structures with components of the basic type > Structures containing components that are arrays of a basic type > Arrays with elements that are structures whose components are of the basic data type > Arrays whose elements are arrays containing elements of a basic data type Note: detailed information about the type description can be found at the end of this chapter. 4-3 Volume 2TF Variable Services B 8976049/01 4.1.2. Scope of Variables in a SIMATIC S5 Programmable Logic Controller Meaning Each variable is assigned a scope. This allows remote access to the variable on the PLC (via the network) to be restricted. The following scopes are possible: a)VMD-specific: Since in SIMATIC $5 a programmable logic controller always represents a VMD, this scope means that the variable is valid and known in the whole station. Access to the variable is permitted via every application association regardless of whether a particular program or particular pro- gram section (domain) is loaded. A VMD-specific variable is visible from every station, i.e. every station can access this variable via any applicati- on association. Application: Global lists or variables accessed by different programs in the PLC. Server configuration: VMD-specific variables are configured with COM 143 TF using the functi- on VMD variable editor (local variables). Client configuration: On the client, the variable must be configured if it is more complex (data type description > 4 words). The variable is, however, configured for the application association as a remote variable. b)Domain-specific: Domain-specific variables are also assigned to the whole VMD and valid within it. The existence of such variables, however, depends on whether a particular program or particular program section (domain) is loaded. Domain-specific variables are always assigned to a specific program. Ac- cess to domain-specific variables is possible via all application associati- ons. Volume 2 4-4B 8976049/01 TF Variable Services Scope of the Variables in the SIMATIC S5 (continued) Application: Domains can be understood as a cocoon around an application pro- gram for a specific automation task. Domain-specific variables are then local variables belonging to this application program and are protected by the domain "cocoon". Server configuration: The type description of the domain-specific variables is only required when the domain is loaded on the PLC. For this reason, the type confi- guration must be made with the COM 143 TF tool PGLOAD. PGLOAD generates and loads domains. Client configuration: On the client, the variable must be configured if it is more complex (data type description > 4 words). The variable is, however, configured for the application association as a remote variable. c) Link-specific: Link-specific (or application association specific) variables are assigned to a particular application association. The variable is only visible via this link, i.e. it is only possible to access the variable via this link. Access does not depend on a particular program being loaded. Application: The application association is capable of allowing access to one of se- veral tasks on a VMD. The use and access to data areas can therefore be resiricted to a specific task by means of a link-specific assignment. Server configuration: Link-specific variables are configured using the sub-function local varia- bles during link configuration with COM 143 TF. Client configuration: If the variable is more complex (data description > 4 words) a variable configuration is necessary on the client. 4-5 Volume 2TF Variable Services B 8976049/01 Scope of the Variables in the SIMATIC S5 (continued) Fig. 4 .1 provides an example of a complete virtual device, two domains, a program invocation and assigned variables. PIs 7 VM D I Pl "ARTHUR" |: || vamp variables: | Domains: | | "VDI" Al Domain John Domain Mike | ' wb" f | | ; | 1 ; Domain variables: Domain variables: | | ' DOMA1" ' l DOMA2" none | | ane (=F Sasa m ' sped fic LINK11" none ' variables: LINK12" ' Appl. ass. 1 Appl. ass. 2 Fig. 4.1 Example of VMD Structure There are two application associations to the virtual device: application association 1, application association 2. The variables "LINK 11" and "LINK 12" have a link-specific scope and are assigned to application association 1. Access to these variables is only possible via application association 1. The variables "VD1" and "VD2" have the VMD-specific scope. Access to these variables is possible via application association 1 and application association 2. Within the virtual device, there are two domains, domain "John" and domain Mike. The two variables "DOMA1" and "DOMA2" have the domain-specific scope and are assigned to the domain "John". Access to these variables is possible both via application association 1 and application association 2 by Volume 2 4-6B 8976049/01 TF Variable Services Scope of the Variab'es in the SIMATIC S5 (continued) specifying the domain name "John" and the variable name "DOMA1" or "DOMA2". The domains John" and "Mike" are used by the program invocation "ARTHUR". The program invocation "ARTHUR" can be addressed both via application association 1 and application association 2. The services address the object of the server since the object reaily exists there. 4-7 Volume 2TF Variable Services B 8976049/01 Scope of the Varialles in the SIMATIC S5 (continued) Access to variable objects The key to accessing an object and object description is the name for logical addressing (possibly also access via address without scope). These names are listed on the VMD in the object description. Access is controlled and restricted by the scope and the link. Figure 4.2 illustrates the ways of accessing a variable using a name. Scope Identified by Access/report via Virtual device Variable name One or more application associations Domain Domain name and One or more application variable name associations Link Variable name Exacily one application association Fig. 4.2 Access to Variables Dependent on Scope For reporting variable values, domain-specific or VMD-specific variables can also have more than one application association available. Which of these application associations is used is specified by the SSNR/ANR of the SEND job. Volume 2 4-8B 8976049/01 TF Variable Services 4.1.3 Checklist for the Application This checklist specifies the steps you must take when using the variable services. initiating jobs for variable services means the following: > Configuring the job buffer (request editor or direct programming of the blocks in STEP 5 LAD/CSF/STL). > Specifying the variable definition (data type description): - with simple variables (max. 4 data words) in the job buffer - with complex variables by configuring on the CP. > Referencing the job buffer in the HDB program call. > Integrating the HDBs and the status evaluation in the PLC program. Using variable services with the PLC in the server role means the fol- jowing: > Specifying the variable definition (data type description) by configuring on the CP. > Integrating the HDBs (SEND ALL and RECEIVE ALL) and the status evaluation in the PLC program. 4-9 Volume 2TF Variable Services B 8976049/01 4.2 Service Description 4.2.1. Read Variable (Client) Meaning With the read variable service, a client application can read a variable on a server. The data of the variable are transferred from the server to the client in the acknowledgment and entered under the local S5 address of the client (data block). lf the description of the data type requires more than 4 data words, the data description of the variable must be configured as a remote variable on the CP of the client. Job buffer "read" KS: Gen. KS: Opcode 4 bytes (ASCII), V-RE section KF: Timeout Monitoring time in 0.1 sec reserved = . $5 destination address $5 KS: Identifier DB, DX address KY: u |_DB no. Block number KF: DW no. Offset in DB or DX KS: Data Specification of the data KF: ype spec. types of the variables KS: KF: T KS: Scope Scope of validity: VM, DO, VB KY. 0 | Length Length of the following name Rem. KS Var. Variable name name spec. KY: 0 | Length Length of the following name KS: 1 Domain as Domain name name Fig. 4.3 Structure of the Job Buffer for TF Variable Service "Read" Volume 2 4-10B 8976049/01 TF Variable Services Read Variable, Client Interface (continued) Call description General section: Opcode V-RE Timeout 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. $5 address: Description of the local destination address for the service. Identifier 1 word, format: KS Range of values:DB, DX DB for data block DX for extended data block DB no. 1 word, format:KY Range of values:high byte: 0, low byte: 0-255 Meaning:DB or DX number If the identifier is DB or DX, the DB no. can also be 0. This means that there is no address specified in the job buffer. The addressed variable (see below) must then be completely programmed i As $5 address, you can only use data blocks not reserved by the CPU as system DBs (e.g. DB1). Otherwise the job is aborted with an error. 4-11 Volume 2TF Variable Services B 8976049/01 Read Variable, Client Interface (continued) DW no. 1 word, format:KF Range of values:0 - 2042 This is an offset within the data block or extended data block. The length parameter required for the complete definition of an S5 address is not specified. This is calculated in the PC from the type information for the variable. Data Type Description: This defines the data type of the addressed TF object. In the job bufters, only simple types (basic data types) and arrays of simple types are supported. These can be coded in four words. If the variable is more complex, the user must program this completely in COM 143 TF. If the variable is programmed, the four words in the job buffer have the value 0 or blank. Data type 1 word, format:KS permitted values: see Table 4-2, page 4-40. Type 1. word, format:KF specification permitted values: see Table 4-2, 4-40. Remote Object Description: A network object is defined by the name and scope, i.e. a variable name, for example, must be specified here in the job buffer. In one job, the SIMATIC PLC acting as client can only ever access one variable. Scope 1 word, format:KS Range of values:VM, DO, VB Meaning: VM:VMD-specific The variable is known and valid throughout the whole destination station. DO:Domain-specific The variable is only valid in a particular domain in the destination station. In this case, the name of the domain must also be specified. Volume 2 4-12B 8976049/01 TF Variable Services Read Variable, Client Interface (continued) Length Variable name: Length Domain name: VB:Link-specific The specified variable is only valid for the link identified by the interface number/job number. 1 Byte, format:KY (low byte) Range of values:1 to 32 Specifies the number of following valid bytes (length of the variable name). n bytes, format:KS lf the length of the variable name is odd, the last byte has no significance. 1 word, format:KY Range of values: high byte:0 low byte:1 to 32 Specifies the number of following valid bytes (length of the domain name; only with scope=DO). m bytes, format KS If the length of the domain name is odd, the last byte has no significance. 4-13 Volume 2TF Variable Services Read Variable, Client Interface (continued) B 8976049/01 Sequence description (Read, positive acknowledgment) PLC (client) SSNR_ --_F ANR | $5 add, SEND |pare ~ 7 Ldirect_| y V-RE loc. rem. param. Job buffer without data ANR=0} ANzw]._F RECEIVE ALL param. | | | | | | | | | | L DB/DX CP __V-RE loc. | param. rem. | param. Anzw = job_active Compile AP-PDU - Name from job buffer - Type from job buffer or programmed Send AP-PDU Read_reply (pos.) received Enter receive request in DPR - $5 adddress from the job buffer or programmed q vata Anzw = job_completed_without_error Fig. 4.4 Sequence Description (Read, Positive Acknowledgment) Volume 2B 8976049/01 Read Variable, Cliert Interface (continued) TF Variable Services Sequence description (Read, negative acknowledgment) PLC (client) CP SSNR ANR | fap | ___ ANZW SEND ~ add. direct PAFE ; | _V-RE { V-RE 7 | loc. |. | loc. | param. || param. | rem. | | rem. | param. | param._| | Job | Anzw = job_active | butfer | Compile AP-PDU without . | data | - Name from job buffer | _DB/DX - Type from job buffer | ~ or programmed | If local error occurred: | skip sending PDU p | continue with receive request | If no error occurred: ) Le =| send AP-PDU Read_reply (neg.} received | SSNR or dwell time exceeded ANR=O | Enter receive request in DPR ANZw|__F8 = - $5 address from ANWZ RECEIVE ALL | { ERROR NUMBER Anzw = job_terminated_without_error Fig. 4.5 Sequence Description (Read, Negative Acknowledgment) 4-15 Volume 2TE Variable Services B 8976049/01 4.2.2 Read Variable (Server) The TF variable service read variable is interpreted and executed in the server communications processor largely without the support of the CPU of the programmable logic controller. In the PLC program, only the CP handling blocks "SEND ALL" and "RECEIVE ALL must be called. The variables to be read, must be configured as local variables specifying the scope. If the requested variable type does not match the configured variable type, the CP 143 generates a negative acknowledgment. Volume 2 4-16B 8976049/01 . TF Variable Services 4.2.3. Write Variable (Client) Meaning With the service write variable, a client application can write to a variable on a server. The data of the variable are transferred from the client to the server and entered in the local variable on the server by overwriting the existing content. if the description of the data type requires more than 4 data words, the description of the data type of the variable must be configured on the CP as a remote variable. Write Job Buffer KS: Gen. KS: Opcode 4 bytes (ASCII), V-WR section KF: Timeout Monitoring time in 0.1 sec reserved $5 source address $5 KS: Identifier DB, DX, DA address KY: Q__|_DBno. Block number KF: DW no. Offset in DB or DX KS: Data type Specification of the data KF: Type spec. type of the variables KS: Data type KF: Type spec. KS: Scope Scope of validity: VM, DO, VB KY: O {Length Length of the following name KS: Var. L_- . Rem. = name = Variable name Spee. KY: Oo [_ Length Length of the following name KS- Domain = Domain name - name = Data (if DA identifier = specified) == Fig. 4.6 Job Buffer for TF Variable Service "Write" 4-17 Volume 2TF Variable Services B 8976049/01 Write Variable, Client interface (continued) Call description General section: Opcode: V-WR Timeout: 1 word, format:KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. $5 address: Description of the local source address or indicates that the data are in the buffer. Identifier: 1 word, format:KS Range of values:DB, DX, DA DB for data block DX for extended data block DA for data in the job buffer Note on the DA" identifier: Apart from the TF service specification and the required parameters, the $5 user program can also transfer the data completely to the CP. This is possible when the specified S5 address is a data source. This allows a considerable increase in the data throughput, as can be seen in the description of the sequence. When using this facility, remember that a job buffer must not exceed 256 bytes. The data must follow on immedi- ately after the last valid parameter of the job buffer. If the DA identifier is specified the next two words are invalid. DB no.: 1 word, format:KY Range of values:high byte: 0, low byte: 0-255 Meaning:DB or DX number Volume 2 4-18B 8976049/01 TF Variable Services Write Variable, Client Interface (continued) If the identifier is DB or DX, the DB no. can also be 0. This means that there is no address specified in the job buffer. The addressed variable (see below) must then be completely configured. TS As S5 address, you can only use data blocks not reserved by the CPU as system DBs (e.g. DB1). Otherwise the job is aborted with an error. DW no.: 1 word, format:KF Range of values:0 - 2042 This is an offset within the data block or extended data block. The "length" parameter required for the complete specification of an S5 address is not specified. This is calculated in the CP from the type information for the variable. Data Type Description: This defines the data type of the addressed TF object. In the job buffers, only simple types (basic data types) and arrays of simple types are supported. These can be coded in four words. If the variable is more complex, you must configure this as a remote variable. If the variable is configured, the four words in the job buffer have the value 0. Data type: 1 word, format:KS permitted values:see "Table 4-2, page 4-40, Type 1 word, format:KF specification: permitted values:see Table 4-2, page 4-40, Remote Object Description: A network object is defined by the name, i.e. a variable name must be specified in the job buffer. In one job, the SIMATIC PLC acting as client can only ever access one variable. According to the conventions of TF, you must also specify the scope. 4-19 Volume 2TF Variable Services B 8976049/01 Write Variable, Client Interface (continued) Scope: Length Variable name: Length Domain name: 1 word, format:KS Range of values:VM, DO, VB Meaning: VM: VMD-specific The variable is known and valid throughout the whole destination station. DO: Domain-specific The variable is only valid in a particular domain in the destination station. In this case, the name of the domain must also be specified. VB:Link-specific The specified variable is only valid for the link identified by the interface number/job number. 1 word, format:KY (low byte) Range of values:1 to 32 Specifies the number of following valid bytes (length of the variable name) Box names are restricted to a maximum of 8 characters. n bytes, format:KS If the length of the variable name is odd, the last byte has no significance. 1 word, format:KY Range of values: high byte: 0 low byie: 1 to 32 Specifies the number of following valid bytes (length of the domain name). m bytes, format:KS If the length of the domain name is odd, the last byte has no significance. Volume 2B 8976049/01 TF Variable Services Write Variable, Client Interface (continued) Data with identifier DA: Daia If the source identifier is DA, the CP expects the current values of the data to be transmitted according to the data type description. 4-21 Volume 2TF Variable Services Write Variable, Client Interface (continued) B 8976049/01 Sequence description (write, positive acknowledgment) PLC (client) SSNR --- ANR FB S5 add) SEND |pare ar | V-WR loc. pararn. |" | rem. param. | Job | buffer | without data | | | | SSNR | ANR=0 FB SEND DB/DX AlacL | 1-280 CP ~V-WR7 loc. | | param. rem. | | param._ Anzw = job_active Compile AP-PDU - Name from job buffer - Type from job buffer or programmed e Enter SEND request in DPR .- S5 address from job buffer or programmed Data AP-PDU >on L__| Send AP-PDU =) Write_reply (pos.) received { Anzw = job_completed_without_error Fig. 4.7 Write with Source ID "DB" or "DX" Volume 2B 8976049/01 . Write Variable, Client Interface (continued) PLC (client) SSNR ANR ANZW S5 add. FB SEND direct PAFE _- [ V-WR | loc. param. rem. param. data Job buffer with data Fig. 4.8 Write with Source ID "DA" TF Variable Services CP | V-WR_ loc. | aram. | rem. | param. _ | data | Anzw = job_active Compile AP-PDU - Name from job buffer - Type from job buffer or programmed - Data from job buffer e Send AP-PDU ) (- Anzw = job_completed_without_error Write_reply (pos.) received Volume 2TF Variable Services Write Variable, Client Interface (continued) B 8976049/01 Sequence description (write, negative acknowledgment) PLC (client) FB }= =! SEND | PAFE direct V-WR loc. rem. param. SSNR Job buffer without/ with param. | | | | | | data lL ANR=0 ANZW FBO Wo_ RECEIVE _ ALL L Fig. 4.9 4 ERROR NUMBER | CP | V-WR_ loc. | param. | rem. | | param. Anzw = job_active AP-PDU compiled - Name from job buffer - Type from job buffer or programmed If local error occurred: skip sending PDU continue with receive request If no error occurred: e if nec. execute send-all send AP-PDU ) Write_reply (neg.) received { or dwell time exceeded Enter receive request in DPR - S5 address from ANZW { ERROR NUMBER Anzw = job_terminated_with_error Sequence Description (Write, Negative Acknowledgment) Volume 2B 8976049/01 TF Variable Services 4.2.4 Write variable (server) The TF variable service write variable-is interpreted and executed in the server communications processor largely without the support of the CPU of the programmable logic controller. In the PLC program, only the CP handling blocks "SEND ALL" and "RECEIVE ALL" must be called. The variables to be written, must be configured as local variables specifying the scope. If the requested variable type does not match the configured variable type, the CP 143 generates a negative acknowledgment. 4-25 Volume 2TF Variable Services B 8976049/01 4.2.5 Information Report (Client) Meaning With the information report service, an application can send a variable unsolicited to a another application. The data of the variables is transferred in the job and entered in the buffer made available by the receiver. With this service, the data description of the variable must be configured as a local variable (with scope) on the CP of the client. On the receiver, the variable must be configured as a remote variable. It is also possible to group variables together during configuration and to specify such a group in the job. This makes it possible to transfer several variables in one job. Information report job buffer KS: Gen. KS: Opcode 4 bytes (ASCII), V-IN section KF: | ___ reserved | KS: Scope Scope of validity: VM, DO, VB KY: [Box ID | Length Length of the following name : Box ID for access to several KS: i Var./foox L_- Local ee == variables object name Variable name KY: QO {| _Length Length of the following name KS: 1 Domain _ Domain name LL name Fig. 4.10 Structure of the Job Buffer for TF Variable Service "Information Report" Volume 2 4-26B 8976049/01 TE Variable Services Information Report, Client (continued) Call description General section: Opcode V-IN Local object: For the information report" service, with which a local object (or its value) is transferred to another station, the local object is described by the name. Scope: 1 word, format:KS Range of values:VM, DO, VB Meaning: VM:VMD-specific The variable is known and valid in the whole VMD DO:Domain-specific The variable is only valid in a particular domain in of the local VMD In this case, the name of the domain must also be specified. VB:Link-specific The specified variable is only valid for the link identified by the interface number/job number. Box ID: 1 byte, format:KY (high byte) Range of values:0 to 1 Meaning: The term box is used to mean a collection of variables forming a group of VMD-specific variables. If you select box iD = 0, only one single variable is involved, otherwise several variables are requested with one call. The following name is then not interpreted as a variable name but as a box name. The collection of variables under a "box name is performed using COM 143 TF. In this case, the domain name in the job buffer does not exist. Length 1 word, format:KY (low byte) Range of values:1 to 32 Specifies the number of following valid bytes (length of the 4-27 Volume 2TF Variabie Services B 8976049/01 Information Report, Client (continued) Variable name /Box name: Length Domain name: variable name or box name) Box names are restricted to a maximum of 8 characters. n bytes, format:KS lf the length of the variable name is odd, a byte is appended at the end of the name. 1 word, format:KY Range of values: high byte: 0 low byte: 1 to 32 Specifies the number of following valid bytes (length of the domain name) m bytes, format: KS If the length of the domain name is odd, a byte is appended at the end of the name. Volume 2B 8976049/01 Information Report, Client (continued) TF Variable Services Sequence description (information report, positive acknowledgment) PLc (Server) SSNR ANR ANZW FB }=_] $5 add} SEND | PAFE =e | _ V-IN rem. param. Job buffer without data SSNR ANR=0 FB SEND ALL DB/DX CP | V-IN | , local lobject | Anzw = job_active e Compile AP-PDU Name from job buffer - Type programmed e Enter send request in DPR - S5 address programmed Fig. 4.11 Information Report Data _AP-PDU | | e Send AP-PDU > Pos. transport ack. received _ Anzw = job_completed_without_error 4-29 Volume 2TF Variable Services Information Report, Client (continued) B 8976049/01 PLC CP SSNR ANR z_ ANZW FB $5-ADR SEND | PAFE T direct Le _ VIN VN | = Box ID 1] 1 Lo IeGroup- [eGroup- Name> Name> es - Begin compiling TF-PDU - Find programmed group name - 1st programmed var. name - Programmed type of 1st variable SSNR - Enter SEND request and request data aNROO _=z_.. of the 1st variable ANZW FB SEND | PAFE - Continue compiling TF-PDU ALL - 2nd programmed var. name - Programmed type of 2nd variable - Enter SEND request and request data of the 2nd variable SSNR ANR=0 ANZW FB SEND | PAFE _ALL | - Continue compiling TF-DPU . - nth programmed var. name - Programmed type of nth variable - Enter SEND request and SSNR request data of the nth variable ANRoO <a - Send AP-PDU ANZW FB "| SEND | PAFE > _ALL 4 - Positive transport ack. received - ANZW = job completed without error Fig. 4.12 | Reporting Several Variables in One Call Volume 2 4-30B 8976049/01 Information Report, Client (continued) TF Variable Services Sequence description (information report, neg. acknowledgment) PLC (client) SSNR ANR | fp ANZW | SEND S add. girect PAFE | VEIN loc. | _ param. rem. param. Job buffer SNR Al ANAW) sip SSadd. ENP _PAFE DB/DX SSNR ANR= FB ANZW RECEIVE TALL | i [ERROR NUMBER | CP VEIN loc. param. Anzw = job_active Compile TF-PDU - Name from job buffer - Type from job buffer or programmed If a local error occurred: skip sending PDU continue with receive request If no error occurred: send TFPDU Transport ack. (neg.) received or dwell time exceeded e Enter receive request in DPR - $5 address from ANZW ERROR NUMBER Anzw = job_terminated_with_error Fig. 4.13 Sequence Description (Report, neg. Acknowledgment) 4-31 Volume 2TF Variable Services B 8976049/01 4.2.6 Information Report (Receiver) The TF variable service information report is interpreted and executed in the receiving communications processor largely without the support of the CPU of the programmable logic controller. In the PLC program, only the CP handling blocks "SEND ALL" and "RECEIVE ALL" must be called. The variables to be reported must be configured as remote variables on the receiver specifying the scope. Volume 2 4-32B 8976049/01 TE Variable Services 4.3. Read and Write Variable with the Option of Addressing via a Free Format Address The free format read/write service provides a more flexible form of access to variables. This means the following: > A direct and therefore more efficient access to the source or destination data area on the partner PLC is possible. > Flexible adaptation to the address format of the partner device is possible. > The variable does not need to be configured on the server. The use of this service is, however, restricted compared with access using a name. > Variable access cannot be differentiated and there is therefore no access protection using a scope (the scope is always VMD-specific). > The transferred variables always have the type identifier octet string, i.e. differentiation according to a task-oriented variable structure is not possible. 4-33 Volume 2TF Variable Services 4.3.1 Client Interface B 8976049/01 The option of addressing via the free format address is permitted for variables of the octet string type. The service supports access to complete variables of up to 32 characters. Alternative access is not supported. Write job buffer KS: Gen. KS: section KF: $s KS: address KY: KF: KS: KF: KS: KF: KS: KY: Rem. KS: spec. = Opcode Timeout reserved Identifier 0 | DBno. DW no. "OS" Length 0 0 Scope = "VM" Box ID Length =12h Lene l Format-free address 0 \\ W Data {if DA identifier <= specified) \\ 4 bytes (ASCII), V-WR V-RE Monitoring time in 0.1 sec $5 source address DB, DX, DA Block number Offset in DB or DX Type description Scope of validity: VM Length of address Variable name Format-free address up to 32 characters (see following page Fig. 4.14 Addres: Buffer for Variable Services Read and Write with Free Format Address Volume 2B 8976049/01 ; TF Variable Services Read/Write Variable: via Free Format Address, Client Interface(continued) Call description General section: Opcode: V-WR, V-RE Timeout: 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. S5 address: Description of the local source address or indicates that the data is in the job buffer. identifier: 1 word, format:KS Range of values:DB, DX, DA DB for data block DX for extended data block DA for data in the job buffer (only with V-WR) Note on identifier "DA": Apart from the TF service specification and the required parameters, the S5 user program can also transfer the data completely to the CP. This is possible when the specified S5 address is a data source. This allows a considerable increase in the data throughput, as can be seen in the description of the sequence. When using this facility, remember that a job buffer must not exceed 256 bytes. The data must follow on immedi- ately after the last valid parameter of the job buffer. If the DA identifier is selected, the next two words are invalid. DB no.: 1 word, format:KY Range of values:high byte: 0, low byte: 2-255 Meaning: DB- or DX number DW no.: 1 word, format:KF Range of values:0 - 2042 4-35 Volume 2TF Variable Services B 8976049/01 Read/Write Variable via Free Format Address, Client Interface(continued) Offset within the data block or extended data block. Data Type Description: The data type is an octet string, the length is determined by the data block limit. Data type: 1 word, format:KS permitted value:"OS" Type 1 word, format:KF specification: String type:Number of bytes in a string Remote Object Description: The format-free address can be freely defined by the user. For communication between an S5 PLC and an $5 PLC, select a structure as described above. The scope of validity is always VM. Identifier 12 indicates the job read/write variable with free format addressing. Length 1 byte, format:KY (low byte) Range of values:1 to 32 Specifies the number of following valid bytes of the free format address an. with S5: length = 8 for type 0 (see Figure 4.15) length = 11 for type 1 (see Figure 4.16) Free Format Address: The siructure of the free format address is represented for communication between SIEMENS programmable controllers. The format-free address with a status word is used by the S5 program for coordination when several PLC cycles are required for the data exchange between the CPU and CP. Volume 2 4 - 36B 8976049/01 TF Variable Services Read/Write Variable via Free Format Address, Client Interface(continued) Type and CPU ID 65 KY: 0 CPU no. KY: | Org. ID DB-NO address KF: Start address KF: Number Fig. 4.15 $5-Specific Free Format Address in Job Buffer without Status Word $5 KY: 1 CPU no. address ee: Org. iO | DBNO {F: ar eeaess Token characters KF: Number KY:| Data type DB no. Status : word KY:| Start address Fig. 4.16 S$5-Specific Free Format Address in Job Buffer with Status Word es For communication between SIEMENS programmable con- trollers and a non-SIMATIC unit, the format-free address can have a different structure. S5 address: Description of the local source address or indication that the data are contained in the job buffer. 4-37 Volume 2TF Variable Services B 8976049/01 Read/Write Variable via Free Format Address, Client Interface(continued) CPU No.: 1 byte, format:KY (low byte) Range of values:1 to 4 Meaning: specifies the CPU no. in which the variable will be written. Org identifier: 1 byte, format:KY (high byte) Range of values:01,10 Meaning: address to which the variable will be written 10 for extended data block (DX) 01 for data block (DB) DB No: 1 byte, format:KY (low byte) Range of values:1 to 255 Meaning: if DB/DX, data block number to which the variable will be written; otherwise no significance. Start address: 1 word, format:KF Range of values:0 to 2047 Meaning: start address from which the variable will be stored in the data block. Number: 1 word, format:KF Range of values:1 to 2048 Meaning: number of data values to be transferred. Status word: Type: 1 byte, format:KY (high byte) Range of values:01,02,03,255 Meaning: type of status word (see Table 1). DB no.: 1 byte, format:KY (low byte) Range of values:0 to 255 low byte:DB- or DX number Start address: 1 byte, format:KY (high byte) Range of values:0 to 255 (DW), 1 to 255 (flag area) Meaning: area for storing the status word Volume 2 4-38B 8976049/01 TF Variable Services Read/Write Variable via Free Format Address, Client Interface(continued) Status word Type Values Type Flag area 01H DW in DB area 02H DW in DX area 03H No status word FFH DB number DB-Nr. 0 to 255 DX-Nr. 0 to 255 irrelevant with type = flag area DW number Flag word no. 1 to 255 DW-Nr. 0 to 255 Tabelle 4.1:Status Word Data with identifier DA: lf the source identifier is DA, the CP expects the current values of the data to be transmitted according to the data type description. The sequence descriptions correspond to those of the services Read variable" and "Write variable" via object addressing. 4.3.2 Server Interface At the server end, only the required SEND-ALL and RECEIVE-ALL calls must be incorporated. Variables do not need to be configured. 4-39 Volume 2TF Variable Services 4.4 B 8976049/01 TF Data Types in SIMATIC S5 In this section, you will find an explanation of the data descriptions used with SIMATIC S5. You will require this information to use the variable services and for configuring variables using the COM 143 TF configuring tool. TF TYPE Meaning Corr. to TYPE _ {description $5 type BO no entry Boolean - IN 8 integer, 8 bits - 16 Integer, 16 bits KF 32 Integer, 32 bits - UN 8 Unsigned, 8 bits - 16 Unsigned, 16 bits KH 32 Unsigned, 32 bits - FP 32 Floating point number in KG MC5 format, 32 bits TI 4 Time of day, 4 bytes, format see below - TD 6 Time of day with date, format see below__|{- BS -|n Bit string, n = number of bits in string KM OS n Octet string, n = number of bytes in string |KY VS n Visible string, n= number of bytes in string |KS AR Array Number of elements in an array Table 4.2: TF Type and Meaning Volume 2B 8976049/01 TF Data Types in SIMATIC S5 (continued) TF Variable Services Explanation of the TF types and representation of the types in SIMATIC S5: 1. BO: Boolean Boolean variables are modelled on the CP on a data word in the data block. The following values are permitted: OH "false" 70H = true 2. IN: Integer 8/16/32 The TF data type integer 8 (representation 1 byte, range of values (-128 to +127)) and the TF data type integer 16 is modelled by the CP on a data word in a data block (format KF). The TF-data type integer 32 is modelled by the CP on two data words in a data block. 3. UN: Unsigned 8/16/32 The TF data type Unsigned 8 (representation 1 byte, range of values 0 to +255) and the TF data type unsigned 16 are is modelled by the CP on a data word in a data block (format KH). The TF data type unsigned 32 is modelled by the CP on two data words in a data block (format KH). 4. FP: Floating point number Floating point numbers are modelled by the CP on KG in the SIMATIC PLC. 5. Tl, TD:Time of day, time of day with date Formats in the PLC for representing the TF formats time of day and time of day with date, are as shown below:(Note: S5=8 bytes; network=6 bytes!): Bit 15 Bit 0 Time of day s*10 $*1 factor (10 ms) (4 bytes) | Time of day with date h*10 h*4 min*10 min (8 bytes) day*10 day*1 weekday 0 year*10 year*1 month*10 = |month*1 4-41 Volume 2TF Variable Services B 8976049/01 TF Data Types in SIMATIC SS (continued) Permitted values: Weekday 0 Monday seconds units: 0to9 1Tuesday seconds tens 0to5 2Wednesday minutes units: 0to9 3Thursday minutes tens 0to5 4Friday hours units: 0 to9 5Saturday hours tens 0 to 1/0 to 2 (see below) 6Sunday days units 0to9 days tens 0to3 months units: 0to9 months tens 0 to 1 years units 0to9 years tens 0to9 factor (*10 ms): | Factor (BCD-coded) * 10 ms Note on hours tens: Bit 15: 1: 24 hour format 0: 12 hour format Bit 14: 0: AM 1: PM Note: when converting the TF time representation to the PLC time format used here, the CP always uses the 24 hour format iS Every completed binary date is a valid date in the range 01.03.1984 to 29.02.2084. Before a date is transmitted it is "normalized". Example: 35.12.93 becomes 04.01.1994 35.14.93 becomes 07.03.1994 00.01.93 becomes 31.12.1992 00.00.93 becomes 30.11.1992 61.01.84 becomes 01.03.1984 but 60.01.84 becomes 29.02.1984 Volume 2 4-42B 8976049/01 TF Variable Services TF Data Types in SIMATIC S5 (continued) The individual numbers are BCD-coded, i.e. numbers between 0 and 9 are "normal". However non-normal values are also accepted. A BCD number always becomes 10*X+Y. Example: Fly becomes 1510+1 = 151 ABH becomes 10*10+11 =111 FFy becomes 15710+15 = 165 Times are also normalized in a similar way to dates. This means that more than 59 minutes can be added to an hour. A day consists of 86400 seconds. If a time and date are transmitted together and if the time is greater than or equal to the time 86400 seconds, this is converted to days and automatically added to the date. Only normalized dates and times are received. The procedure allows the user to transfer a time (base time and [optional date] plus delta time in BCD arithmetic) extremely simply. The user is not concerned with the normalization, since the date is always received in a normalized form. 6. BS: Bit string The "bit string" data type is modelled on the type "KM" known in the SIMATIC PLC. If the number of valid bits can be divided by 16 (number of bits in a data word, is modelled immediately on the resulting number of data words. Otherwise, the string is extended to the next word limit, and the bits appended must not be used in the PLC program. BS types are stored as shown below: Bit |15 ... 8 ]7.. 0 DWn|8 |7 (6 {5 |4 [3 {2 {1 $16 [15 |14 13 |12 111 110 [9 DW 124 (23 ;22 |21 |20 119 |18 |17 432 131 |30 |29 128 |27 |26 |25 n+1 7. OS: Octet string The octet string represents a string of bytes (with any content). It is modelled on the SIMATIC format (KY). An octet string with the length n occupies n/2 data words in the PLC, if n is an odd number, then (n-1)/2+1 data words are occupied and the last low byte is invalid. 4-43 Volume 2TF Variable Services B 8976049/01 TF Data Types in SIMATIC S5 (continued) 8. VS: Visible string The handling in the CP is the same as with the octet string data type, however, the range of values is restricted to representable ASCIil characters (format KS). iS The VS is not checked by the CP 143 for permitted values --> user check!! is All string types are stored in the SIMATIC PLC in ascending memory addresses. This means with data blocks that first the high byte (this is located at the lower memory address) and then the low byte is written to. The format and type conversions specified here are also carried out at the server interface, so that the user is unaware of differences in the data representation. The definition of the data base types is made in the first and second data word of the type description. In this case, the third and fourth data words are irrelevant. Arrays of data base types are defined by the user entering the ASCII characters AR" (for array) in the first data word of the type description in the job buffer and the number of elements in the array (repetition factor) in the second data word. The third and fourth data words contain the definition of the data type of the array elements. QO Volume 2 4-44B 8976049/01 TF Domain and P! Services Implementing a CIM Network 5 TF Domain and PI Services Implementing a CIM Network In this chapter you will find information required for using domain and PI services. You can decide which services you require for your task based on the description in Chapter 2 "The TF Model and TF Services". Domain services support you in task-oriented structuring of your automation task and supplying the PLC with currently required data and program code. Pl services support you in all phases of operation with the programmable logic controller. The VMD object program invocation is closely linked with the VMD object domain. Both objects describe a specific view of the same physical object or parts of the same physical object. In SIMATIC S5 this means the following: > The PLC is represented by two program invocations, a system PI and a user Pl. These Pls can be controlled using the Pl services. > The user PI includes the domains assigned to it when it is generated and within a PLC there can be up to eight loadable domains. > The system Pl covers the whole PLC. It is only used to start and stop a PLC using the PI functions. 5-1 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 5.1 Domain Services Definition A domain in the SIMATIC S5 programmable logic controller is always part of (or even the whole) PLC program. A domain always consists of one or more blocks. Overview The following domain services are available for the SIMATIC S5 PLC: > load domain content > store domain content > delete domain content > get domain attributes Generating domains To create a domain, two steps are necessary, as follows: > Creating the blocks (OB, PB, FB ...) and storing them in a block file using the STEP 5 basic package LAD, CSF, STL. > Grouping the biocks to form a domain using the COM 143 tool PGLOAD. A domain is assigned to a CPU when the domain is loaded on the PLC. The additional information "dynamic" means that the domain is loaded by a host using the TF services. When domains are discussed in this chapter, they are always dynamic domains. The function of the PGLOAD tool is described in Chapter 9 in this manual. Defining domains Which blocks are assigned to a domain is decided by the user. In practice, the blocks are grouped together to handle a definable automation task so that it is possible to adapt the program to the process by loading new domains as required. Volume 2 5-2B 8976049/01 TF Domain and Pl Services Implementing a CIM Network Domain Services (continued) Example Domains could be distributed on a CPU for example so that one domain contains the actual PLC program (OBs, FB, PBs, SBs and DBs) while another domain contains the parameters for the PLC program (normally only DBs). lf a modification is then made, normally only a parameter record must be exchanged and not the whole PLC program (e.g. changing product from red to green cars only requires a different parameter and not a different program). This division is, however, not mandatory and is not checked by the communications processor. It is also possible to split the PLC program so that not the whole program is contained in one (loadable) domain, but part is always loaded on the PLC (possibly even in an EPROM). Once again, the user can decide on the most suitable strategy. Number of domains The communications processor supports a maximum of eight dynamically loadable domains. Local services Every domain service can also be triggered locally (job number 205). iS Before this function is executed locally using ANR 205, the communications processor must first be informed of the status word ANZW (of ANR 205), refer to configuration job". Static domain SIMATIC_S5 Under certain circumstances, you may not wish to use the domain services but nevertheless want to control the program using PI services. In this case, the static domain with the name SIMATIC_SS is available. 5-3 Volume 2TF Domain and Pl Services Implementing a CIM Network B 8976049/01 Domain Services (continued) Checklist for using domain services Using domain services means the following: > Structuring domains, i.e. deciding which program or data sections (blocks) must be loaded or exchanged at what time. > Defining variables belonging to a domain and configuring them as domain-specific variables using the PGLOAD tool. > Grouping the required blocks to loadable domains using the PGLOAD tool. > Clarifying the system configuration in which the loadable domains will be managed. Will there be a third-party association (host - PLC - fileserver)? > Configuring application associations for transmitting the domain services. lf third-party associations are to be used, fileserver application associations must also be configured. Volume 2 5-4B 8976049/01 TF Domain and PI Services Implementing a CIM Network Domain Services (continued) Modes Domain services can be activated directly or indirectly. A host computer (e.g. PG, PC or PLC) can control the loading or archiving of a station (e.g. PLC) using domain services. This situation is illustrated by the following figure. File eo | PLC 1 server 3) SINEG H1/L2 @d Load domain content" request Loading sequence @ "Load domain content acknowledgement Fig. 5.1: Loading the Local PLC The host computer can, however, also request the second station to load itself from a third station (e.g. a fileserver) or to save the domains on a third station. This is known as a third-party association. Before loading blocks, the station to be loaded establishes a communications link with the fileserver. This situation is illustrated by the following Figure File server PLCt PLC2 @ SINEC H1/L2 O) Load domain content" request @) Loading sequence @ Load domain content" acknowledgement .2 Loading a Further PLC (third-party association) 5-5 Volume 2TF Domain and PI Services Implementing a CIM Network Domain Services (continued) Third-party associations are supported by the CP. This results in the following sequence between the devices: Host computer Load_domain_content_job CP Loading sequence Loading seq. with without third-party third-party association association Load_domain_content_ack. B 8976049/01 File server Initiate_application_association_job Initiate_application_association_ack. Load_request_job Begin_loading_sequence_job Begin_loading_sequence_acknowledgement Load_segment_job Load_segment_ack. Load_segment_job Load_segment_ack. End_loading_sequence_job End_loading_sequence_ack. Loading_request_ack. Conclude_application_association_job Fig. 5.3 Conclude_application_association_ack. Load Sequence with/without Third-Party Association Volume 2B 8976049/01 Domain Services (continued) The sequence of the upload sequence (archiving) is as follows: TE Domain and PI Services Implementing a CIM Network Host computer CP File server Store_domain_content_job tnitiate_application_association_job Initiate_application_association_ack. Upload_request_job Begin_upload_sequence_job Begin_upload_sequence_acknowledgement Upload_segment_job Upioad sequence Upload seq. Upload_segment_job_ack. with without third-party third-party association association . Upload_segment_job Upload_segm._job_ack. End_ upload_ sequence_ job End_sequence_acknowledgement Upload_request_ack. Store_domain_content_ack. Conclude_application_association_job Conciude_application_association_ack. L_J Fig. 5-4 Upload Sequence with/without Third-Party Association iss This means that the PG For all domain services, the CP requires the "swing cable". load services and bus communication function cannot be used simultaneously. If this is attempted, one of the two jobs will be rejected. Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 5.1.1. Load Domain Content Using the "load domain content" service, a PLC program can load a domain from a fileserver (i.e. load part of the PLC program). The destination station can either be a different network station or the PLCs own station. The PLC loads a domain in its own station by using the send direct job with job number 205. Loading a domain first initiates a compress memory function on the AS511 interface to the CPU. Job buffer load domain content" KS: : 4 bytes (ASCII), D-LO Gen. KS: Opcode yres (ASCII section KF: Timeout Monitoring time in 0.1 sec reserved . Number of capabilities used KF: | No. of capabilities in the domain KY: 0 | Length Length of the domain name KS: | Domain ae Domain name T name T (max. 32 characters) KY: 0 | Length Length of file name KS File 2 File name name (max. 64 characters) KY: 0 | Length Length of following name KS:|- __ Name of a Name of the application assoc. ~lapplication assoc. = to file server (max. 32 characters) KY: 0 Length optional: length of capability =1 KS: | Capability 0 1,2,3,4 Fig.5-5 Structure of the Job Buffer for TF Service "Request Download Volume 2 5-8B 8976049/01 TF Domain and Pl Services Implementing a CIM Network Load Domain Content (continued) Call description General section Opcode Timeout: = D-LO 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). remember that the time required for loading depends on the length of the domain. For more information about timeout, see page 3 - 9. Job-related section Number of capabilities: Length of domain name: Domain name: Format: KF Range of values: 0, 1 (for SIMATIC applications) Meaning: 0: no capabilities specified, i.e. the domain is loaded in CPU 1 (only permitted for single processor operation) (default) 1: a capability is specified that will be used by the domain. With SIMATIC PLCs, the capability is always the CPU number in which the domain will be loaded. It is, however, possible to specifiy more than one capability if this is required in the destination station. If the SIMATIC S5 PLC is operating as the server, this job request is acknowledged negatively. Format: KY Range of values: high byte: 0 low byte: 1..32 Meaning: length of the following domain name Format: KS Name of the domain to be foaded. If the length of the domain name is odd, a padding byte is appended. 5-9 Volume 2TF Domain and PI! Services Implementing a CIM Network B 8976049/01 Load Domain Content (continued) Length of Format: KY fie name. Range of values: high byte: 0 low byte1...64 Meaning: length of the file name (including path) File name. Format: KS Meaning: name of the file on the fileserver containing the domain. Length of name of Format: KY appl. ass. to Range of values: high byte: 0 fileserver: low byte: 1...32 Name of appl. Format: KS ass. to Meaning: name of the link via which the fileserver: fileserver can be obtained by the destination station (third-party association).; Length of capability: Format: KY Range of values: high byte: 0 low byte: 1 (bei SIMATIC $5) Meaning: length of the first capability. The first capability describes the CPU belonging to the domain. Capability: Format: KS Range of values: for SIMATIC S5 feasible: 1, 2, 3, 4 Meaning: specifies the CPU number in which the domain is to be loaded. Note: The job buffer illustrated in the diagram only contains one capability, since only one is necessary for SIMATIC S5. When generating the buffer with the TF editor, only one capability can be specified. If more are required for links to other systems, the capabilities list and the number can be increased. The job buffer must not, however, exceed a length of 256 bytes. Volume 2 5-10B 8976049/01 TE Domain and PI Services Implementing a CIM Network Load Domain Content (continued) PLC (client) CP SSNR ANR=205 EB ANZW a 5 addr_| SEND [pare | Ldirect_ ~~ - | D-LO | , DLO- | "Name" _ "Name" | _ L _ _| butter Anzw = job_active e Loading sequence after sending a message to the PLC load task a Loading sequence" (see "server interface") e Loading sequence after receiving a message from PLC ioad task If pos. acknowledgement Anzw = job_completed_without_error SSNR Otherwise_ ANR= EB Enter receive request in DPR ANZW DECEIVE - $5 address from ANZW ALL ERROR NUMBER Anzw = job_terminated_with_error Fig.5-6 Sequence "Load-Domain-Content" (local PLC) 5-11 Volume 2TF Domain and Pi Services Implementing a CIM Network B 8976049/01 Load Domain Content (continued) Sequence description "load-domain-content" PLC (c SSNR lient) FBO }==_] SEND | Pare direct D-LO "Name" SSNR Job buffer ANR=0 ANZW | FB RECEIVE ALL CP D-LO |"Name" | | | | | Anzw = job_active Compile TF-PDU - Name from job buffer e Send TF-PDU TW Load_domain_content_reply received If pos. acknowledgement: Anzw = job_completed_without_error Otherwise: Enter receive request in DPR - $5 address from ANZW ERROR NUMBER Anzw = job_terminated_with_error Fig. 5-7 Sequence "Load-Domain Content" (second PLC) Volume 2 5-12B 8976049/01 TF Domain and PI Services Implementing a CIM Network Load Domain Content (continued) Points to note with the load domain content: Stipulating the CPU route for loading The capabilities list parameter informs the CP for which CPU the domain is intended. The CP expects the CPU number in the capabilities list. If no capabilities list is specified, CPU number 1 is assumed. There are the following possible "routes" to the PLC that the user must select: > Direct, i.e. via the AS 511 connection (swing cable") to the PLC Configuration: asst! to the bus PLC-CPU CP > Route via PG Mux/COR Configuration: AS 511 to i 7 the bus UU U PLC-CPU PG-Mux/COR cp In the multiprocessor mode, the VMD configuration must be defined using the COM 143 function Edit | VMD configuration. 5-13 Volume 2TF Domain and Pi Services Implementing a CiM Network B 8976049/01 Load Domain Content (continued) insufficient memory on the PLC for loading a domain If the error insufficient memory" occurs when loading a domain, the sequence is aborted and the parts that have already been loaded are deleted. In this case, the error must be dealt with locally. The CP attempts to prevent this error as far as possible by compressing the memory after generating a program invocation (see Program Invocation Services"). Assigning domains to a CPU A maximum of eight loaded dynamic domains is supported by the CP. The distribution of the domains on the CPUs (1...4) can be decided by the user. The capabilities list informs the CP of the CPU in which the domain is to be loaded. Block allocations must be unique If a domain contains a block that is also part of another domain loaded in this CPU, the loading function is aborted. Blocks contained in the PLC that do not belong to another domain are overwritten. Managing domains on the CP The data structures required to manage the domain are stored on the CP. They are stored in battery-backed areas and are retained if there is a power failure. Configuring and establishing the fileserver application association The link to the fileserver specified by the "application association name parameter is set up by the CP (see application association management - special links). This is not defined in the same way as a normal application association, but in COM 143 in the "fileserver application associations" screen form. After the loading sequence is complete, the fileserver application association is terminated again and the load job acknowledged. is Domains must not contain blocks that exist in the EPROM of the destination PLC (e.g. HDBs on the S5-115U). Volume 2 5-14B 8976049/01 TF Domain and Pl Services Implementing a CIM Network 5.1.2 Store domain content Using the "store domain content service, the content of a (loaded) domain can be archived on a fileserver. The domain can either exist locally (Figure 5-8) or in a remote PLC (Figure 5-9). Ol PLC 1 @ Oo File server a) "Store domain content request (2) Storing sequence 3) "Store domain content acknowledgement Fig.5-8 Archiving a Domain of the Local PLC PLC 1 | PLC 2 File server @) "Store domain content request @) Storing sequence @) "Store domain content acknowledgement Fig.5-9 Archiving a Domain of a Remote PLC Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 Store Domain Content (continued) The domain is remote The application association to the second PLC is identified by the call parameters "SSNR" and "ANR" of the send-direct" call to transfer the job buffer. The domain is local The archiving of a local domain is achieved by using the VMD configuration job number (205). Job buffer "store-domain-content" KS: -ST Gen. KS: Opcode 4 bytes (ASCII), D-S section KF: Timeout Monitoring time in 0.1 sec reserved KY: | Length Length of domain name KS.) Domain we Domain name Te mame (max. 32 characters) KY: | Length Length of file name KS: File ae File name name (max. 64 characters) KY: | Length Length of the following name KS:l- Nameof tL Name of the application assoc. ~T_application assoc. TT to file server (max. 32 characters) Fig. 5- 10 Structure of the Job Buffer for TF Service Request Upload Volume 2 5-16B 8976049/01 TF Domain and PI Services Implementing a CIM Network Store Domain Content (continued) Call description: General section: Opcode Timeout: D-ST 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. Job-related section Length of dom. Name: Domain name: Length of fille name. File name: Format: KY Range of values: high byte: 0 low byte: 1..32 Meaning: length of the following domain name Format: KS Meaning: Name of the domain to be archived, if the length of the domain name is odd, a padding byte is appended. Format: KY Range of values: high byte: 0, low byte: 1...64 Meaning: length of the following file name (including path Format: KS Meaning: name of the file on the fileserver that will contain the domain Length of the name of the application association to the fileserver Format: KY Range of values: high byte: 0, low byte: 1...32 5-17 Volume 2TF Domain and Pl Services Implementing a CIM Network B 8976049/01 Store Domain Content (continued) Name of the application association to the fileserver: Format: Meaning: KS name of the appl. ass. via which the fileserver can be obtained by the dest. station (third-party association). Sequence description "store-domain-content" PLC (client) CP SSNR ANR ANZW] of [= $& add. direct PAFE L, D-ST __0-ST | Name | "Name" | ! | | Job buffer Anzw = job_active Compile TF-PDU - Name from job buffer @ Send TF-PDU ) Load_domain_content_reply oe received If pos. acknowledgement: Anzw = job_completed_without_error SSNR Otherwise: ANR= FB Enter receive request in DPR [Se . ANZW RECEIVE $5 address from ANZW ALL ERROR NUMBER Anzw = job_terminated_with_error Fig. 5-11 Sequence 'Store Domain Content (second PLC) Volume 2 5-18B 8976049/01 Store Domain Content (continued) TF Domain and PI Services Implementing a CIM Network PLC (client) CP SSNR ANR=205 ANZW FB == $5 addr,| SEND [pare Ldirect_ [__ | _ _ _ D-ST [ D-ST | | "Name" | "Name" | | | | _ La! Job : : buffer Anzw = job_active e Loading sequence after sending a message to the PLC load task "Loading sequence (see "server interface") e Loading sequence after receiving a message from PLC load task If pos. acknowledgement Anzw = job_completed_without_error SSNR Otherwise _ ANR=0 EB Enter receive request in DPR [= ANZW lee cEIVE - $5 address from ANZW ALL { ERROR NUMBER Anzw = job_terminated_with_error Fig. 5- 12 Sequence Store Domain Content (local PLC) 5-19 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 5.1.3. Delete Domain Content (Client) This job deletes a domain identified by the domain name. It can be loaded either locally or on a remote PLC. Deleting a domain initiates a compress memory function on the AS511 interface to the CPU. Job buffer "delete domain content" Gen, Ke. Opcode 4 bytes (ASCII), D-DE section KF: Timeout Monitoring time in 0.1 sec reserved KY: | Length Length of domain name KS: Domain LE Domain name name (max. 32 characters) Fig. 5- 13 Structure of the Job Buffer "Delete Domain" Call description General section: Opcode D-DE Timeout: 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. Job-related section Length of Format: KY domain name: Range of values: high byte: 0, low byte: 1..32 Meaning: length of following domain name. Volume 2 5-20B 8976049/01 Delete Domain(continued) TF Domain name: Format: KS Meaning: name of the domain to be deleted, if the length of the domain name is odd, a padding byte is appended. Domain and P| Services Implementing a CIM Network Sequence description "delete domain content" PLC (client) SSNR FR }=_ |] SEND direct - D-DE Domain name Job buffer PAFE FB =f RECEIVE ALL CP p- i D-BDE Domain | name Anzw = job_active Compile and send TF-DPU ~) e Delete_domain_content_reply received If pos. acknowledgement: Anzw = job_completed_without_error Otherwise: e Enter receive request in DPR - $5 address from ANZW ERROR NUMBER Anzw = job_terminated_with_error Fig.5- 14 Sequence Delete Domain" (other PLC) 5 - 21 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 5.1.4 Get Domain Attributes (Client) This service requests the attributes of a particular domain. Domain attributes are information about capabilities, status information and information about the PI assignment. On recieving the job, the server checks whether or not the domain with the domain name exists. If no domain exists with this name, a negative acknowledgment is sent. Job buffer "get domain attributes" Gen, Ke. Opcode 4 bytes (ASCII), D-GE section KF: Timeout Monitoring time in 0.1 sec reserved KS: Destination ID DB, DX KY: ) | DB no. Data block number KF: DW number Data word number KF: Length KY: | Length Length of domain name KS: 1 Domain LL Domain name aa name TT (max. 32 characters) Fig. 5-15 Job Buffer Get Domain Attributes" Call description General section: Opcode D-GE Timeout: 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified Volume 2 5-22B 8976049/01 TF Domain and Pi Services Implementing a CIM Network Get Domain Attributes (continued) in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. Job-related section Dest. ID Format: KS Range of values: DB, DX Meaning: 55 destination address, at which the information about the attributes of the domain will be stored. DB number Format: KY Range of values: high byte: 0, low byte: 1..255 DW number Format: KF Range of values: 0..2042 Length: Format: KF Range of values: 1..2043, -1 Meaning: length of the data block area in which the domain attributes can be stored; the value -1 indicates that all the domain attributes sent in the acknowledgement from the DW number up to the end of the data block can be accepied. Length of Format: KY domain name: Range of vaiues: high byte: 0, low byte: 1..32 Meaning: length of the following domain name Domain name: Format: KS Name of the domain if the length of the domain name is odd, a padding byte is appended. 5-23 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 Get Domain Attributes (continued) Sequence description "get domain attributes" PLC (client) SSNR ANR ANZW FB el S5add| SEND parE | D-GE foc. | param. | | rem. param. Job | buffer | without | data | | | SSNR ! ANR=0 FRO ANZW teecewve |! ppypx ALL he CP { D-GE | | loc. param. | rem. | _param._ Anzw = job_active Compile TF-PDU - Domain name from job buffer e Send TF-PDU Domain_attributes_reply_data { received Enter receive request in DPR - $5 address from job buffer q Data Anzw = job_completed_without_error Fig. 5- 16 Sequence Description (Get Domain Attributes, Positive Acknowledgment) Volume 2B 8976049/01 Get Domain Attributes(continued) FRO pee PLC (client) SSNR ANR ANZW SEND p add direct [PAFE | | | DGE | loc. param. | | | rem. | param. | | Job buffer | | without | | data | L. | | | | ns | SSNR ANR=0 ANZW ALL L FB == RECEIVE [ERROR NUMBER | DB/DX TF Domain and Pl Services Implementing a CIM Network CP | D-GE_, | loc. | param. | rem. | _param._ Anzw = job_active Compile TF-PDU - Domain name from job buffer If local error occurred: skip sending TF-PDU continue with receive request lf no error occurred: => send TF-PDU Request_domain_attributes_reply (neg.) received or dwell time exceeded { e Enter receive request in DPR - S5 address from ANZW { ERROR NUMBER Anzw = job_terminated_with_error Fig.5-17 Sequence Description (Get Domain Attributes, Negative Acknowledgment) 5 - 25 Volume 2TF Domain and Pl Services Implementing a CIM Network B 8976049/01 Get Domain Attributes (continued) Structure of the reply data The reply data stored at the S5 address specified in the job buffer have the following structure: Service ID Free Number of i capabilities Multiple Domain | Deletable Status |withTF serv Upload No. of procedures | P| names Length Je Pl L- an name List of program invocation names No padding bytes are appended Length ac Pl a 7 name 7 Length +: Capablityname _l- List of the capabilities No padding bytes are appended Length Capability name Fig. 5-18 Structure of the Repiy Data Volume 2 5 - 26B 8976049/01 TF Domain and PI Services Implementing a CIM Network Get Domain Attributes (continued) Meaning of the individual parameters in the reply data: Service ID 25h (for unique assignment of the reply to the requested service) Number of capabilities: number of the entries contained in the capabilities list parameter Multiple use: specifies whether the domain can be used by more than one program invocation at any time, for SIMATIC $5 stations always "false" Domain status: 0 the domain does not exist (reserved value) the domain is being loaded, the CP is currently processing data the domain is loaded the domain is loaded and assigned to a program invocation the domain is loaded but the loading sequence is not yet completed the loading procedure for the domain was aborted (reserved) the domain is being generated the domain is being loaded, the interface module is waiting for data the loading sequence is being terminated the domain is being assigned to a program invocation the domain is being assigned to a further program invocation (not with SIMATIC $5) the domain is being released by a program invocation, however, it remains linked into another program invocation (not with SIMATIC $5) 13 the domain is being released by a program invocation and is changing to status 2 14 the domain is being deleted 15 _ The loading procedure was aborted, the domain is being deleted. 2-2 00NOMNR WD =o _ f Statuses 7...15 are only temporary, i.e. between a job currently processed and the corresponding reply. 5-27 Volume 2TF Domain and Pi Services Implementing a CIM Network B 8976049/01 Deletable with TF services: Specifies whether the domain can be deleted with the "delete domain service. Upload procedures: Specifies whether the domain is currently being archived on a fileserver. If this parameter is "true" the domain cannot be deleted at the present time. Number of program invocation names: Number of elements in the program invocation_list, with SIMATIC S5, a maximum of one. Program invocation_list: Contains the names of the program invocations currently occupying the domain, with SIMATIC $5, a maximum of one. Capability list: List of the capabilities used by the domain, for SIMATIC S5 the CPU number which the domain is loaded is specified (see also job description load domain content"). 5.1.5 Domain Services (Server) On the server, the service is executed automatically in the CP without support of the PLC program. The tables or data structures addressed are only in the address area of the CP and contain the domain and PI object attributes known in the CP. The swing cable is required for this service. Volume 2 5-28B 8976049/01 TF Domain and PI Services Implementing a CIM Network 5.2 Program Invocation Services The program invocation services support you in controlling the programs which process the automation tasks in the programmable logic controllers. With these services you can control the functions of these devices dependent on their processing status. These services are available for PLCs in the client and server roles. in the client role, the PLC functions as a host computer requesting status changes in the monitored device by means of service jobs. In the server role, a PLC reacts to the instructions contained in the service job. The CP is responsible for keeping the PI statuses up to date in the Pl management, interpreting the instructions and checking that they are permitted. The instructions must then be converted in the PLC user program and acknowledged. After the acknowledgment, the CP notes the status change in its Pl management. The following services are supported (in each case both on the client and server): > Create Pl > Delete Pl > Start Pl > Stop Pl > Resume Pl > Reset PI > Kill Pl > Local program stop (only server function -> local service) > Get PI attributes 5-29 Volume 2TF Domain and Pl Services Implementing a CIM Network B 8976049/01 5.2.1. PLC Program Structure, Status Transitions PI in the SIMATIC S5 PLC In the SIMATIC S5 PLC there are two program invocations defined: > The system Pl (PLC_START_STOP) The system PI represents the PLC with its global start/stop procedure. The system Pi ensures that the status of the whole device is independent of the statuses of the user Pl. No status of a user Pl can, for example, automatically cause a PLC stop. > The user Pl The user PI includes all the domains defined on the PLC. Remember that apart from the blocks grouped to form domains, other blocks can exist on the PLC. The separate view of the user PI and the system PI allows non-domain blocks to be run independent of the user PI. Up to eight domains (sets of blocks) can be stored on a SIMATIC S5 PLC. Along with any permanently loaded blocks (option) these domains perform the actual PLC program. A program invocation" (Pl) as available in the TF model for sequential control of an application process, is always formed by the domains loaded in the PLC. The modelling of possible program invocation statuses is explained in the following sections. Dynamic and static domains Normally, the user PI represents the domains that can be loaded using the loadable domains. These are also known as dynamic domains. A static. domain has been defined for the special situation where the user wishes to control the program using PI services but is not using the domain services. The static domain includes the PLC blocks not explicitly assigned to a domain. By generating a Pl related to this static domain, PI services can be used with the blocks of this "pseudo" domain. Volume 2 5-30B 8976049/01 TF Domain and Pl Services Implementing a CIM Network Pl Services - PLC Program Structure / Status Transitions (continued) Pi status management The management of the TF-P! statuses (see illustration) is performed by the CP alone. The PLC program is informed of status change requests by Pl jobs, for example, a request to the application to change to the stop status). The PLC user program executes the service by changing the status as requested and acknowledging the request according to the process status. Note: Due to its coordinating role, the client is also known as a host computer in conjunction with the PI services. Pl status indication via FB 103 (PI-ZUSTD) The information about the actual Pi status and any status change requested by the host computer is passed on by a standard function block (FB PI-ZUSTD), that can either be loaded permanently in the PLC or be part of a domain. This block can be called in any program branch by the application program. The standard function block FB 103 (FB PI-ZUSTD) is supplied with COM 143 TF. Status transitions The PI status changes defined in TF can be seen in the diagram. Whether or not a status transition requested by the host computer is permitted is checked in the CP. Multiprocessor mode In the multiprocessor PLC, the view of the PLC via the system PI and the user PI remains unchanged. The number of possible domains also remains unchanged. The information depends on the number of CPUs in operation! In the multiprocessor mode, the only difference is that a master CPU must be specified with which the CP executes the system PI functions (START/STOP PLC). The master CPU is specified using the COM 143 TF configuration tool, with the function VMD Configuration. 5-31 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 PI Services - PLC Program Structure / Status Transitions (continued) Checklist for using PI services Using PI services means the following: In the PLC with the server role: > Configure an application association for transferring the Pl services (it may be possible to use the predefined application association S5_ TF; refer to the Chapter Supplementary Services, Section Special Links. > Assign the data and program blocks to domains (refer to domain services and the PGLOAD tool). > Specify the reactions to Pl jobs in the PLC user program, i.e. what it means to resume, reset, start or stop a PI etc. > Call the function block for the status request (FB 103) in the PLC program. > Evaluate the status information in the PLC program and if applicable . send an acknowledgment from the PLC program. In the PLC with the client role: > Configure an application association for transferring the PI services (it may be possible to use the predefined application association S5_TF; refer to the Chapter Supplementary Services, Section Special Links. > Send PI jobs via handling blocks if status changes are required in the server PLC. > Evaluate status information, i.e. the acknowledgments of the server PLC in the PLC program. Volume 2 5 - 32B 8976049/01 TF Domain and Pl Services Implementing a CIM Network Pl Services - PLC Program Structure / Status Transitions (continued) 26 NON- 26 EXISTENT fa Ne Pa P3 P1 P2 25| |27 aN 25/ fe UNRUNNABLE 15 IDLE 1 3 STARTING 15, 4 7 2 45 RUNNING 5 5 15, 8 LA <i 20 STOPPING |~|,, | RESUMING -212 RESETTING 9 A VA 27 15 16 19 STOPPED 25 Fig. 5-19 Status Diagram of a Program Invocation Explanation of the status transitions: Start job Start acknowledgment (positive) Start acknowledgment (negative, non-destructive) Start acknowledgment (negative, destructive) Stop job Stop acknowledgment (positive) Stop acknowledgment (negative, non-destructive) Stop acknowledgment (negative, destructive) Resume Job 10 Resume acknowledgment (positive) 11 Resume acknowledgment (negative, non-destuctive) 12 Resume acknowledgment (negative, destructive) OANOD AA WN 5-33 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 P| Services - PLC Program Structure / Status Transitions (continued) 15 Kill acknowledgment (positive) 16 Reset job 17 Reset acknowledgment (positive; if Pl is re-usable) 18 Reset acknowledgment (positive; if Pl not re-usable) 19 Reset acknowledgment (negative, non-destructive) 20 ~= Reset acknowledgment (negative, destructive) 21 Local program stop 22 Create_Pl job 23 Create_Pl acknowledgment (positive) 24 Create_Pl acknowledgment (negative) 25 _ Delete_PI job 26 ~ Delete_PI acknowledgment (positive) 27 ~~ Delete_PI acknowledgment (negative) The term "destructive" in this situation means that the PI can then no longer be used. Description of the PI statuses for the System PI The system PI controls the START/STOP response of the PLC. The following service jobs are possible: > A resume PI job generates a PLC start on the AS511 interface, but does not influence the status of the user Pl. The PLC memory is not compressed. > A stop PI job generates a PLC stop on the AS511 interface, but does not influence the status of the user PI. Further status changes of this system PI are not allowed and are acknowledged negatively. Volume 2 5 - 34B 8976049/01 TF Domain and PI Services Implementing a CIM Network P| Services - PLC Program Structure / Status Transitions (continued) Description of the PI statuses for the user Pl Some of the effects of Pl jobs on the user process must be programmed in the PLC. After the application has requested a specific PI status (FB 103) the status change is triggered and after acknowledgment, it is entered in the status management of the CP. PI non- existent Pl idle PI starting PI running PI stopping PI stopped A program invocation has not been created. The PI has been created, the actual user process has, however, not yet started.This status follows a create Pl job. The process controlled by the PLC program will be started. In this status, the user program can, for example, make certain preparations to allow the transition to the "running" status. The change of status (to running or unrunnable) is triggered by the user program (acknowledgement of the start PI job). The user process has started and is being controlled by the PLC program. The process controlled by the PLC program will stop. in this status the user program can for example make certain preparations to allow the transition to the stopped status. The change of status (to stopped or unrunnable) is triggered by the user program (acknowledgement of the Pl start job) The process controlled by the PLC program is (temporarily) stopped. As can been seen from the PI status diagram, the process can be completely stopped in this status (for example because another program is to be loaded) or can be resumed by a command from the host computer, i.e. can change back to the "running" status. When in the "running" status, the change to stopped can also be caused by a local event (see description of FB "PI-ZUSTD"). 5-35 Volume 2TF Domain and P] Services Implementing a CIM Network B 8976049/01 PI Services - PLC Program Structure / Status Transitions (continued) Pl resuming PI resetting PI unrunnable The process controlled by the PLC program will be resumed after a temporary stoppage. The change from this Status (to running or stopped/unrunnable) is triggered by the user program (acknowledgement of the resume PI job). The process will be returned to the idle state by the user program. Changing from this state to the idle or stopped/unrunnable status is triggered by the user program (acknowledgement of the reset PI job). The "unrunnabie status means that an event has occurred during the control of the process that prevents further processing. This may, for example, be the result of one of the following causes: - the host computer has sent an abort request - the user program acknowledges a status transition negative, destructive. The statuses P1 to P4 are managed by the CP. They are decision phases on the CP when the CP decides which of the alternative statuses will result from a status request. The user program has no influence on these transiti- ons. Volume 2B 8976049/01 TF Domain and Pl Services Implementing a CIM Network 5.2.2 General Sequence of a Status Change The description of the sequence of a status change illustrates the interaction of the user program on the PLC and the status processing on the CP. The steps from the arrival of the Pl job on the CP until the new status is acknowledged are described. The following steps are run through on the CP 143: > Request received > Requested status change checked for consistency > If status change not allowed, negative acknowledgement and abort Otherwise: New status entered in the DB-RAM. The transmission of an acknow- ledgement is not time-monitored > If applicable, wait for acknowledgement from the user program The following steps are run through on the programmable logic con- troller: > Check the PI status with FB "PI-ZUSTD" call. Processing of a program section dependent on the PI status > If a status with an acknowledgement request is set in the PI status, the user program reacts as follows: It recognizes the request and prepares the process for a new status (Running, Stopped, Idle}. It acknowledges the job positively. lf the process is already in the status requested by the host computer, or . it is not possible to change to this status the job must be acknowledged negatively (by calling FB "Pi-ZUSTD"). 5 - 37 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 PI Services - General Sequence of a Status Change (continued) Interface module PI job Enter new Pl status Enter acknowledgement request Wait for acknowledgement | | | | | | | | | | | | | | Enter new PI status + Acknowledge Pl job | oP | | PLC SSNR Q/Z-T OBNR Q/Z-A SSNR Q/Z-T DBNR aza | User program Call user blocks also several cycles) Read PI status FB PI status (RLO = 0) PAFE Read PI status and enter in destination address, acknowledgement requested Call user blocks (also several cycles) FB PI status (RLO = 1) PAFE Enter acknowledgement in DPR and trigger interrupt in the CP Fig.5-20 General Sequence (no error) of a Status Change Volume 2 5 - 38B 8976049/01 TF Domain and Pl Services Implementing a CIM Network 5.2.3 Interface of the PLC Program to the PI Services on the Server Significance of FB 103 The function block "PI-ZUSTD (FB 103) is used to inform the user program of the current status of the program invocation and therefore represents the interface of the user program to the program invocation services of TF. Block function The block executes two different functions: read PI status or send acknowledgement. The function block is processed dependent on the result of logic operation (RLO), as follows: > Call when RLO = 0: The PI status is read and stored at the specified S5 address > Call when RLO = 1: The user wants to acknowledge a PI status, either positively or negatively. The FB reads the acknowledgement at the specified S5 address and then writes the new PI status at this address. Block interface As can be seen in the diagram illustrating the general sequence of a status change, the block requires various parameters: _SSNR FB PI status Q/ZT DBNR Q/ZA PAFE Fig. 5 - 21 Call Parameters of the Status Function Block "PI-ZUSTD* 5-39 Volume 2TF Domain and Pl Services Implementing a CIM Network B 8976049/01 PI Services - Interface PLC Program to PI Services (continued) Description of the interface parameters 1. SSNR (interface number) The value specified here has the same significance as when calling a handling block and determines the page via which the Pi status in the CP can be scanned. This value is also the value assigned to the applica- tion association on which the host computer triggers the Pl services. The base interface number of the module must be set according to the value used here. Special feature in multiprocessor PLCs: as with communication via hand- ling blocks, the interface number is determined by the slot on the CPU. This means that the CPU in slot n (n=1..4) obtains the Pl status via interface number n-1 (+ base interface number). The interface module ensures that the same PI status is read in all CPUs. 2. Q/ZT (source/destination type) Depending on the function of the block, this parameter specifies the S5 source or S5 destination type to be used by the block. Identifier: DB data block area DX extended data block area FW flag area 3. DBNR (data block number) If Q/ZT =DB or DX: 1...255 If Q/ZT = FW: invalid. 4. Q/ZA (source/destination start) This parameter specifies the start address within the selected area. If Q/ZT = DB or DX:0...2042 If Q/ZT = FW: 1...(dependent on PLC type) Since one word of the block is always required, no length needs to be specified. Volume 2 5-40B 8976049/01 TF Domain and PI Services Implementing a CIM Network Pl Services - Interface PLC Program to PI Services (continued) 5. PAFE (parameter assignment error) Parameter assignment error, 1 byte The block transfers any errors that may occur to the user program at the FB output (byte parameter) specified by this address (see following ta- ble). List of possible error messages and their causes: 00h 11h 2th 31h 4ih 51h 61h 71h 8th Qih Aih Bih Cth Dih Eth Fth no error occurred parameter "Q/ZT" not correctly entered, i.e. not DB/DX/FW access to address not possible, e.g. DB does not exist area too small, i.e. DW does not exist parameter Q/ZA is greater than 255 RLO = 1, but no acknowledgement requested CP/PLC not synchronized access to DPR not possible, interface does not exist interface not ready interface overloaded free free interface not acknowledging free free free 5 - 41 Volume 2TF Domain and P| Services Implementing a CIM Network B 8976049/01 PI Services - Interface PLC Program to PI Services (continued) 5.2.3.1 $5 Files of the Function Block "PI-ZUSTD" (FB 103) PLC CPU $5 file Library number $5-115 U CPU 942A/B SS5CI50ST.S5D P71200-S 5103-C-2 CPU 943A/B CPU 944A/B $5-135 U CPU 922 S5CI29ST.S5D P71200-S 9103-C-1 CPU 928A/B CPU 948 $5-150 U S5CI40ST.S5D P71200-S 4103-C-1 $5-155 U CPU 946/947 SS5CI69ST.S5D P71200-S 6103-C-1 CPU 922 CPU 928 A/B CPU 948 Volume 2 5 - 42B 8976049/01 TF Domain and Pl Services Implementing a CIM Network PI Services - Interface PLC Program to Pi Services (continued) Format and Significance of the Supplied PI Status: Bit 15 11 7 3 0 Li} Ti tTy Tt | Tet tt yy Ny [Lo unrunnable idle running stopped starting stopping resuming resetting bits 0 to 7 = 0: non existent acknowledgement bits, only valid if RLO = 1 free CP status In the following statuses, the user program must generate an acknowledgement: Starting Stopping Resuming Resetting In all other statuses the user program must not generate an acknowledgement. Significance of the acknowledgement bits > Bits 8 and 9 = 0: The status transition will be executed (pos. acknowledgement) > Bit 8 = 1, bit 9 = 0: The status transition will not be executed, the Pl is to remain in the old status (negative, acknowledgement, non-destructive). > Bit 8 =0 or 1, bit 9 = 1: The Pl must be brought to the unrunnable status (negative acknowledgement, destructive). 5-43 Volume 2TF Domain and Pi Services Implementing a CIM Network B 8976049/01 P| Services - Interface PLC Program to PI Services (continued) Significance of the CP status Bit 14 = 1, bit 15 = 0: CP stopped Bit 14 = 0, bit 15 = 1: CP in run mode Bit 14 = 1, bit 15 =1: CP and PLC not synchronized Notes on the sequence in multiprocessor PLCs: The PI status is valid for the entire PLC In a multiprocessor PLC, the CP ensures that the same PI status is always read out in all CPUs. The user must make sure that the "SSNR" parameter is specified correctly when FB "PI-ZUSTD" is called (= CPU number - 1). in the statuses in which an acknowledgement is required, the user must make sure that the acknowledgement is only triggered when all the CPUs require the status change. The CP itself can only accept one acknowledgement. Note on the system Pi Since the CP starts and stops the PLC (with the resume Pi" and "stop PI" services for the system Pl) the CP must know the configuration of the PLC. This is achieved in the configuring phase with COM 143 TF using the VMD Configuration function with which the user defines a master CPU" that is controlled via the CP. At this stage, the user also specifies how the CPU is to be started and stopped. Volume 2 5-44B 8976049/01 TF Domain and PI Services Implementing a CIM Network 5.2.4 Start-up, Installation The installation on a SIMATIC PLC that will later be controlled within a system by a host computer using TF services (particularly with the aid of domain and PI services) must be performed as follows: > The domain must already have been generated with the COM 143 tool PGLOAD. The PG (as an aid to installation) transfers the files as ioad files" to a fileserver on completion of the programming (or after changes in the program). > The PLC should only contain blocks that are not contained in a domain (if these blocks do exist in a domain, they will be overwritten when the domain is loaded). > Since the CP assumes the status "stopped" as the initial status of the system Pl "PLC_START_STOP", the PLC must be in the "stop" mode. In the multiprocessor mode, the CPU designated as "master CPU" during configuration must be set to stop. The use of variables services is not dependent on the existence of domains or Pls. Only the definition and access to domain-specific variables require that the domain exists. ZT Following power down, a PI always has the non-existent status. 5-45 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 5.2.5 Create Program Invocation (Client) This service allocates one or more domains to a program. This can be in a remote station (identified by SSNR/ANR) or in the local station (ANR = 205). Job buffer "create program invocation KS: ASCII), P-C Gen. KS: Opcode 4 bytes ( ), P-CR section KF: Timeout Monitoring time in 0.1 sec reserved KY: | Length Length of Pl name KS: Program invocation_j Pl name name (max. 32 characters) 1..8 (for SIMATIC $5) KY: | Length Length of domain name KS: |- Domain Je Domain name name (max. 32 characters) KY: | Length Length of domain name KS: | Domain tie Domain name name (max. 32 characters) Fig.5-22 Structure of the Job Buffer for TF Service "Create Program Invocation" Volume 2 5 - 46B 8976049/01 TF Domain and P! Services Implementing a CIM Network PI Services - Create Program Invocation, Client Interface (continued) Call description General section: Opcode Timeout: P-CR 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec For more information about timeout, see page 3 - 9. Job-related section: Length of PI name Pl name Number of domains Length of domain name domain name Format: KY Range of values: 1..32 Meaning: length of the following Pl name Format: KS Meaning: name of PI to be created. If the length of the name is odd, a padding byte is appended. Format: KF Range of values: 1..8 Meaning: specifies the number of domains to be linked together in a PI. In the job buffer itself, the number of domain names is only limited by the maximum length of the job buffer. Format: KY Range of values: high byte: 0, low byte: 1..32 Meaning: length of the following domain name Format: KS Meaning: name of the domain, if the length is odd, a padding byte is appended. Parameters length of domain name and domain name are repeated as often as specified by the "number of domains" 5 - 47 Volume 2TF Domain and Pi Services Implementing a CIM Network B 8976049/01 Pl Services - Create Program Invocation, Client Interface (continued) Job sequence "create program invocation" PLC (client) SSNR ANR 85 add] SEND PAFE ey | _P-CR Pl name Domain name(s) Job buffer SSNR ANR=0 FB =? ANZW RECEIVE ALL CP P-CR_ Pl | name | Domain | [|name(s) | Anzw = job_active Compile and send TF-PDU ) e Create_Pl_reply received If positive acknowledgement: Anzw = job_completed_without_error Otherwise: enier receive request in DPR - $5 address from ANZW ( ERROR NUMBER Anzw = job_terminated_with_error Fig. 5-23 Sequence Create Program Invocation Volume 2B 8976049/01 TF Domain and Pl Services Implementing a CIM Network PI Services - Create Program Invocation, Client Interface (continued) PLC (client) CP SSNR ANR=205 EB ANZW OO === S addr) SEND |PAFe ni | ore7 _ P-CR P-CR Pl PI | name | name Domain Domain name(s) |name(s) | Job buffer Anzw = job_active Trigger create PI" by sending a message to PLC load task { Create program invocation e Create Pl acknowledgement by PLC load task receiving a message If positive acknowledgement: Anzw = job_completed_without_error SSNR Otherwise: = FB e enter receive request in DPR | entree - ANZW | RECEIVE $5 address from ANZW { ERROR NUMBER Anzw = job_terminated_with_error Fig. 5 - 24 Sequence Create Program Invocation" on Local PLC The PLC triggers the creation of a PI in itself by sending the job buffer with the VMD configuration job number (205). 5 - 49 Volume 2TF Domain and Pl Services Implementing a CIM Network B 8976049/01 5.2.6 Create Program Invocation (Server) This section describes the handling of the service on the server and the conditions that must be met. Preparations on the interface module: > Domains are loaded > No user PI exists (PI status = non-existent) Sequence: > A data structure is set up to manage the Pl. The PI status is stored in all four pages of the dual-port RAM. > The PLC is started as stipulated in the configuration ("swing cable", PG-MUX, dual-port RAM) > The PI status idle is entered (= 2) > Acknowledgement of the TF job Note on loaded domains: If no dynamic domains were loaded, i.e. the CP is not explicitly informed of domains, a so-called "static domain is supported. In this case, the computer (or another client) must enter the following in the list of domains of the create PI" TF service: Number of domains: 1 Length of domain name: 10 (dec ) Domain name: SIMATIC_S5 This domain name is also supplied in the reply in the "get name list" service if no other domain is loaded. It cannot be deleted with TF services This allows a SIMATIC S5 PLC to be controlled using PI services without requiring the TF transfer services. Note on domain statuses: A domain specified with "create PI" changes to the "in use status. It cannot be deleted in this status. Volume 2 5 - 50B 8976049/01 TF Domain and Pl Services Implementing a CIM Network 5.2.7. Delete Program Invocation (Client) This service deletes a previously created PI in the local or in a remote station. Since only one user PI can exist on a SIMATIC S5 PLC at any one time, the user Pi in the SIMATIC S5 PLC must be deleted before a new PI with a different structure can be generated. Job buffer "delete PI" KS: 4 ASC), P-DE Gen. KS. Opcode bytes (ASCIl), section KF: Timeout Monitoring time in 0.1 sec reserved KY: | Length Length of PI name KS: | Program invocation_|_ PI name - name TT (max. 32 characters) Fig. 5-25 Structure of the Job Buffer for TF Service Delete Program Invocation" Call description General section: Opcode P-DE Timeout: 1 word, format: KF Meaning: specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. 5-51 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 PI Services - Delete Program invocation, Client Interface (continued) Job-related section: Length of Format: KY Program Range of values: 1..32 invocation nameMeaning: length of the following PI name Program Format: KS invocation Meaning: Name of the PI to be deleted. If the length of the name Pi name is odd, a padding byte is appended. Sequence description delete Pi" PLC (client) CP SSNR ANR SSadd| SEND (pare ~ 7! direct_ [_ L-=pE mP-DE- Pl Pi name | name | Job buffer Anzw = job_active Compile and send TF-PDU > e Delete_PlI_reply received If positive acknowledgement: Anzw = job_compieted_without_error SSNR Otherwise: ANR=0 FB e@enter receive request in DPR a - N ANZW RECEIVE $5 address from ANZW ALL ERROR NUMBER Anzw = job_terminated_with_error Fig. 5 - 26 Sequence Delete Program Invocation Volume 2 5 - 52B 8976049/01 TF Domain and Pl Services Implementing a CIM Network PI Services - Delete Program Invocation, Client Interface (continued) PLC (client) SSNR ANR=205 ANZW | $5 addr. OT! FB }=_! SEND direct |PAFE_ P-DE Pl name Job buffer SSNR FB RECEIVE ALL CP "PDE j Ply name | | | | Anzw = job_active Trigger delete PI" by sending a message to PLC load task { delete program invocation e Delete PI acknowledgement by PLC load task receiving a message If positive acknowledgement: Anzw = job_completed_without_error Otherwise: eenter receive request in DPR - $5 address from ANZW { ERROR NUMBER Anzw = job_terminated_with_error Fig. 5- 27 Sequence Delete Program Invocation (on Local PLC) 5-53 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 5.2.8 Delete Program Invocation (Server) Effects on the user Pl in the SIMATIC S5 PLC: > The TF job is acknowledged by the PC providing the current status allows such a status change. After this job, the Pl management once again allows a create PI job for a user Pl. The domains used by the PI change from the "in use status to the "ready" status; if required, they can also be deleted. Volume 2 5 - 54B 8976049/01 TF Domain and PI Services Implementing a CIM Network 5.2.9 Start, Stop, Resume, Reset, Kill Program Invocation and Local Program Stop (Client) Depending on the current status, the jobs cause status changes in the system or user PI. Only the jobs resume PI! and stop PI are permitted for the system PI. Job buffer: start_Pl", stop PI", "resume_Pi", "reset_Pl", kill_PI" and "local program stop KS: 4 bytes (ASCII), P-ST, P-SP, P-RE Gen. KS: Opcode P-RS, P-AB section . KF: Timeout Monitoring time in 0.1 sec reserved KY: | Length Length of Pl name KS; |- Program invocation | Pl name 7 name TJ (max. 32 characters) Fig. 5- 28 Structure of the Job Buffer for TF Services "Start Pl", Stop Pl", Resume PI", "Reset Pi", "Kill Pl" and Local Program Stop Note: local program stop does not have a timeout parameter since it is only local. Call description General section: Opcode P-ST (start program) P-SP (stop program) P-RE (resume program) P-RS (reset program) P-AB {kill program) P-HL (local program stop) 5 - 55 Volume 2TF Domain and Pl Services Implementing a CIM Network B 8976049/01 PI Services - Start Pl ... Local Stop (continued) Timeout: 1 word, Format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. Job-related section: Length of Format: KY Pi name: Range of values: 1..32 Meaning: length of the following Pl name PI name Format: KS Meaning: name of PI to be processed, if the length of the PI name is odd, a padding byte is appended. Sequence description "start_Pl", stop_Pl", resume_Pl", "reset_Pl", kill_PI" The sequence for starting, stopping, resuming, resetting and killing a program invocation is the same for creating the PI. The syntax ID execution argument and length execution argument parameters required for the start Pl" and resume PI" services are preassigned the value 0 by the CP. Sequence description "local program stop" The user program can trigger the transition of the Pi from running to stopped (see status diagram of a program invocation page 5- 33). The transition takes place without a job from the network, i.e. without an explicit "stop PI" job from a client. The intermediate status "stopping" is skipped. This can, for example, be useful when the user process must be retriggered by the host computer each time it has worked through its task (e.g. manu- facturing a part). Volume 2 5-56B 8976049/01 TF Domain and Pl Services Implementing a CIM Network PI Services - Start PI ... Local Stop (continued) The status transition is triggered by the user program sending a job buffer as a local job with the job number 205. PLC (client) CP SSNR ANR=205 ANZW) 8 [==] ANZW $5 addr._| SEND [pare me | _P-HL ~P-AL Pi PI | name | name Anzw = job_active If the status transition is permitted: e update the PI status Anzw = job_completed_without_error SSNR Otherwise: ANR=0 FB enter receive request in DPR ANZW < - $5 address from ANZW RECEIVE ALL ERROR NUMBER Anzw = job_terminated_with_error Fig. 5- 29 Sequence Local Program Stop" 5-57 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 5.2.10 Start, Stop, Resume, Reset, Kill a Program Invocation (Server) The services are executed in the interface module as described in the Section "General Sequence of a Status Change", Section 5.2.2 Note the information about handling the user program in Section 5.2.3 Interface of the PLC Program to the PI Services on the Server. With the following results as the current status, the user program must generate an acknowledgment: - Starting Stopping - Resuming - Resetting Based on this acknowledgment, status changes are entered into the status management. The actual effects in the PLC user program must be program- med. Volume 2 5 - 58B 8976049/01 TF Domain and Pl Services Implementing a CIM Network 5.2.11 Points to Note when Starting and Stopping the PLC using the System PI The stop system PI service brings about a transition from RUN to STOP on the PLC. The resume system PI service brings about a transition from STOP to RUN on the PLC. The type of startup selected by the CP 143 is always a cold restart. The synchron handling block call required to synchronize the CP with the CPU must only be called in the cold restart branch when the CP status not synchronized is indicated. You can find out about this status by calling FB "PI ZUSTD". If you nevertheless call the synchron biock although the PLC and CP are synchronized, a cold restart is executed on the CP which means that the MMS/TF service Create Pl" which triggered the cold restart can no longer be acknowledged. Note on capabilities To execute this service, the CP requires the "swing cable" (or backplane bus). If this is occupied (by a "PG on the bus") the service is acknowledged negatively. The PLC cannot be addressed by a PG on the bus while the service is being executed. 5 - 59 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 5.2.12 Get Program Invocation Attributes (Client) This service allows the PI attributes such as PI status or domain assignment to be requested (both local and remote). Job buffer get Pl attributes" KS: Gen. KS: Opcode 4 bytes (ASCII), P-GE section KF: Timeout Monitoring time in 0.1 sec reserved KS: Destination ID DB, DX KY: 0 | DBno. Data block number KF: DW number Data word number KF: Length KY: | Length Length of PI name KS: | _L Pl name + Piname =~ (max. 32 characters) Fig. 5 - 30 Structure of the Job Buffer Get PI Attributes" Call description General section: Opcode P-GE Timeout: 1 word, format: KF Meaning: specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For more information about timeout, see page 3 - 9. Volume 2 5 - 60B 8976049/01 TF Domain and Pl Services Implementing a CIM Network Pi Services - Get PI Attributes (continued) Job-related section: Zielkennung: DB number: DW number: Length: Length of PI name: PI name: Format: KS Range of values: DB, DX Meaning: $5 destination address at which the information about the attributes of the PI will be stored. Format: KY Range of values: high byte: 0, low byte: 1..255 Format: KF Range of values: 0..2042 Format: KF Range of values: 1..2043, -1 Meaning: Length of the data block area in which the PI attributes can be stored; the value -1 means that all the data in the acknowledgement from the DW number to the end of the data block can be accepted. Format: KY Range of values: high byte:0 low byte: 1..32 Meaning: length of the following Pl name Format: KS Meaning: name of PI, if the length of the PI name is odd, a padding byte is appended. 5 - 61 Volume 2TF Domain and Pl Services Implementing a CIM Network B 8976049/01 PI Services - Get P! Attributes (continued) Sequence description " get P! attributes The sequence of the "get PI attributes" service is analogous to the sequence of the "get domain attributes" TF service. On the server, the service is executed automatically in the CP without support of the PLC program. The tables or data structures addressed are only in the address area of the CP and contain the domain and Pl object attributes known in the CP. Structure of the reply data The reply data stored by the CP at the S5 address specified in the job buffer has the following structure: DWn ID P| status DW n+1 with use DW n+2 free names Execution The number of bytes used here is argument (~ specified in length of the execution argument". No padding byte is appended. Length List of the domain names. ac Domain .- No padding bytes are inserted. name Length ae Domain name Fig. 5- 31 Structure of the Job Buffer Get PI Attributes" Volume 2 5-62B 8976049/01 TF Domain and PI Services Implementing a CIM Network PI Services - Get PI Attributes (continued) Significance of the individual parameters in the reply data: Service ID: 2Dh (to assign the reply to the requested service unequivocally) PI status: Value |MMS status |Status description 1 unrunnable |the program invocation was aborted or is ina status caused locally by an exceptional situation in which it can no longer be started. 2 idle: the PI has been created 3 running the user process has started 4 stopped the user process was stopped 5 starting the user process is in the start-up routine 6 stopping the user process is in the stopping phase 7 resuming the user process had stopped and is now starting up again. 8 resetting the user process was stopped and is being reset so that it can then be deleted - non-existent |if no PI with this name exists a negative acknowledgment is returned with ERRCLS and ERRCOD. 5-63 Volume 2TF Domain and PI Services Implementing a CIM Network B 8976049/01 Pl Services - Get PI Attributes (continued) Deletable with TF services lf this parameter = TRUE, it means that the program invocation can be deleted using the delete program invocation" service. Otherwise this is not possible. Multiple use lf this parameter = TRUE, it means that the program invocation can be started again following the reset carried out with the "reset program invocation" service. Otherwise this is not possible. Number of domain names Specifies the number of the domains belonging to the PI. Execution argument: the execution argument can be used to start an action on the server. The definition and execution are not specified by TF. The following - The "syntax_ID_execution_argument" has the value applies to 252. This defines a visible sting as the type for the SIMATIC S5: execution argument. - "Length of the execution argument for SIMATIC applications is always 0. - The execution argument itself is not used in SIMATIC S5; Domain list List of the domain names belonging to the program invocation. 5.2.13 Get Program Invocation Attributes (Server) The service is executed on the server without support of the PLC program. The tables and data structures addressed are in the address area of the CP and include the domain and PI object attributes known in the CP. QO Volume 2 5 - 64B8976049/01 Supplementary Services 6 Supplementary Services This chapter provides you with the information required for handling the following services: > application association management > VMD services > configuration jobs > clock services In a network with SIMATIC S5 PLCs, the CP relieves you of much of the handling of application associations during the operational phase. The CP establishes the application associations based on the configuration information during the start-up or as necessary. Information in this chapter about application association management is only required in exceptional cases when connecting two systems of other manufacturers. Using the VMD services you can clarify the availability and capabilities of the communicating devices. Configuration jobs are used to supply application associations with certain parameters during the operating phase independent of the configuration. The clock function of the CP 143 is implemented by a clock chip and clock software which uses the clock chip. With this clock function, you can set and synchronize the time in the SINEC H1 network. 6-1 Volume 2Supplementary Services B8976049/01 6.1. Application Association Management Overview The TF services for managing application associations provide the infrastructure required for communication on the application layer (layer 7) of the OSI reference model. The management of the corresponding transport connections (connections on layer 4) are also handled by the application link management. These services are executed automatically by the CP 143 (with the exception of the abort application association" service based on the configuration information. Service jobs for non-SIMATIC connections Due to the implicit execution of the services for application association management, S5 applications do not normally require access via a program interface. The "application association management services described in this section are only required when linking up with non-SIMATIC systems. 6.1.1. Definition of Application Associations Application associations are defined in the COM 143 TF definitions screen and stored in data link blocks in the memory module of the CP. The global and local parameters of the data link block are essential for link management. (See the introduction in Volume 1, Chapter 2 of this manual). Global parameters: definition of the layer 4 connection with the parameters - local TSAP remote TSAP - remote Ethernet address (MAC address) Volume 2 6-2B8976049/01 Supplementary Services Definition of Application Associations (continued) Local parameters Definition of the application association (layer 7 link) and modelling of the virtual circuit on the SIMATIC S5 PLC - Multiplex address - application association name interface number job number - status word (can be modified later using a configuration job) -> see also the REQUEST-EDITOR tool) - type of connection establishment - number of jobs (or number of application associations) Number of jobs The parameter number of jobs" specifies how many application associations can use the same layer 4 connection. These application associations are distinguished based on the multiplex address. Type of connection establishment Using the "type of connection establishment" the system planner can decide whether the connection is established only as far as layer 4 or up to layer 7. The conditions for establishment are also stipulated, i.e. how and when the connection should be established In concrete terms this means that if a link is required to a system in which application association management functions are not implemented, the connection is established only as far as layer 4. All communications partners must be capable of this connection establishment. This is, for example, the case when a link is required between the CP 143 and CP 535 with the AP protocol handler SINEC AV/S5. Normally, establishment up to layer 7 should be selected. The three following types of establishment must be distinguished: static active The CP establishes a permanent connection during start up. Static passive The CP is ready to positively confirm a connection request for the configured link. 6-3 Volume 2Supplementary Services B8976049/01 Definition of Application Associations (continued) dynamic The CP establishes a connection as soon as there is a job for the configured link. The recommended type of connection establishment for various services is listed in the following table: Connection establishment for TF services Service Type of establishment Non-open services Layer 4 (transparent data exchange, read/write byte string) Variable services Layer 7 Domain services Layer 7 PI services Layer 7 Volume 2 6-4B8976049/01 Supplementary Services 6.1.2 Connection Establishment The connection is established implicitly by the CP based on the configuration information. The establishment of connections is only completely transparent for the PLC program. The connection establishment is triggered by the CP and not by an application program on the PLC. Only the dynamic links (priority 3) are triggered indirectly by the PLC when a TF job is triggered. Nevertheless, even in this case there is no specific job for triggering connection establishment. This is always in conjunction with a client job (not configuration jobs). During the start-up on the module, the establishment of all priority 2 links (establishment "ACTIVE" or "PASSIVE") is initiated. Layer 4 The establishment of the transport connection is made by the transport software using the appropriate layer calls (e.g. open, connection request). CP143 transport software: iNA960 R 1.1 Layer 7 The establishment of the layer 7 link is only possible when the layer 4 connection establishment was successful. Since the initiate application association" service contains specific implementation parameters, these are explained in detail. These parameters are sent to the partner when the connection is established. They are fixed by the CP and cannot be modified by programming or configuring (exception max_receive_buffer_calling)! , 6-5 Volume 2Supplementary Services B8976049/01 Connection Establishment (continued) Service ID FOH Local_expansion_valid always "FALSE" Max_AmQ_calling_proposition OFFH, i.e. any number of server jobs per application association can be managed in the CP at one time. Max_AmQ_called_proposition 1H, i.e. the remote VMD must expect a maximum of one server job on an application association at one time. Max_receive_buffer_calling Value from the INIT block of the module card.. The maximum length of a TF-PDU can be selected by the user in COM 143 for all application associations when the module is initialized. Non_open_services_calling 0000 0000 0000 0111B i.e. the following non-open TF services are supported: - read byte string - write byte string - transparent data exchange Nesting_level_proposition 2H, i.e. the CP supports variables up to the following structure: ~ arrays of arrays of basic data types arrays of structures of basic data types - structures of structures of basic data types Number_syntax 1H exactly one syntax field follows Syntax_ID OH (assigned by TF) Length_abstract_syntax 5H Volume 2 6-6B8976049/01 Connection Establishment (continued) Abstract_syntax SINEC_TF_CORE_VERSION_1 Codierung: 28 CA 22 02 01 (hex.) Length_Transfer_Syntax OFH Transfer_Syntax SINEC_TF_CODING Version number_proposition 1H Parameter_CBB_ proposition 0000 0000 0101 1111 - Data type "ARRAY" is supported - Data type "STRUCTURE" is supported ~ Access to variables via a name is supported - Access to variables via an address is supported Supplementary Services ~ Third-party association for loading domain is supported Supported_TF_services_calling: All TF services of level 1 are supported (see appendix "CP 143 Product Data Sheet"). If a third-party association is involved, only the necessary services are required. These values are proposed in the initiate application association" TF-PDU. When the CPU sends the acknowledgement, it negotiates that the partner settles for these values. iS The specific implementation parameters are supplied by the CP 143 and do not need to be set by the user. Volume 2Supplementary Services B8976049/01 6.1.3. Connection Termination A TF application association is terminated by the "conclude application association" service that requires no parameters other than the service identifier. If, following the termination of the layer 7 link, there are no further layer 7 links set up on the layer 4 connection, the layer 4 connection is also terminated. The PLC program can trigger connection termination explicitly with a reset call (handling block) with the corresponding job numbers. This can, for example, be necessary when an TF service was triggered without timeout monitoring and was not completed. With priority 3 jobs, the link remains terminated until it is triggered again by the PLC program. Priority 2 connections are re-established immediately by the CP. A reset all job" (job number 0) to terminate all connections is not permitted. Volume 2 6-8B8976049/01 Supplementary Services 6.1.4 Special Connections Application associations to a fileserver To load or store domains, the third-party association" is supported by the CP 143. This means that after a host computer has triggered a load procedure (load domain content, store domain content) the CP itself establishes the connection identified by the application association name parameter. Up to 16 different fileserver application associations can be defined, of which a maximum of one can be established at any time. The type of connection establishment for fileserver application associations is always "dynamic". Variable definitions are not possible. The assignment of the connections to the end system is not specified explicitly for these associations, but is transferred by the user in the capabilities list when the ioad function is triggered. Multiplex addresses are not supported on these connections. Predefined connection The communications processor provides a non-configurable standard connection for loading services and for program invocation services, for which the following parameters are selected: local TSAP: $5_STF (length 6) remote TSAP: S5_STF (length 6) remote Ethernet address:unspecified MUX address: 0 6-9 Volume 2Supplementary Services B8976049/01 6.2 VMD Services for Virtual Manufacturing Devices The general TF services for virtual manufacturing devices allow a client to request information about the status or attributes of the virtual manufacturing device (VMD) in the server. The server can also indicate the status to a client without being requested. The information can then be further processed at the client, for example to provide a supervisory control center with an overview of the whole status of the plant. The following services are available: > Status of a VMD > Unsolicited status of a VMD > Identify VMD Volume 2 6 - 10B8976049/01 Supplementary Services 6.2.1 Status of the Virtual Device (Client) Using the "status of the virtual device" service, a client requests information about the physical and logical status of the virtual manufacturing device managed in the server. The server sends the requested information in the acknowledgement (e.g. whether the real" manufacturing device or the communications processor of the server is in the RUN or STOP mode or whether the PLC and CP are synchronized or not. Job buffer "VMD-Status" Gen. Ke. Opcode 4 bytes (ASCII), M-ST section. KF: Timeout Monitoring time in 0.1 sec reserved KS: Destination ID DB, DX KY: 0 | DB no. Data block number KF: DW number Data word number KF: Length Fig.6-1 Structure of the Job Buffer "VMD Status" Call description General section Opcode M-ST Timeout: 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For further information about timeout see page 3 - 9. 6 - 11 Volume 2Supplementary Services B8976049/01 VMD Status (continued) Job-related section Dest. ID Format: Values: Meaning: DB number Format: Values: DW number Format: Values: Length Format: Values: Meaning: Sequence description KS DB, DX destination address at which the information about the status will be stored. KY high byte: 0 ,low byte: 1..255 KF 0..2042 KF 1..2043, -1 length of the data block area in which the VMD status can be stored; the value -1 means that all the data in the acknowledgement from the DW number to the end of the data block can be accepted. The sequence of the "VMD status service is analogous to the sequence of the "read" TF variable service. Requesting the status of the VMD in the local PLC (job number = 205) is not possible. Volume 2 6- 12B8976049/01 Supplementary Services VMD Status (continued) 6.2.2 Status of the Virtual Device (Server) The service is executed by the communications processor without the support of the PLC. However, the status of the PLC is also included in the data of the reply. Structure of the reply data The reply data stored by the CP at the STEP 5 address specified in the job buffer has the following structure: DW n Service ID Logical Physical Length loc. DWn+1 | status expansion DW n+2 free a Local The length of the bits used here aa expansion == is specified in the length of the a local expansion. No padding byte is inserted. Fig. 6 - 2 Structure of the Reply Data in the Data Block Service ID: Oh (to assign the reply to the required service unequivocally) The range of values of the other parameters is described below. 6-13 Volume 2Supplementary Services VMD Status (continued) VMD Status Indication: 1. The AS 511 master connecior is plugged in or PG functions are possible via the dual-port RAM (with swing cable) B8976049/01 PLC status/ jPLC in RUN PLC in STOP CP status CP in RUN state changes state changes __|logical status allowed allowed operational partially physical status operational CP in STOP |limited services _|limited services {logical status permitted permitted needs needs physical status commissioning |commissioning CP/PLC limited services |state changes _ |logical status not permitted allowed synchronized partially needs physical status operational commissioning Volume 2 6-14B8976049/01 VMD Status (continued) Supplementary Services 2. No AS 511 master connector plugged in and no PG functions via the dual-port RAM (swing cable) PLC status/ |PLC in RUN PLC in STOP CP status CP in RUN limited services |support services permitted permitted operational partially operational CP in STOP limited services | limited services permitted permitted needs needs commissioning |commissioning CP/PLC limited services | limited services not permitted permitted synchronized inoperable inoperable logical status physical status logical status physical status logical status physical status Explanations: 1. PLC in RUN, CP in RUN, master connector: all TF services permitted, fully functional 2. PLC in RUN, CP in RUN, no master connector: no domain or PI services possible 3. PLC in Stop, CP in RUN, master connector: only domain and PI services and information services (status, name list etc.) permitted, no variable services, no non-open services 4. PLC in Stop, CP in RUN, no master connector: only information services allowed 6-15 Volume 2Supplementary Services B8976049/01 VMD Status (continued) 5. CP in stop: only status and identify VMD permitted (regardless of PLC mode and the configuration with the master connector). The CP must first be switched to the run mode or at least brought to the CP/PLC not synchronized status before other TF services are permitted. 6. PLC in stop, CP/PLC not synchronized master connector: only domain services and the services create Pl'/"delete Pl" and information services (status, name list etc.) permitted, no variable services, no non-open services. 7. PLC in stop, CP/PLC not synchronized no master connector: only information services permitted. 8. PLC in run, CP/PLC not synchronized, master connector: only domain services and the services create Pl"/"delete PI" and information services (status, name list etc.) permitted, no variable services, no non-open services. 9. PLC in run, CP/PLC not synchronized: no master connector only information services permitted. Coding of the parameters "logical status" and physical status: logical status: state changes allowed 00h no state changes allowed Oth limited services permitted 02h supported services permitted 03h physical status: operational 10h partially operational 11h inoperable 12h needs commissioning 13h Volume 2 6-16B8976049/01 Supplementary Services 6.2.3. Unsolicited VMD Status (Initiator) Spontaneous indication of the status of the local VMD to another partner. Job buffer unsolicited VMD status Call description KS: Gen KS: Opcode 4 bytes (ASCII), M-SU section KF: reserved reserved KY: e Length of the local expansion in bits KH: KM: KM: KM: KM: KM: KM: KM: KM: Local expansion, 8 words Fig. 6.3 Structure of the Job Buffer Unsolicited Status" General section: Opcode M-SU Job-related section: Length of local Format: KY (low byte) expansion Values: 0..128 Meaning: the parameter length_of_local_expansion specifies the number of left-justified bits in the local expansion parameter. 6-17 Volume 2Supplementary Services B8976049/01 Unsolicited Status (continued) Local Format: KM (8 words) expansion: Meaning: the significance of the local expansion is fixed depending on the particular application. The TF parameters logical status" and "physical status" are inserted by the CP itself. The table of statuses is described in the previous section. Sequence description The sequence of the "unsolicited VMD status" service is analogous to the sequence of the information report TF variable service. 6.2.4 Unsolicited VMD Status (Receiver) To allow the frame to be processed correctly on the receiver, the CP must be informed of the location of the received data with a configuration job. Volume 2 6-18B8976049/01 Supplementary Services 6.2.5 Identify Virtual Manufacturing Device (Client) With this service, a client can request information about the attributes of the virtual manufacturing device (VMD) from a server. Job buffer identify virtual device " Gen. Ke. Opcode 4 bytes (ASCII), M-ID section KF: Timeout Monitoring time in 0.1 sec reserved KS: Destination ID. DB, DX KY: 0 | DBno. Data block number KF: DW number Data word number KF: Length Fig. 6.4 Structure of the Job Buffer " Identify Call description General section: Opcode M-ID Timeout: 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For further information about timeout see page 3 - 9. Job-related section: Dest. ID: Format: KS Values: DB, DX Meaning: address at which the information about the identity of the remote station will be stored. 6-19 Volume 2Supplementary Services B8976049/01 Identify (continued) DB number: Format: KY Values: high byte: 0, low byte: 1..255 DW number: Format: KF Values: 0..2042 Length: Format: KF Values: 1..2043, -1 Meaning: length of the data block area in which the information contained in the acknowledgement can be stored; the value -1 means that all the data in the acknowledgement from the DW number to the end of the data block can be accepted. Sequence description The sequence of the "identify virtual device service is analogous to the sequence of the "read" TF variable service. The service cannot be used on the local PLC. Volume 2 6 - 20B8976049/01 Supplementary Services Identify (continued) 6.2.6 Identify VMD (Server) The service is executed by the CP without support of the PLC. However, the attributes of the PLC are contained in the data of the reply. Structure of the reply data The reply data stored by the CP at the S5 address specified in the job buffer has the following structure: DW n Service ID Length at Length of Length of DW n+1 device ID version No. of abstr. free DW n+2 syntax The number of bytes used here is L- [Sj J specified in length of manuf. ID". = Siemens AG 4 No padding byte is inserted. The number of bytes used here is specified in length of device ID". No padding byte is inserted. The number of bytes used here is specified in length of version. No padding byte is inserted. \\ Leer = Device ID = \\ \V \\ = Version \\ \\ Len. of abs. syntax The parameter "no. of abstract syntax ie Abstract |. specifies how often the combination T syntax -7 length of abstract syntax" and abstract Len. of abs. syntax is to follow. No padding bytes syntax are inserted. -c Abstract _ 7 syntax 7 Fig. 6.5 Structure of the Reply Data in the Data Block Service ID: 2h (to assign the reply to the requested service unequivocally) Length_of_manufacturers_identifier: length of the manufacturers identifier contained in the reply data 6 - 21 Volume 2Supplementary Services B8976049/01 Identify (continued) Length_of_the_device_identifier: length of the device identifier contained in the reply data Length_of_the_version: length of the version contained in the reply data Number_of_abstract_syntax: number of elements in the syntax list of the reply data Syntax_list: in the syntax list, the server enters the number of syntaxes it supports If the remote partner is a SIMATIC PLC, the following values are contained in the reply. Length of manufacturer's ID: OBH Manufacturers ID: SIEMENS AG Length of device ID: OFH Device ID: 6GK1 143 0Ax00 Length of version: 12H Version: VA x,y 7/<date> The version consists of 18 characters (including blanks) x,y; current version ID of the CP 143 firmware The parameter <date> contains the data the module file was created specified by the user when entering the SYSID Number of syntax: OH Protocol information: The CP does not support any CS_parameters (Companion Standards) that may occur with the TF services (variable services, general services, domain and program services). Volume 2 6 - 22B8976049/01 Supplementary Services 6.3. Configuration Jobs Purpose Using the configuration jobs, an S5 program can assign certain parameters to an application association. This means that the parameters do not need to be programmed, but can be passed on to the CP while it is running. The configuration only ever applies to the link specified by the HDB call parameter SSNR/ANR". The PLC program triggers configuration jobs once again using job buffers. These can be transferred to the CP at any time after start up. Special note: lf the status of the job (can be ascertained by calling the control HDB) is "job terminated with error" with the error number 0, this means that the connection has been re-established. In this case previously transferred configuration parameters are invalid. IZ Configuration parameters are valid as long as_ the connection is established. The parameters transferred with a configuration job always have priority over programmed parameters. The following connection-specific parameters can be configured by the PLC program: 1. Status word for PLC client jobs For client jobs (odd ANR) the communications processor requires information about the status word assigned by the user, also for calling the SEND-DIR to trigger the job. To inform the CP, the parameter type AN (status word for PLC client jobs) is used. Note: the status word can also be programmed. 2. Source address for server job "read byte string To be able to execute an incoming read byte string" job, the CP must know the S5 address of the required byte string. Parameter type: BL 6-23 Volume 2Supplementary Services B8976049/01 Configuration Jobs (continued) 3. Destination address for server jobs "write byte string To be able to execute an incoming "write byte string" job, the CP must know the S5 address of the byte string to be written. Parameter type: BS 4. Destination address for server jobs unsolicited VMD status indication" To be able to process an unsolicited VMD status indication" job in the CP that was received without being triggered by the PLC, the PLC program must have an S5 destination address available at which the data contained in the job are stored. The structure of the data stored by the CP in the PLC is the same as for the reply data of the "VMD status" service. The service identifier is 1H. Parameter type: MS Volume 2 6 - 24B8976049/01 Configuration Jobs (continued) Job buffer configure ANZW [local]" Supplementary Services KS: 4 bytes (ASCII), A-CF Gen, KS: Opcode section reserved reserved KF: KS: sramerer type $5 source/dest. addr. ce DB, DX, SS DB no. Block number 1-4 address DW no. Offset in DB or DX times $s KS: ANZW identifier DB, DX, FW status L. KY: DB no. l Start Data block number word Start address Fig. 6.7 Structure of the Job Buffer Configure ANZW (local) Sequence description (configure ANZW [local]) PLC (client) CP SSNR ANR | pRB Le ANZW SEND S5 add} PAFE ey [PATE | _ | _A-CF | __A-CF | t Parameters Parameters Anzw = job_active @ Mark parameter Anzw = job_completed_without_error Fig. 6.6 Sequence: Configure ANZW (local)" Volume 2Supplementary Services B8976049/01 Configuration Jobs (continued) Call description General section: Opcode No. of parameters: A-CF Format: KF Values: 1..4 Meaning: up to 4 parameters can be transferred simultaneously. Parameter type Format: KS $5 address: Source/ dest. ID: DB no. DW no.:: Length: Values: AN, BL, BS, MS Meaning: specifies the parameter to be configured Format: KS Values: DB, DX Meaning: source/destination address identifier for configuring the address for the services read/_write_byte_siring. Invalid for parameter type "AN" Format: KY Values: high byte: 0, low byte: 0..255 Meaning: data block number for the parameter types "BL", "BS" and "MS", value 0 only allowed for parameter type "AN" Format: KF Values: 0..2042 Format: KF Values: 1..2043, -1 Meaning: length of the data block area to be transferred with the "read byte string" service or that must be made available for the "write byte string service. The value -1 means that all data can be accepted (only permitted for parameter type "BS") For parameter type "MS" this parameter is invalid. In this case the length is implicitly 11 words. Volume 2B8976049/01 Supplementary Services Configuration Jobs (continued) Status word ANZW identifier: ANZW specification Format: KS Values: FW, DB, DX Meaning: status word type Format: KY Values: high byte: block number low byte: DW number, FW number Volume 2Supplementary Services B8976049/01 6.4 Clock Services The CP 143 clock function is implemented by a clock chip and clock software that uses the clock chip. There are three basic clock functions: 1. The clock keeps the time on the CP 143 within the absolute limits of accuracy described in the technical data. This clock continues to run during a power down as long as the battery voltage is present. 2. The clock can also be used to send synchronization frames so that ail the CP 143s connected to the SINEC H1 network and which participate in synchronization have a relative deviation of 20 ms from each other. The transmitter of the clock message can be either a CP 143 or the SINEC time transmitter. 3. The CP can function as clock master and transmit synchronization frames. The clock frame has a fixed format for SINEC which corresponds to the TF standard. The transmitter uses a special multicast set (Ethernet address 09 00 06 01 FF EF) for transmitting the time message. The user does not need to assign parameters to this, since the clock software executes this task. The time is supplied to the PLC in the S5-155U data format (see page 6-40 ). Volume 2 6 - 28B8976049/0 1 Supplementary Services Clock Services (continued) Bit position for serial Bevnnnnrrronrrronnes 1 transmission via H1 ooootttt Time of day: More significant section tttttttt Milliseconds relative to 0:00 o'clock tttttttt Less significant section tttttttt Date: dddddddd Days relative to 01.01.84 dddddddd Scccc0d }_t it reserved Status Correction value (in 1/2 h) for representing local time Sign for correction (O=forwards, 1= backwards) OOzaasen | Lo 1 = synchronization failed Alternative synchronization on LAN (not implemented with the time transmitter) 1 = time jump (not imple- mented in the time transmitter) Resolution: 01 = 10 ms Time value not correct (not implemented in the time transmitter) reserved Fig.6.8 | Time and Status Representation 6 - 29 Volume 2Supplementary Services B8976049/01 Clock Services (continued) Byte no. Range Factor (* 10 ms} 0 0..99 (10) s*10 s1 1 0..59 min*10 min*1 2 0..59 _ bit 0.5 O-> AM Values "10 n't 3 0..23 bit 6 1> PM bit 7 - BCD-coded 0-> 12H omitted 0 4 0.6 Weekday 13 24H Day*10 Day*1 5 depending on month Month*10 Month 1 6 1.12 Year"10 Year*t 7 0..99 , 8 bit 0..5 deviation in half hours bit 6 free bit 7 Clock correction: sign O=plus Meaning of the weekday: 0 -> Monday 1 = minus 1 -> Tuesday 2 -> Wednesday 3 -> Thursday 4-> Friday 5 -> Saturday 6 -> Sunday This format corresponds to the S5-155format (see page 6-40 ). Byte 8 is an extension derived from the MMS time representation. This represents a flexible time deviation from the standard time. Volume 2 6 - 30B89 76049/01 Supplementary Services 6.4.1. Network Topology, Clock Master/Slave Functions Within a SINEC H1 network, all the 143s can execute clock functions. The aim is to achieve network-wide clock synchronization. Time transmitter H1 7 CP 143 CP 143 CP 143 Station | Station II Station n Fig. 6.9 Network Topology The synchronization can be performed by a SINEC time transmitter or by one selected CP 143. The station that transmits the clock synchronization frames is known as the clock master". In this case, all other stations are "clock slaves". If the synchronization is handled by a SINEC time transmitter, all the CP 143s are clock slaves. f there is no SINEC time transmitter in the network, a CP 143 can be programmed to take over the clock master functions(dynamic clock master = yes in the "CP Initialization Block screen) . The time transmitter has time transmission intervals of 1 sec, 10 sec and 60 sec. If the clock messages are transmitted without the clock transmitter, these transmission intervals should be retained. The default value supplied by COM 143 is 10 sec. This means that all the slaves expect a synchronization frame from the clock master after a maximum of 10 sec. Otherwise, the clock slaves attempt to take over the clock master function (this is only achieved by the highest priority clock slave station, provided this is configured as the DYNAMIC CLOCK MASTER in COM 143). The other CPs then take their time from the highest priority CP. 6 - 31 Volume 2Supplementary Services B8976049/01 Clock Services - Network Topology, Clock Master/Slave Functions (continued) Priority can be assigned to the stations for taking over the clock master function by assigning the Ethernet address as described below. The Ethernet address is defined as follows: Byte 43 2 1 0 Ethernet address (6 bytes) 08 00 06 01 | X x| X x| (default values supplied by COM 143) All six bytes of the Ethernet address can be freely selected. To achieve a clearly defined priority, the user must keep to the following Ethernet address assignment: Byte 5 43 2 1 0 of the Ethernet address The clock slaves are distinguished based on this byte. Name assigned by the user {freely selectable) Default setting made by COM 143 (08 00 06 01) Volume 2 6 - 32B89 7604 9/0 1 Supplementary Services Clock Services - Network Topology, Clock Master/Slave Functions (continued) Further explanations: a) If the first four bytes of the Ethernet address differ from the default value, the module will not attempt to take over the clock master function. b) The CP 143 can only take over the master function when byte 0 of the Ethernet address is within the following limits and at the same time "DYNAMIC CLOCK MASTER" (Y/N)? was answered with "Y" in COM 143. c) Based on byte 0 of the Ethernet address, a time is stipulated after which (if no clock message has been received) the station attempts to become clock master. The following terms are important: > Delay Time corresponds to byte 0 of the Ethernet address in seconds. > Update Time selected time interval for transmitting clock synchronization frames. > Undefined Time sum of the delay time and update time By evaluating byte 0 of the Ethernet address as the delay time, a priority is established for the attempt to take over the clock master functions. 6-33 Volume 2Supplementary Services B8976049/01 Clock Services - Network Topology, Clock Master/Slave Functions (continued) Example: the following table shows which station takes over the clock master function and if this fails, which station will replace it. Status Dyn. master Delay time Master Y 03 Can be master Slave Y 07 Slave Y 08 Assigning the priority Y Slave 10 based on the delay time Slave Y 12 Slave Y 13 N Cannot be Slave 8 master Slave N 21 Slave N 01 etc. t=! iS The delay time must be different for each station. lf this is not the case, the stations with the same delay time will never attempt to take over the clock master functions. This concept ensures that there is always clock synchronization within the network. Volume 2 6 - 34B8976049/01 Supplementary Services 6.4.2 Accuracy The hardware clock of the CP 143 has a maximum deviation of 11.94 say or 8.3 ms/min. This deviation is based on a calculation involving the quartz inaccuracy and temperature fluctuation. To perform accuracy calculations, twice the clock deviation must be assumed, since a clock can be both fast and slow. This results in a time of 23.88 s/day OF 16.6 mssmin. For this reason, it is necessary to compensate for this deviation in the CP 143 hardware clock by receiving synchronization messages. The highest accuracy can be achieved by using the SINEC time transmitter for transmitting synchronization frames. The time is kept on the hardware clock of the CP 143 with a resolution of 10 ms. To achieve a system-wide clock accuracy in the programmable controllers, a time difference of 20 ms must not be exceeded. This is achieved by clock synchronization. 6 - 35 Volume 2Supplementary Services B8976049/01 6.4.3 How the Clock Functions Power . OFF 1 2 Clock Start-up invalid 8 9 3 7 Clock 4 Clock 5 Clock valid slave r?;. master C7 = invisible* CP operating statuses = "visible" CP operating statuses Fig.6.10 Operating Statuses of the Clock The clock can have the following statuses: Description of the status transitions: 1. While the CP is starting up, the hardware clock of the CP 143 is checked. 2. The status of the hardware clock was recognized as invalid. The clock must be reset. 3. The status of the hardware clock was recognized as valid, ie. the hardware clock has already been set. 4. lf during the CP start-up the clock is recognized as valid, the CP automatically assumes the "clock_slave" status. Volume 2 6 - 36B8976049/01 Supplementary Services 5. During the undefined time, no synchronization frame was received. The CP therefore attempts to take over the clock master function. 6. The current clock master has received a synchronization frame from a SINEC time transmitter or a higher priority CP 143. The station once again assumes the status of clock slave. 7. The CP with the clock slave status recognizes an invalid time (e.g. defect hardware clock). 8. This status change is possible after receiving a valid clock message from the clock master from the PG or from the PLC. 9. The CP with the clock master status recognizes an invalid time (e.g. defect hardware clock). 6 - 37 Volume 2Supplementary Services B8976049/01 6.4.4 Several CP 143 TFs on One SINEC H1 Bus without a SINEC Time Transmitter With a bus structure, dynamic clock masters can be configured. Byte 0 of the Ethernet address determines which CP 143 executes the clock master function. A double definition is not possible. Configuring the clock The clock is configured in the screen for configuration of the initialization block of the CP. The values entered in the screen correspond to the defaults. DYNAMIC Y CLOCK MASTER (Y/N): The CP 143 can become the clock master if it has the highest priority and there is no time transmitter in the SINEC H1 network. , N The CP 143 receives synchronization frames if they exist in the H1 network. CYCLE TIMES If the CP 143 is the clock master, it sends clock FOR SYNC FRAMES: _ synchronization frames to the SINEC H1 network 10 (sec) default at the time intervals specified above. Possible values: 1 sec, 10 sec or 60 sec. ETHERNET ADDRESS: 080006010000 The Ethernet address has a double significance for the CP 143 clock function. 1.Only CPs with the address 08000601 at the start can become clock masters. 2.The last byte (ID) of the address decides which CP will become clock master. Only the CP whose ID is the lowest on the SINEC H1 network will be- come clock master, i.e. the CP with the highest priority. Volume 2 6 - 38B8976049/0 1 Supplementary Services 6.4.5 CP 143 TF on a SINEC H1 Bus with SINEC Time Transmitter The SINEC time transmitter has the highest priority as clock master. If a SINEC time transmitter is integrated in an existing bus structure, the CP 143s connected to the SINEC Hi bus that receive a clock message from the SINEC time transmitter assume the status of clock slaves. If a SINEC time transmitter is taken out of the existing bus structure, the CP 143 with the lowest delay time (byte 0 of the Ethernet address) assumes the clock master function. 6 - 39 Volume 2Supplementary Services Setting and Getting the Time from the PLC (continued) 6.4.6 Setting and Reading the Time in the Programmable Logic Controller The SIMATIC S5 CP has the job number 218 available for processing the time. A SEND with this job number writes the CPs time, a RECEIVE, reads the CPs time. These services are possible on the synchronized CP interfaces using the appropriate standard HDBs for the PLC. Data format of the time in a PLC data block (S5-155 U-format) B8976049/01 15 87 43 DW n: tens sec units sec 1/10 sec 1/100s sec DW n+1: tens hour units hour tens min units min DW n+2: tens day units day weekday 0 DW n+3: tens year units year tens mon units mon DW n+4: | time \ adjustment y Sign of the time difference Volume 2 6 - 40B8976049/01 Supplementary Services Setting and Getting the Time from the PLC (continued) Possible values (hexadecimal): 100ths seconds: tenths seconds units seconds tens seconds units minutes tens minutes units hours tens hours Weekday units day tens day units month tens month units year tens year irrelevant for "set time irrelevant for "set time 0...9 0...5 0...9 0...5 0...9 0...1/0...2 Bit 15 = 1: 24 hour format Bit 15 = 0: 12 hour format Bit 14 = 0: AM Biti15= 1: PM Mon...Sun = 0...6 0...9 0...3 0...9 0...1 0...9 0...9 Time adjustment: +/- 0 to 24 in 1/2 hours. Sign of the time adjustment: 0=positive; 1=negative 6 - 41 Volume 2Supplementary Services 88976049/01 Setting and Getting the Time from the PLC (continued) The following identifiers are possible replies to a set time" job from the PLC. Reply ID Meaning (decoded IDs) OK, no error 00H Command could be executed without errors Protocol error 01H acy is invalid (was not set etc. System error OEH System error (e.g. invalid command) Hardware clock OFH Hardware clock failure Volume 2B8976049/01 Setting and Getting the Time from the PLC (continued) Supplementary Services The following identifiers are possible as the reply to a read time" job of the PLC. Reply ID Meaning System error OEH System error (e.g. invalid command) Hardware clock OFH Hardware clock failure Clock_master 06H CP is clock master and is operating as master Clock_slave 07H CP is clock slave Clock_slave, + invalid 08H Station has an invalid clock chip Clock_slave, + asynchronous 09H Station does not receive a clock message Slave, >master OAH CP is clock slave; prepare for master function Master,>slave CP is clock master; prepare for slave function Transmitter, synchronous OBH Transmitter itself does not receive synchronization frames Replacement synchronization 0CH Replacement synchronization ODH free 6 - 43 Volume 2Supplementary Services B8976049/01 Setting and Getting the Time from the PLC (continued) Identifiers of the status word of the handling blocks (HDBs) Receive possible___ Job active | || Setclock | Read clock 00 yes no 0 1 yes yes 10 no no O6H..0FH free 11] no yes | 1 | X X ANZW | | identifier | | Length word | | When the CP 143 is starting up, the lower two bits of the status word are set to "set clock" and "read clock not possible. During normal operation, these bits are set according to the CP clock status. Volume 2B89 76049/01 Supplemeniary Services 6.4.7 Setting and Reading the Time with COM 143 Using COM 143, it is possible to both set the hardware clock of the CP 143 as well as to read the current time (including cyclically). COM 143 TF provides the CLOCK FUNCTIONS screen. When this is called, a read time message is sent to the currently selected CP 143. The screen form is filled with the received data and the possible functions available with the softkeys correspond to the CP clock status. When reading the time, an identifier byte is also sent to the PG protocol, the value of which provides information about the current status of the clock chip. The decoded identifiers are entered in the "CP clock status" field. 6-45 Volume 2Supplementary Services B8976049/01 Setting and Getting the Time from COM 143 TF (continued) CLOCK FUNCTIONS sinccncm F 143 (EXIT) WEEKDAY: HAHHHHAAAE CURRENT DATE: REBHHHHE CURRENT TIME: HABE HH TIME DIFFERENCE (1/2 H): # #4 CLOCK MASTER : # CP CLOCK STATUS: HRABHHHERAAHBRAAHBRABH HAHA F[ JF | lel Je[ |F| | F[ JF FCHELP _] 1 2 READ 3 _ SET 4 5 UPDATE 6 7 OK g SELECT Fe The time is requested once by the PG READ F3 The time can only be set when the CP status is "master SET clock or when the clock chip of the CP 143 is marked as invalid. F5 The PG requests the time cyclically. The CP clock status is UPDATE also updated. F7 The data edited in the screen form are entered as the OK current data. F8 Branches back to the previous screen form. RETURN Volume 2 6 - 46B8976049/01 Supplementary Services Setting and Getting the Time from COM 143 TF (continued) Displays in the COM 143 screen WEEKDAY: MONDAY - SUNDAY CURRENT DATE: e.g. 15. 11. 1991 The data can be set within the limits 01.03.1984 to 31.12 2083. CURRENT TIME: .g. 15:23:43 TIME DIFFERENCE (1/2 H): "+" or"-" and range between 0 and 24 CLOCK MASTER: Indicates whether the current CP 143 is the clock master or is a clock slave CP CLOCK STATUS: CLOCK MASTER the clock sends synchronization frames CLOCK SLAVE the clock receives synchronization fra- mes CLOCK SLAVE,+ INVALID the clock must be set CLOCK SLAVE,+ ASYNC clock does not receive synchronization frames SLAVE <--> MASTER clock status change TRANSMITTER ASYNC time transmitter is itself asynchronous REPLACEMENT SYNC the clock is synchronized from a CP 143 SYSTEM ERROR an internal error has occurred HW CLOCK FAILURE hardware clock has failed 6 - 47 Volume 2Supplementary Services B8976049/01 6.4.8 Restrictions / Tips The time should be read or set by the programmable controller (with RECEIVE) at a time interval > 10 ms. a) The hardware clock of the CP 143 itself only has a resolution of 10 ms. b) With an extremely fast handshake with the handling blocks of the PLCs, the CP 143 can be influenced so that the module is disabled for other activities. To avoid loading the SINEC Hi bus with unnecessary time messages, a synchronization time greater than 10 sec should be selected. To ensure perfect functionality when there is no SINEC time transmitter on the SINEC H1 bus, the following points must be taken into account: > CPs must be distinguished uniquely with byte 0 of the Ethernet address. > The cycle time for synchronization frames on every CP 143 is the same. The preset cycle time is 10 sec (can be modified in the INIT screen form). > At least one dynamic clock master must be programmed. Volume 2 6 - 48B89 76049/01 Supplementary Services 6.4.9 Accuracy > Absolute accuracy The absolute accuracy of the clock chip on the CP 143 is in the worst case +/- 11.94 sec per day. > Relative accuracy if the times on the SINEC H1 network relative to each other should not deviate by more than 20 ms, the relationship between the Ethernet address (ID) and cycle time of the synchronization frame must be borne in mind. Deviations of the hardware clock dependent on the transmission of the synchronization frame: iD Cycle time of the synchronization frame and resulting deviation 1 sec 10 sec 60 sec 0 0.28 ms 2.7/7 ms 1 1 0.55 ms 3.04 1 10 1 15 2 20 25 30 -i- 35 - Il - 40 45 50 55 60 19.37 ms 65 20.75 ms 70 19.64 ms 75 21.03 ms 6 - 49 Volume 2Notes _B89 76049/01 Non-Open Services - Serial Transfer 7 Non-Open Services for Serial Transfer This chapter will familiarize you with the so-called non-open services. The serial transfer services are known as "non-open services. They are not included in the scope of functions of the international standard (MMS standard) and can therefore not be modelled on MMS services. You should only consider using these services when you do not require the conformity with devices of other manufacturers that can be achieved with the open services. Above all, you should check whether the characteristics and concept of the variable services or the domain services would not in fact be better for your communication task. The non-open services are used primarily with existing systems. The serial transfer function class is distinguished by the following characteristics: Data are exchanged between the client and server without address information or parameters relating to the meaning of the data. The following non-open services are supported by the CP: Read byte string (client + server) Write byte string (client + server) Transparent data exchange (client + server) 7-1 Volume 2Non-Open Services - Serial Transfer B8976049/01 7.1 Overview of the Functions and Services General Applications making use of serial transfer have already negotiated the structure and content of the data. In the frame itself, no further information is transmitted apart from the length specification and the data itself. Since no address information is transferred, only one data area (source or destination) can be identified via an application association. Read/write byte string The byte string services are used for unidirectional data transfer, i.e. data are transmitted in only one direction: with the "read byte string service in the acknowledgement message, and in the "write byte string" service with the job message. By calling the "read byte string" service, the client requests data from the server. The job frame itself must not contain data. The client obtains the data from the server in the acknowledgment. With the write byte string" service, the client transfers data to a server. The client can decide whether or not an acknowledgment is required. Transparent data exchange With ihe transparent data exchange service, data exchange can be bi-directional. Data can be transmitted both in the job message and in the acknowledgement. The client can decide whether or not = an acknowledgement is required. Segmented jobs are not supported on either the client or server. Volume 2 7-2B8976049/01 Advantage and restrictions The serial transfer services provide the greatest degree of freedom when configuring communication associations. The user (programmer) must, however, negotiate the meaning and processing of the data. Non-Open Services - Serial Transfer Compared with direct use of layer 4, the user can make use of the TF infrastructure with the serial transfer services. This ensures for example increased reliability with the logical acknowledgment of messages, the time and logical monitoring of TF jobs and the possibility of better use of a transport connection by multiplexing at the application layer. TF service Job PD U Acknowledgment PDU Read byte string Data request frame | Acknowledgment frame data exchange without T~ with requested data data \ | Write byte string Data frame Acknowledgment frame | without data orno acknowledgment | Transparent Data frame + Acknowledgment frame | with or without data | or no acknowledgment Volume 2Non-Open Services - Serial Transfer 7.2. Read Byte String (Client) Request transfer of a data area. Job buffer "read byte string" KS: Gen. KS: section KF: KS: KY: KF: KF: Fig. 7.1 Structure of the Job Buffer "Read Byte String" Opcode Timeout reserved Dest. identifier 0. | DB no. DW number Length B8976049/01 4 bytes (ASCII), B-RQ Monitoring time in 0.1 sec DB, DX Data block number Data word number Volume 2B89 76049/01 Non-Open Services - Serial Transfer Job buffer General section: Opcode: B-RQ Timeout: 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. For further information about timeout, see page 3 - 9. Job-related section: Dest. identifier: Format: KS Values: DB, DX Meaning: S5 address at which the byte string read out will be stored. DB number: Format: KY Values: high byte: 0, low byte: 1..255 DW number: Format: KF Values: 0..2042 Length: Format: KF Values: 1..2043 ee Meaning: length of the data block area in which the byte string can be written. 7-5 Volume 2Non-Open Services - Serial Transfer B8976049/01 Sequence of "read byte string" PLC (client) CP SSNR ANR EB ANZW Cl $5-Adr.| SEND |pare B-RQ [ B-RO_, ' | S5 dest. | S5 dest. address | | Laddress | | Job buffer Anzw = job active Compile TF-PDU e Send TF-PDU ) Reply received (pos.) { e Enter receive request in DPR SSNR - S5 address from job buffer ANR=0 FB == ANZW RECEIVE _, DB/DX qe vate Anzw = Job complete without error Fig. 7.2 Sequence Read Byte String If the job cannot be processed without errors (not illustrated here) this is indicated to the user in the status word (see description "write byte string). Volume 2 7-6B8976049/01 Non-Open Services - Serial Transfer 7.3 Write Byte String (Client) Transfer a data area to the partner Job buffer write byte string " KS: 4 bytes (ASCII), B-WQ or Gen. KS: Opcode mes OS WO section KF: Timeout Monitoring time in 0.1 sec reserved S5 source address KS: e DB, DX, DA SS KY: DB no. Block number address | KF. DW no. Offset in DB or DX KF: Data (if DA specified) Len nen a \\ Fig. 7.3 Structure of the Job Buffer "Write Byte String Job buffer General section Opcode: B-WQ ("write byte string with acknowledgement") or Opcode: B-WO ("write byte string without acknowledgement) Timeout: 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified 7-7 Volume 2Non-Open Services - Serial Transfer B8976049/01 in multiples of 0.1 sec. For further information about timeout, see page 3 - 9. Job-related section Source ID: DB number: DW number: Length: Format: KS Values: DB, DX, DA Meaning: S5 source address at which the byte string to be written is stored. DB for data block DX for extended data block DA for data in job buffer Note on the "DA" identifier Apart from the TF service specification and the required parameters, the S5 user program can also transfer the data simultaneously to the CP. This is possible when the specified $5 address is a data source. This allows a considerable increase in the data throughput, as can be seen in the description of the sequence (see detailed description of the services). When using this facility, remember that a job buffer must not exceed 256 bytes. The data must follow on immediately after the last valid parameter of the job buffer. Format: KY Values: high byte: 0, low byte: 1..255 invalid with source ID DA Format: KF Values: 0..2042 invalid with source ID DA Format: KF Values: 1..2043 Meaning: length of the data block area to be transferred with the service. Volume 2B89 76049/01 Non-Open Services - Serial Transfer Sequence of "write byte string PLC (client) SSNR ANR A NZW FB TI $5-Adr| SEND | B-WQ IS5 source address Job buffer without data FB SH ANZW SEND PAFE DB/DX uw CP B-WQ 1 S5 soure | address Anzw = job active Compile TF-PDU e Enter send request in DPR - $5 address from job buffer Data TE-PDU | | | | | uw Send TF-PDU ) Reply received (pos.) Anzw = job complete without error Fig. 7.4 Write Byte String with Acknowledgment (Example: Source ID = DB/DX) 7-9 Volume 2Non-Open Services - Serial Transfer PLC (client) SSNR ANR $5-Adr| SEND | pare aan | PAPE | B-WO DA |__| free / data | Job buffer with data Fig. 7.5 B8976049/01 CP Anzw = job active e Compile TF-PDU - data from job buffer e Send TF-PDU ) Pos. transp. ack. received _ Anzw = job completed without error Write Byte String without Acknowledgment (Example: Source ID = DA) Volume 2 7-10B8976049/01 Non-Open Services - Serial Transfer Errors The situation in which the job could not be completed without errors is not represented here, but is indicated to the user as with the other services by setting the error identifier (TF error occurred) in the status word and entering the parameters ERRCLS and "ERRCOD" of the reply in the third word after the status word address. The situation in which the server is unable to accept the data completely (ERRCLS = 2AH, ERRCOD = 1H) is a special case. To allow the client to determine how many bytes have been accepted in the server, it can trigger a (local) request byte string length" job (see below), by specifying an S5 destination address at which the parameter number of accepted data in the server is to be stored. This job must always be triggered when the parameter mentioned above is to be transferred to the PLC and is then always valid for the last "write byte string" job triggered by the client. The service is only executed locally and is only useful when a "write byte string with acknowledgement (B-WQ) was started immediately before. The request byte string length" is triggered as with all client jobs by a job buffer, whose structure is illustrated in the following diagram. Following this, the sequence is illustrated based on an example. KS: Gen. KS. Opcode 4 bytes (ASCII), B-WI section KF: reserved reserved $5 destination address S5 [ KS: Identifier DB, DX address KY: DB no. Block number KF: DW no. Offset in DB or DX A length is not specified, one word is always required. Fig. 7.6 Structure of the Job Buffer "Request Byte String Length" 7-11 Volume 2Non-Open Services - Serial Transfer B8976049/01 B-WO _ $5 source address data Lee Anzw = job active Compile TF-PDU Send TF-PDU Reply received (neg., not all data accepted) ) Enter receive request in DPR - $5 address from ANZW (ERRCLS/ERRCOD) Anzw = job terminated with error Enter receive request in DPR - $5 address from ANZW B-WI | | $5 dest. address | Anzw = job active }}___ Enter receive request in DPR - $5 address from job buffer Number of data accepted from PDU ar Anzw = job completed without error PLC (client) SSNR ANR ANZW FB Sb add.| SEND | pare | | B-WQ | IS5 source address | data | Job buffer | with data SSNR | ANR=0 anzvw]tStB _ N ANZW RECEIVE L. AH] 1H SSNR ANR anzw | _F8 s5add,| SEND [pare B-WI S5 dest. address i SSNR ANR=0 Anzw) FB | 7] ANAW RECEIVE | i A Fig. 7.7 Write Byte String with Acknowledgment if Error Occurs, when the Server cannot accept all the data of the job (Example: Source ID = DA) Volume 2 7-12B8976049/01 Non-Open Services - Serial Transfer 7.4 Read/Write Byte String (Server) Both these services are interpreted and executed in the CP on the server side, largely without support of the PLC CPU. All the CP handling blocks "SEND-ALL" and "RECEIVE-ALL" required as DMA substitutes must be called in the PLC program. The assignment of the data to an S5 address must be configured for these services (see also "configuration jobs"). This means that before the CP can process this type of service, an appropriate configuration job must be triggered locally on the link. To allow server processing of a read byte string job, the source of the data is specified in the configuration job. For the server processing of a write byte string job, the destination of the data is specified in the configuration job. The configuration job must be transferred to the communications processor as a client job with a "SEND DIRECT" job. 7-13 Volume 2Non-Open Services - Serial Transfer B8976049/01 Job buffer configure ANZW" for the server handling of write/read byte string jobs KS: 4 bytes (ASCII), A-CF Gen. KS: Opcode section reserved reserved KF: KS: BL, BS $5 source/dest. addr. KS: Source identifier DB, DX, SS KY: DB no. Block number 1-4 address KF: DW no. Offset in DB or DX times KF: Length $5 KS: ANZW identifier DB, DX, FW status KY: DB no. | Start Data block number word Start addr. Fig. 7.8 Structure of the Job Buffer Configure ANZW" Call description General section Opcode: A-CF Job-related section Number of Format: KF parameters: Values: 1..4 Meaning: up to four parameters can be transferred simultaneously. Parameter Format: KS type: Values: BL, BS Meaning: specifies the parameter to be configured. BL: source address for "read byte string server job BS: source address for read byte string" server job S5 address Volume 2 7-14B8976049/01 Source/destinatibormat: identifier: Values: Meaning: DB no.: Format: Values: Meaning: DW no: Format: Values: Format: Values: Meaning: Length: Status word Format: Values: Meaning: ANZW specification Format: Values: Non-Open Services - Serial Transfer KS DB, DX source/destination address identifier for configuring the address for the read/write byte string services. KY high byte: 0, low byte: 1..255 data block number for the parameter types "BL", "BS". KF 0..2042 KF 1..2043, -1 length of the data block area to be transferred with the "read byte string service or to be made available for the "write byte string" service. The value -1 means that all the data can be accepted (only permitted for parameter ("BS"). ANZW identifier KS FW, DB, DX status word type KY high byte: block number low byte: DW number, FW number 7-15 Volume 2Non-Open Services - Serial Transfer PLC (server) SSNR ANR ANZW $5add| SEND |pare 4 FB [- _ B8976049/01 CP { A-CF_, Fig. 7.9 jobs on the server A-CF ~ Parameter Parameter | BL: source address for oo read byte string" server job BS: destination address for write byte string" server job Anzw = job active Mark parameter Anzw = job completed without error Sequence: Configure ANZW" for handling Read/Write Byte String" Volume 2B8976049/01 Non-Open Services - Serial Transfer 7.5 Transparent Data Exchange (Client) A data area is transferred to the partner with the implicit request to send a reply with data. Job buffer "transparent data exchange" KS: 4 bytes (ASCII), T-DQ Gen. KS: Opcode T-DO section KF: Timeout Monitoring time in 0.1 sec reserved S5 source address KS: Source identifier DB, DX, DA SS Ky:| 0 | DBno. Block number address | kf. DW no. Offset in DB or DX KF: Length KS: . Identifier DB, DX SS KY: 0 no. Data block number address KF: DW no.. Data word number KF: L Data {if DA specified) a \\ | at \\ Fig. 7.10 Structure of the Job Buffer "Transparent Data Exchange" 7-17 Volume 2Non-Open Services - Serial Transfer B8976049/01 Job buffer General section Opcode: Timeout: T-DQ ("transparent data exchange with acknowledgement") or Opcode = T-DO (transparent data exchange without acknowledgement") Note: If the client receives an acknowledgment with data length zero after a job with acknowledgment, this is indicated by the SINEC TF error number 3028. 1 word, format: KF Specifies the maximum length of time the user program will wait for an acknowledgement for the service (i.e. the maximum dwell time of the job in the CP). This is specified in multiples of 0.1 sec. If the job is completed within the specified time, the parameter is irrelevant. For further information about timeout, see page 3 - 9. $5 source address Source ID: Format: KS Values: DB, DX, DA Meaning: Address at which the data to be transmitted are stored. DB for data block DX for extended data block DA for data in job buffer Note on the "DA" identifier Apart from the TF service specification and the required parameters, the S5 user program can also transfer the data simultaneously to the CP. This is possible when the specified S5 address is a data source. This allows a considerable increase in the data throughput, as can be seen in the description of the sequence (see detailed description of the services). When using this facility, Volume 2B8976049/01 DB number: DW number: Length: Non-Open Services - Serial Transfer remember that a job buffer must not exceed 256 bytes. The data must follow on immediately after the last valid parameter of the job buffer. Format: KY Values: high byte: 0, low byte: 1..255 invalid for source ID DA Format: KF Values: 0..2042 invalid for source |D DA Format: KF Values: 1..2043 Meaning: length of the data block area to be transferred with the service. $5 destination address Dest. identifier: Format: KS DB number: DW number: Length: Values: DB, DX Meaning: Address at which the data in the acknowledgement will be stored. This address can also be invalid (DB no. = 0). In this case, no data can be expected in the acknowledgement. Values: high byte: 0, low byte: 0..255 ome Format: KF Values: 0..2042 Format: KF Values: ..2048, -1 Meaning: length of the data block area in which the data in the acknowledgement will be stored; the value -1 indicates that all the data in the acknowledgement from the DW number to the end of the data block can be accepted. 7-19 Volume 2Non-Open Services - Serial Transfer B8976049/01 Sequence of "transparent data exchange PLC (client) CP SSNR ANR | 5B ANZW SS. $5add} SEND | pare ~T-50 08 S5 source! ddrese | address address |] $5 desi. address | | | laddress_ Job Anzw = job active u | pee t | Compile TF-PDU withou | data | Enter send request in DPR | - $5 address from job buffer SSNR | ANR= FB | ANZW | os SEND ||| Box id Data | > TF-PDU (request) | | | | ! | | Send TF-PDU Reply received (pos.) SSNR ANR=0 FB ANEW | RECEIVE DB/DX TF-PDU (acknowledgement) | os Anzw = job completed without error Fig. 7.11. Transparent Data Exchange with Source ID "DB" or "DX" If the source identifier in the job buffer is "DA", then the SEND-ALL block call is omitted in the sequence illustrated here. For the service without an acknowledgement request (T-DO), or if the acknowledgement does not contain data or the destination identifier in the job buffer is invalid, then the RECEIVE-ALL block cail is omitted in this sequence. Volume 2 7-20B8976049/01 Non-Open Services - Serial Transfer 7.6 Transparent Data Exchange (Server) For the non-open STF service "transparent data exchange" the service request must be passed on to the PLC program, since the data can only be interpreted there. To allow for this, the parameter and data section of the TF-PDU is preceded by a "job header in which the service is described and passed on to the PLC. Structure of the job header (three words) KY: Opcode KY: reserved KY: length In the opcode, the CP informs the PLC CPU of the required service as follows: High byte: OBOH: non-open STF services Low byte: 0 transparent data exchange without acknowledgement 1 transparent data exchange with acknowledgement The 2nd word in the job header is reserved (value 0 is entered) it contains a response code in the reply. In the length parameter, the interface module informs the PLC how many valid bytes (without header) were transferred to the PLC. 7-2 Volume 2Non-Open Services - Serial Transfer B8976049/01 CP PLC program | TF job with | acknowledgement request | received | | AP Job status = header "receive useful" __J Data | | . Receive DIR | SSNR | | >| Opcode passes | |, Job | Osh gh] header Data | \ Job status = ' send direct | permitted" Send DIR SSNR only | for PAFE job with acknowledgement | LL ] Opcode posses 3 | Job |. esp _ | header Cength Send TF r Reply] acknowledgement | data | Job status = "job disabled" | | Fig. 7.12 Sequence "General Server Interface Volume 2 7-22B89 76049/01 Non-Open Services - Serial Transfer If the job does not require an acknowledgement, the status word is set to "job disabled" on completion of the receive job. For a job with an acknowledgement, the PLC program must generate a reply that is transferred to the CP with a send direct call. The sending of the acknowledgement by the PLC program is not time-monitored by the CP. The first three words of the PLC acknowledgement must once again be contained in a job header, in which the second word contains a response code. The first word of the job header is taken from the job. If the PLC wants to acknowlege the job positively, the response code is 0. Otherwise, error codes according to the AP protocol (ERRCLS, ERRCOD) are entered in this word. The response code is entered in the AP header by the CP. If data bytes are to be transmitted in the acknowlegement, these must be located immediately after the job header, the length of the data {in bytes) must be located in the third word of the job header. If the acknowledgement does not contain data, the send direct call by the PLC program must have a length = 3. In the third word of the job buffer, the length = 0 must be entered (no data in acknowledgement). If the length of the frame to be transmitted exceeds the frame length negotiated between the PLC and interface module during the course of a handling block call (send-dir, receive-dir), the segmentation is automatically carried out by the CP and entered in the status word to inform the PLC program. lf the length of the data to be transmitted exceeds the frame length set in the synchron HDB, the handling blocks SEND or RECEIVE-ALL must continue to be called in the cyclic PLC program. The PDU length must not be less than the number of data bytes to be transmitted. If all the data are accepted with a RECEIVE-DIRECT, remember that the maximum number of data to be received is not limited by the length specified for the handling biock.Q 7-23 Volume 2Non-Open Services - Serial Transfer B8976049/01 7.7 Addendum to Transparent Data Exchange 7.7.1. Status Word of the TRADA on the Server Status ANZW without ackn. ANZW with ackn. After cold restart OA0A not defined at OAOA not defined at present present After connection OEOQA OEOA establishment After connection OA0A OAOA termination After trigger from client |00x3 00x3 Data reception triggered |00x2 00x2 Data all received OExA OEx4 Ackn. triggered by omitted 00x2 server Ackn. transmitted omitted OEOA The table illustrates the time sequence of the transparent data exchange service with/without acknowledgment and the status word on the server can be seen in greater detail. When configuring the server, remember the header required for the receive and transmit buffers. Volume 2 7-24B89 76049/01 Non-Open Services - Serial Transfer 7.7.2 Example of a Program for Evaluating the Bits of the ANWZ on the TRADA Coordination of the status word corresponds to the normal status word evaluation. The bits are scanned as described in the CP 535 and CP 143 manuals. The basic state can, however, cause confusion. This basic state (OEOA) is a self-protection mechanism of the CP so that jobs cannot be connected to the passive ANR without the CP being informed. The following bit evaluation is suitable both for the TRADA with and without acknowledgment. The parameters for the direct blocks must be adapted to the situation. The example was written for an S5 115U programmable logic controller but could easily be ported to other PLC types. FB20 Segment 1 0000 NAME: TRADA 0005 : Bit evaluation of the server 0006 : ANZW with the non-open 0007 : SINEC TF service TRADA 0008 : - ANZW for RCV-D and SNDD-D 0009 : selected the same (not absolutely 000A : necessary) 000B : - Run through CONTROL for this ANR 000C : at the beginning 000D : 000E : = OO0F : System status bytes and control 0010 : for the user: 0011 : FY 80.0 = 1 => trigger RCV-D 0012 : FY 80.1 = 1 => trigger SND-D 0013 : FY 80.2 = 1 => run RCV 0014 : FY 80.3 = 1 => run SND 0015 : FY 80.7 = 1 => user acknowledgment 0016 ; 0017 7-25 Volume 2Non-Open Services - Serial Transfer B8976049/01 0018 FY 81 internal edge ANZB 0019 001A FW 82 ANZW of the HDB 001B FW 84 length word of the HDB 001C FW 86 SINEC TF error word if 001D link status word is the same 001E 001F 0020 O F 1.0 0021 ON F 1.0 0022 : JU FB 247 0023 NAME : Update control status word 0024 : KY 0,0 0025 : KY 0,2 0026 ANZW FW 82 0027 PAFE : FY 5 0028 : 0029 002A A F 83.0 Handshake useful & 002B A F 83.1 Job active & 002C AN F 83.3 Job complete without error 002D S F 80.0 -> RCV-D can be triggered 002E S F 81.0 002F : 0030 A F 80.7 Acknowledgment for the trigger 0031 : must be provided by the user 0032 A F 81.0 0033 RF 80.7 0034 RF 80.0 0035 R F 81.0 0036 JC FB 245 0037 NAME RECEIVE RCV-D to trigger data reception 0038 SSNR KY 0,0 0039 A-NR KY 0,2 003A ANZW FW 82 003B ZTYP KS DB 003C DBNR KY 0,3 003D ZANF KF +0 003E ZLAE KF + 103 003F PAFE FY 5 Volume 2 7-26B8976049/01 0040 0041 0042 0043 0044 0045 0046 0047 0048 0049 004A 004B 004C 004D 004E 004F 0050 0051 0052 0053 0054 0055 0056 0058 0059 005A 005B 005C 005D O05E 005F 0060 0061 0062 0063 0064 0065 0066 0067 0068 0069 NAME SSNR A-NR ANZW ZTYP DBNR ZAM : PAFE NAME Non-Open Services - Serial Transfer AN F 83.0 Handshake not useful and & AN F 83.1 Job not active & AN F 83.3 Job complete without error SF 80.1 ->SND-D can be triggered S F811 A F 80.7 Acknowledgment for trigger : must be provided by user A F 81.1 RF 80.7 RF 80.1 R F 81.1 JC FB 244 SEND SND-D to trigger acknowledgment : KY 0,0 KY 0,2 FW 82 KS DB KY 0,2 KF +0 FY 5 : JU FB 25 Call ALL blocks since ALL bit evaluation follows A F 83.6 Data accepted R F 83.6 R F83.4 S F 80.2 Identifier for the user that the data : have been accepted completely >A F 83.5 Data transfer successful R F 83.5 R F 83.4 S$ F 80.3 Identifier for the user that the data : were transferred completely BE 7-27 Volume 2Non-Open Services - Serial Transfer B8976049/01 FB 25 SEGMENT 1 0000 NAME: ALL 0005 JU FB 244 0006 NAME SEND SEND-ALL for segmenting 0007 SSNR : KY 0,0 0008 A-NR KY 0,0 0009 ANZW FW 100 000A ZTYP KS 000B DBNR KY 0,0 000C ZANF KF +0 000D ZLAE KF +0 O000E PAFE FY 5 000F : 0010 JC FB 244 0011 NAME RECEIVE RCV-ALL for segmenting 0012 SSNR : KY 0,0 0013 A-NR KY 0,0 0014 ANZW FW 102 0015 ZTYP KS 0016 DBNR KY 0,0 0017 ZANF KF +0 0018 ZLAE KF +0 0019 PAFE FY 5 001A : 001B BE The data blocks must have the appropriate headers.Q Volume 2B89 76049/01 TF interface Configuration, Test 8 Configuring and Testing the TF Interface If you have decided to use the TF interface, you will find the descriptions of the required configuration functions of the COM 143 TF tool in this chapter. The main point of interest is the description of the link in the data link block. Apart from this, the definition and use of variables are important when configuring the TF interface. Along with the configuration functions for the data link block, you are also provided with the tools necessary for documentation, starting-up and testing the link. The possibilities range from start/stop of the CP to data-dependent monitoring of the communication. This chapter explains the use of the following functions: > configuring application associations > configuring variables > test functions for links > documentation functions During configuration, it is advisable to perform the steps in the order shown in the following overview. The margin entries shown on a gray background are references to the "COM 143 TF Configuration Tool supplement accompanying this manual. 8-1 Volume 2TF Interface Configuration, Test B8976049/01 8.1 Overview The diagram below is an overview of the steps and functions available for configuring and operating a TF interface. [ Steps and corresponding functions | Configuring the TF eS interface Application Associations Section. 8.2 Edit | VMD Variables Edit | VMD Configuration Documenting Edit | Documentation the Configuration g Application Associations Section 8.3 Te Transferring see Volume 1, Chapter 8 Configured Data Transfer | Transfer Database Section 8.4 Testing the TF Test | Appl. Associations Interface Section 8.5 Fig. 8.1: | Configuration Steps for TF Services Volume 2 8-2B8976049/01 TE Interface Configuration, Test 8.2 Configuring the TF interface 8.2.1 Edit] ... | Application Associations Aims This screen allows the definition of data link blocks that can be used for TF services. Starting with this link configuration, link-specific variables can then be configured by changing from this screen to the variables editor. Link-specific configuration of variables When configuring variables, a distinction is made between the local definition for server functions and the remote definition for client functions: Local definition : Variables are managed in the PLC whose application associations are being configured. Other communications partners (PLCs) write or read these variables. Remote definition: The PLC whose application associations are being configured writes, reads or reports variables. Essential basic configuration A data link block can only be defined when the module file has been completely initialized. Refer to the procedure for basic configuration described in Volume 1, Chapter 7. A maximum of 64 SINEC application associations each with a TF-PDU size of 1024 bytes can be configured. Note: Some of the information in this screen is identical to the parameters for calling the handling blocks in the STEP 5 user programs. 8-3 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ...|[Application Associations (continued) The parameters of the screen for data link blocks SSNR The parameter specifies the interface number or page number via which the communications channel is addressed. The number is formed from the base interface number and the selected page. The PG checks that the interface number is within the permitted range of values and rejects illegal interface numbers. The number specified here must also be specified in the handling block for link identification. Range of values: base SSNR + page number (0..3) ANR: In conjunction with the local interface number, the job number specifies the data link block uniquely. This means that the ANR cannot be assigned more than once per SSNR of a CP 143 module. Only odd job numbers can be assigned. In the control program, the job number and the interface number must be transferred to the handling block to identify the link and job. Range of values: 1..127 ANZW: Status word for the defined job (see: specification of handling blocks) Form: FW 0....,199 or DB < 0,...,255> *< 0,...,32...> DB number word number With client jobs, this status word is transferred by the CP to the HDBs in the SEND/RECEIVE-ALL jobs. Volume 2 8-4B8976049/01 TF Interface Configuration, Test Edit | ...[Application Associations (continued) Local TSAP: Note: The link status word is used for the CLIENT station, i.e. is the service initiator. Three words are required for the status word. It is advisable to make this status word identical to the handling block status word. Structure of the ANZW: M Length word M+1 ERRCLS/ERRCOD |[M +2 lf the address of the ANZW for the link is different from that of the ANZW for the HDBs, the address M and M+1 are used exclusively for the SEND/RECEIVE ALL block. Transport service access point of the local device. Representation and input of the TSAP: LENGTH: HEX: This has the default "8". With connections to non-SIMATIC $5 stations, it may be necessary to specify shorter lengths. Range of values: 2..8 The individual bytes of the TSAP-ID must be entered in groups of two hexadecimal numbers (values 00 to FF). To make the ID easier to read, the groups of two numbers should be separated by blanks. With this type of input, the TSAP-ID can also have numerical values. !f you only enter zeros here, the TSAP counts as being unspecified. Range of values: 8 Bytes 8-5 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ...,Application Associations (continued) Est. type The TSAP-ID entered in the HEX field is displayed here as an ASCII string. Blanks and non-interpretable characters are displayed as underscores. An ASCIl character entered here is displayed in the HEX field in hexadecimal notation. Range of values: 8 characters Example. Length: 5 HEX: 31 32 33 34 35 ASCII: 12345 Note: This distinction between hex and ASCII has the following advantages: - specifying TSAPs as an ASCII string - TSAP selection not only restricted to ASCII characters. A4 = active connection establishment only layer 4 A7 = active connection establishment layers 4 and 7 P4 = passive connection establishment only layer 4 P7 = passive connection establishment layers 4+ 7 D4 = dynamic connection establishment only layer 4 D7 = dynamic connection establishment layers 4+ 7 Connection establishment using only layer 4 should be selected when there is no application association management implemented on the partner system. For more detailed information, refer to Chapter 6 {Application associations). The establishment of a link is handled implicitly by the CPs, i.e. there is no explicit job from the PLC. Connections are established as follows: active: the CP initiates connection establishment during start-up. passive: the CP expects a connection request from the partner. Volume 2B8976049/01 TF Interface Configuration, Test Edit | ...JApplication Associations (continued) dynamic: the CP establishes the connection as soon as a job is pending for the configured link. Multiplex address of the layer 7 link Range of values: 0,...,255 where 0: no multiplexing Note: The multiplex addresses of layer 7 links must be unique for the current layer 4 connection. Remote Analogous to local TSAP TSAP: For correct connection establishment, the local TSAP must match the remote TSAP of the partner and vice-versa. Appl. Ass. Name of the defined application association Name: Range of values: 32 ASCII characters (only for information) Remote Ethernet address of the partner station Ethernet- Range of values: 12 characters from {0....,F} Address: Default: 080060010000 Number of Number of defined jobs <SSNR, ANR> for this layer 4 appl. ass. connection, defined by TSAPs and Ethernet address in the foreur, TSAP case of SINEC H1. Range of values: 1,...,255 Default: 1 Current This indicates which of the jobs included in the number of job: application associations field is currently being processed or displayed. Range of values: 1,...,255 8-7 Volume 2TF Interface Configuration, Test B8976049/01 Edit | .../Application Associations (continued) Note: The link-specific part described here for COM 143 refers to SINEC H1 connections and is used to supply the transport software. The global parameter field of a data link block is generated from the TSAPs and Ethernet address. The corresponding local parameter fields (1... number of jobs) are made up from the establishment type, MUX address, logical partner name, local variables and remote variables. Volume 2B89 76049/01 TF Interface Configuration, Test Edit | ....[Application Associations (continued) Function keys (additional keys or keys with a special significance): FA Display the next data link block or next field of local +1 parameters for a layer 4 connection. Here, there are two possibilities: a) Number of jobs > 1 and current job < number: only the next local parameter field of the already displayed link is displayed. The global parameters can then no longer be modified. b) Next data link block is read and displayed or if the number of jobs is 1, the first local parameter field is displayed. If there is no further block, the display begins from the beginning again. F2 Analogous to F1, paging backwards Al F3 Input new data link block: INPUT F4 Submenus for variable definitions, to be used for server LOCAL services (read, write) (-> M 2-4-2.2) F5 Submenus for remote variable definition to be used in client REMOTE calls (-> M 2-4-2.3) FG The current job (currently displayed job) is deleted DELETE (confirmation is required: delete yes/no). If there is only one job for the connection (layer 4), the whole data link block is deleted. F7 Alt the changes are accepted. If you are working offline, the OK module file is modified. 8-9 Volume 2TF Interface Configuration, Test B8976049/01 Edit | .../[Application Associations (continued) Configuring local variables After selecting the function keys F4 - LOCAL in the M 2-4-2.1 screen, the LOCAL DEFINITION screen is displayed. Here, you define or configure local, flink-specific variables and their structures belonging to values in local data blocks. These variables can only be accessed via the link currently being configured. Name: Maximum 32 character long identifier for a variable. Type: Specifies the type of the variables: the first input field (2 characters long) identifies the actual variable type and the 2nd input field (4 characters long) the variable length. Volume 2 8-10B8976049/01 Edit | ...|Application Associations (continued) TF Interface Configuration, Test The following types of variable are permitted: BO Boolean - BS Bit string number of valid bits IN Integer 8, 16, 32 bits UN Unsigned Integer 8, 16, 32 bits FP Floating point 32 bits OS Octet string length in bytes vs Visible string length in bytes Tl Time of day 4 bytes generated by COM TD Time and date 6 bytes generated by COM { Start of structure number of components (calculated by COM) } End of structure AR Field number of elements in an array Table 8.1. Variable Types ACC: Access type: R only reading possible, no specification means access not restricted $5 ADDRESS: Address of the memory area for modelling the value of the variable on the PLC. FORMAT: <ORG_identifier> <EXT_identifier> <start addr.> ORG_identifier = DB or DX for data block or extended data block EXT_identifier = 0..225 data block number Volume 2TF Interface Configuration, Test B8976049/01 Edit | ...|Application Associations (continued) Start addr. = data word number, at which value of the variable starts. ANZW: Configured status word for server functions with these variables Format: <TYPE> <DBNO> <DWNO> or <FWNO> (Range of values: TYPE = FW, DB, DX DBNO = 0..255, if TYPE = DB or DX (data block number FWNO = 0..255, if TYPE = FW (flag word number) DWNO = 0..255, if TYPE = DB, DX (data word number) DWNO = empty, if TYPE = FW). Note: The variable status word is required for the SERVER station. Two words are required for this status word and overlapping must be avoided. 15 12 11 8 7 4 3 0 Address: free Error Data Status ress: management |management = |management M Length word M-+1 Apart from configuring the name and type of the variables and the $5 address at which the variable is stored by the PLC program, it is also possible during configuration to specify an address for a status word. Here, the PLC program can then obtain information about access to the variable. The PLC program can, for example, recognize whether the value of a variable has been updated by another station or that there has been no access. Using the status word, the PLC program can also block access to a variable for another station (temporarily). How to use the status word and the meaning of the individual bits can be found in the descriptions of the CP handling blocks (see Chapier 3). Volume 2 8-12B8976049/01 TF Interface Configuration, Test Edit | ...,|Application Associations (continued) The status word as presented here is identical in its structure to the status words of the handling blocks. SSNE: This specifies the CPU in which the variable is physically located. In the single processor mode the SSNR specified for the link must be entered (default). In the multiprocessor mode, ((CPU no.) -1) must be entered. Since in the SIMATIC PLC in a station (e.g.S5-155 U, $5-135 U) up to four CPUs can operate in the multiprocessor mode, not only the S5 address but also the interface via which the CP accesses the variable (i.e. the physical CPU on which the variable is located) must be specified when configuring VMD-specific and link-specific variables. is The nesting level for variables is restricted to 2. Function keys (additional keys or keys with a special significance): FS The variable marked by the cursor is deleted. If this DELETE variable is a structure or an array identifier, the whole structure or array is deleted and the variables definitions are shifted together to close the gap. F6 A line is inserted for a new definition at the cursor position. INSERT F7 With this key, you can change the softkey menu. Your CONTINUE input can then be entered with the OK function key (F6). Sofkeys displayed after changing over with F7: F6 The data entered is converted to internal structures. You OK quit the screen, but only save the data when you quit the link screen. 8-13 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ...|Application Associations (continued) Example CP 143 (EXIT) LOCAL DEFINITION SOURCE:C:XXXXXXXX [_] NAME TYPE ACC $5 ADDRESS ANZW _ SSNA : ( {3 dipl| 0B 190 200 FW 30 1 - | FAR} HO IN|H16 ee { |/2 HRIS in ||16 ANDREWS UN|}/32 Ui vsj]i6 : ; F[ JFL JFL ]F[ JF JF ] F JF ] 1 PAGE+1 2 PAGE-1 3 LINE+1 4 LINE-1 5 DELETE 6 INSERT 7 OK 8 SELECT Fig. 8.2: Local Variables In plain language, this screen has the following meaning: OTTO is a structure with the following components: KARL = an array with 10 elements of the type integer 16 THEO = a further structure with the components: CHRIS = integer 16 ANDREW = unsigned integer 32 ULLI = visible string with a length of 16 bytes The structure OTTO can only be read owing to ACC = R. The structure is mapped on data block 100 starting at data word 200. Flag word 30 is used as the status word for the variable. Note the following points: For structures, you only need to specify the S5 address of the start of the structure. Where the components of the structure (within a data block) are Volume 2 8-14B8976049/01 TF Interface Configuration, Test Edit | ...[Application Associations (continued) actually located is calculated by COM 143 and displayed the next time you page through the variables definitions. The length of structures is also calculated by COM 143 based on the com- ponents entered and is displayed the next time the variable definitions are called. The calculation of S5 addresses and structure lengths is only started when you exit the edit mode with "OK" (F7) since only then are the external ASCII structures converted to the internal representation. If an error is detected, an error message is generated and displayed. e.g.: "Error in group: xyz variable: OTTO not defined" "Parenthesis error" (the cursor is then positioned on the line containing the error). The definitions are inset automatically to make the screen clearer, but this is only visible the next time the variables are edited. 8-15 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ....JApplication Associations (continued) 8.2.1.1 Configuring Remote Variables Analogous to the link-specific local variables accessed by the CP as server, remote variables can also be specified which can be accessed via the link acting as the client (known as remote variables"). These variable definitions are used by the CP when the variable is not completely specified in the job buffer or cannot be completely specified (e.g. no type specification in the job buffer) during a client call (read/write a variable). The scope must also be specified for such variables. Input fields: SCOPE: scope of the remote variables VB = link VM = virtual machine DO = domain NAME: analogous to definition of local variables TYPE: analogous to definition of local variables $5 ADDRESS: analogous to definition of local variables ANEW: analogous to definition of local variables SSNR does not need to be specified, since in client jobs, the addressed variable must always be located in the CPU from which the job was triggered. Volume 2 8-16B8976049/0 1 TF Interface Configuration, Test 8.2.2 Edit | VMD Variables The VMD variables menu item provides you with functions for defining VMD-specific variables. VMD-specific variables are stored in a special organization block within the configured module. Meaning of the scope VMD-specific variables can be accessed via any application association. Creating groups for the information report service VMD-specific variables can be collected together into groups. Groups are purely local objects which aliow simpler access to all the grouped variables for the information report service. The Local Definition" screen is structured identically to the screen for variable definitions when configuring links (see page 8- 10). cS The nesting level for variables is restricted to 2. Function keys (additional keys or keys with a special significance): F5 The variable marked by the cursor is deleted. If this DELETE variable is a structure or an array identifier, the whole structure or array is deleted and the variables definitions are shifted together to close the gap. F6 A line is inserted for a new definition at the cursor position. INSERT F7 With this key, you can change to a new softkey menu. CONTINUE 8-17 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ....VMD Variables (continued) The following function keys are available in the second softkey menu. (additional keys or keys with a special significance): F2 This function allows variables to be grouped together. The GROUP screen M2-5.3 Definition of Grouped Variables is displayed. (see Section 6.2.2.1) F4 All the VMD-specific variables can be deleted, however, DEL BLOCK | you will be prompted to confirm your intention DELETE YES/NO. After deleting the variables, you return to the TF overlay initial screen form. F5 The variable marked by the cursor is deleted. If this DELETE variable is a structure or an array identifier, the whole structure or array is deleted and the variables definitions are shifted together to close the gap. F6 With this key, you can change to the first softkey menu. CONTINUE F7 The variable definitions are converted to corresponding OK address directory entries and checked to make sure they are syntactically correct (parenthesis error, double declarations). The defined groups are also converted to an internal structure and checked (unique group names, existence of all the specified variables names). lf an error is detected, an error message is displayed, for example, as follows: error in group: xyz variable: OTTO not defined" parenthesis error" (the cursor is then positioned on the incorrect line. Volume 2 8 - 18B89 76049/01 TF Interface Configuration, Test Edit | ....VMD Variables (continued) Defining Groups You display the Definition of grouped variables" screen by pressing function key F2 in the VMD variables screen, screen M2-5.1. By defining a group, you can transfer variables collected in groups using the information report service. Input fields: Group name: 8 characters long ASCII string, must be unique per VMD. 0S Note that the variable names must be entered line by line and not one column after the other. The free 32 character long fields are for variable names. Only complete structures or arrays can be accessed using the structure names or array names. Function keys (additional keys or keys with a special significance): F3 A screen form with empty fields is displayed in which a INPUT new group can be defined. F4 The currently displayed group is deleted. DELETE F7 Any changes you have made are accepted and the screen OK form is exited. The data are only converted to the internal representation when you exit the VMD screen form, since you can still change the variables definitions. 8-19 Volume 2TF Interface Configuration, Test B8976049/01 8.2.3 Edit | Fileserver AA In this screen form you can define so-called "third-party associations". These are links that are established between the CP and a fileserver after a load operation is triggered by a host computer. Screen structure The screen is identical to screen M2-4-2 LINK, however, the input fields for SSNR, ANR, ANZW, EST TYPE, MUX ADDRESS and NO OF JOBS are omitted. Neither local nor remote definitions are possible (function keys F4 and F5). The establishment type for the server application association is always dynamic. The connection establishment request (in order to load a new domain), is always started by the CP 143. Volume 2 8 - 20B8976049/01 TF Interface Configuration, Test 8.2.4 Edit | VMD Configuration The VMD Configuration function is used to specify the master CPU for domain and PI services in the multiprocessor mode. The master CPU is the CPU via which the PG functions "PLC start" and "PLC stop are executed. The function allows up to four CPUs to be selected and assigned to the VMD. If more than one CPU is selected, the field COR is automatically activated. The currently selected CPU is displayed inversely on the screen. CPUs that have been clicked on (selected) are displayed with a heavier margin. You select a CPU using the function keys. Default: CPU 1 and CP are selected. (The CP cannot be deleted and is only included to illustrate the complete configuration.) Note: COR and CP are not input fields. If you press F7 = OK, at least one CPU must be selected. Meaning of the input fields: Master - CPU: An x must only be entered in one of these four fields. If you enter a second x, the first one is automatically deleted. CORAMIUR- This specifies the path via which the CP can reach the ADDRESS: CPU. ff you do not make an entry, this means that the CPU can be reached via the "swing cable without the MUX. The entry can be made for each selected CPU (even if only one is selected). Values between 1 and 38 are possibile. An entry is only obligatory if more than one CPU is selected. 8 - 21 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ...VWMD Configuration (continued) SSNR: Only if no COR/MUX address is entered, otherwise as for COR/MUX Default : 0, In the multiprocessor mode : CPU-NO - 1. The information about the configuration is only generated after it has been selected by the user. If the information does not exist, a CP uses the default setting. Function keys (additional keys or keys with a special significance): F1 Include or remove a CPU ING/DEL F3 Select the previous CPU pa F4 Select the next CPU corttoo > F6 Create presets PRESETS Volume 2 8-22B8976049/01 TF Interface Configuration, Test 8.3. Documenting the Configuration To document the configured communication parameters, there are functions available for outputting lists. The lists are structured based on the configuration steps. All the lists are displayed on the screen and can be printed out if required (how to control output is described on the following page). 8.3.1. Application association list Output of all application association objects 8.3.2 VMD list Output of all VMD objects 8.3.3 Server list Output of the server list 8.3.4 All With the menu item ALL, all the lists are generated one after the other. The screens correspond to screens M 2-7-5 to M 2-7-7. Both the application association objects and the VMD objects are output. Additional function keys for all documentation functions Output can be stopped or resumed with the function key STOP/CONTINUE: 8 - 23 Volume 2TF Interface Configuration, Test B8976049/01 Controlling output In the Init | Edit screen, you can control the printout and footer. In the PRINTER field, you can switch the printout on or off. In the FOOTER (ON/OFF) field, you can decide whether to include a footer at the bottom of each page. If you want the printout to have a footer, the footer file must be specified. The footer is created with the "Footer editor" utility. Volume 2 8 - 24B8976049/01 TF Interface Configuration, Test 8.4 Transferring Configured Data 8.4.1. Transfer | Transfer Database The transfer functions for the configured parameter records are used in exactly the same way for the blocks of the transport interface and the TF interface. The transfer functions are explained in Volume 1 of the COM 143 TF description. 8-25 Volume 2TF Interface Configuration, Test B8976049/01 8.5 Testing the TF interface The test functions allow the statuses of individual parts of the system to be recognized at the PG during communication and therefore allow errors to be localized. The diagram below is an overview of the screen hierarchy of the test functions. The screens can be displayed by pressing function keys in the basic screen Overview of all connections. Test | Application Associations 4-2 Status all: OVERVIEW OF ALL CONNECTIONS F7 M4-2.5 ISTATUS OF PROGRAM INVOC + DOMAINS 4-2.3 OB TEST PPLICATION SSOCIATIONS F5 M4-2.4 PDU OUTPUT Volume 2 8 - 26B89 76049/01 TF Interface Configuration, Test 8.5.1 Outputting Status All if you select the function Test | Application associations, the function "TF status all is executed between the PG and CP 143. The PG obtains the current status of all programmed application associations and displays this in the overview of all application associations" screen form. Output fields and their meaning: POS: Position indicator, links are numbered in ascending order (0-255). SSNR : interface number. ANR : Job number. PRIO: Priority of the link. LINK : Status of the layer 4 connection (see table Link status). LINK E: Link flags to indicate error in the layer 4 connection (see Figure Link flags). Job : TF job {see table TF jobs). ERROR Error in TF job CHA When the information is updated, the * indicates which link has changed. The following links always exist: ANR 203: Job number for the third-party-fileserver application association ANR 204 Job number for loading with the S5-DOS package PGLOAD ANR 205: This job number is used for local jobs. Note: with the test function, it is not possible to record the sequence of a load job. 8 - 27 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ...|Outputting Status All (continued) Overview of the link statuses (LINK) of the layer 4 connection 0 The link has a defined basic status. The link is defined but not established. 2 The preparations for connection establishment have been made, the link itself has not yet been established. 4 Status '2 has been completed successfully. The ACTIVE partner sent a connection request or the PASSIVE partner sent a connection await. 17 The layer 4 connection is completely established. The transport parameters may still have to be set. The transport is, however, executed automatically. 1 The layer 4 connection is completely established. From now on, certain TF services of the CP 143 can be executed via this connection. 8 The layer 4 connection has been terminated. Since, however, buffers are still occupied 36 The layer 4 connection establishment is completed, the layer 7 link establishment has been initiated. Either an application association initiation message is sent or the partner is waiting for such a message. 33 The layer 7 link is established. All TF services of the CP 143 can be executed via this link. 24 The layer 7 link conclusion is requested. 40 The layer 7 link has been concluded, aborted or has broken down. Table 8.2 Link Statuses Volume 2 8-28B8976049/01 TF Interface Configuration, Test Edit | ...|Outputting Status All (continued) Link flags provide information about dynamic events affecting the connection. Bt7 6 54321 0 fp | _ 0 Layer 4 connection is not established. 1 Layer 4 connection is established. 0 no connection request 1 Connection request received but connection cannot be established. 0 no connection request {' Connection request received but connection cannot be established. frei 0 All actions for creating variabie completed. 1 Disconnect request from local station 2 Not currently assigned. '3' Connection request from local station '4 Resources returned 5 Abort connection request from remote station 6 Disconnect request from remote station 7 Connection request from a remote station 0 Connection request up to layer 7 . . 1 Connection request up to layer 4 Fig. 8.3 Link Flags 8-29 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ...|OQutputting Status All (continued) . The TF jobs with the corresponding opcodes and texts are as follows: Opcode Job M-ST Status M-GN Get name list M-ID Identify V-RE Read variable V-WR Write variable V-GE Get variable attributes V-IN Information report P-ST Start Pl P-SP Stop Pl P-RE Resume Pl P-RS Reset Pl P-AB Kill Pi B-RQ Read byte string B-WQ Write byte string with ack. B-WO Write byte string without ack. T-DQ Transp. data exch. with ack. T-DO Transp. data exch. without ack. D-LI Initiate up/download D-LS Up/download segment D-LT Terminate up/download D-UI Request upload sequence D-US Upload segment D-UT Request upload sequence response D-LR Request download sequence D-UR Request upload sequence D-LO Load domain content D-ST Store domain content D-DE Delete domain content D-GE Get domain attributes P-CR Create P| P-DE Delete Pi P-GE Get PI attributes D-CA Get capability list M-SU Unsolicited status A-IN Initiate A-TE Conclude A-AB Abort A-CF Configure ANZW (local) B-WI Request byte string length P-HL Local program stop Table 83. Volume 2 8 - 30B8976049/01 Edit | ....|Outputting Status All (continued) TF Interface Configuration, Test The job statuses for the status display and the corresponding texts for the PG are as follows: Job status PG text oO = +2 OONMDOARWOHD -~ Disconnect Connect No job Job Request Confirmation Response Indication Send All Receive All Error output Receive Dir 8 - 31 Volume 2TF Interface Configuration, Test B8976049/01 Edit | ...|Outputting Status All (continued) Function keys (additional keys or keys with a special significance) F3 When the links are displayed, the first line is displayed LINE + 1 inversely (first link is selected). With F3, you can move on to the next line which is then displayed inversely. The cursor key arrow down" has the same function. The link selected in this way is then the selected link for single status. F4 Analogous to F3 LINE - 1 F5 If you press the "UPDATE ON/OFF" function key, the UPDATE status is constantly updated. Only status changes are indicated and marked in a special field. FG The selected link is valid for the next functions you select. SEL LINK The screen form is exited and the single status of the link is displayed (screen M4-2.1). F7 By pressing this key, you can obtain the Pl/domain status PI-DOM (screen M4-2.5). Volume 2 8 - 32B8976049/01 TF Interface Configuration, Test 8.5.2 Output Single Status When you select a link in the "OVERVIEW OF ALL APPLICATION ASSOCIATIONS" display, the "TF single status" function is executed between the PG and CP 143 and the "APPLICATION ASSOCIATION" display appears on the PG with the status and link information for the selected link. Updating the status Pressing the "UPDATE" function key activates or deactivates the update status function. When it is activated, the status is continuously updated. Only status changes are indicated. After activating the update function, the start TF single trace" function is run once between the PG and CP 143 and following this, the enable TF single trace function is called cyclically. The "stop test" function terminates the updating. Function keys (additional keys or keys with a special significance) FI Start trace functions TRACE F5 Activate/deactivate cyclic updating of the data UPDATE F6 Trigger job processing JOB TEST 8-33 Volume 2TE Interface Configuration, Test B8976049/01 8.5.3. Trace Functions Using the trace functions, status changes on a selected application association can be written to a trace buffer and displayed on the PG in chronological order. The function is activated with the TRACE function key in the APPLICATION ASSOCIATION screen (screen M4-2.1) . Selecting the application association The application association is selected with the "single status function (screen M4-2.1). Trace buffer overflow If the CP 143 is not able to enter all the status changes in the trace buffer (overflow), this is indicated in the "trace application associations" screen. Volume 2 8 - 34B8976049/01 TF Interface Configuration, Test 8.5.4 Job Test The job test function or single step mode is started by pressing the "JOB TEST" function key in the APPLICATION ASSOCIATION screen. The "job test" screen form appears on the PG as soon as data arrive from the CP. While the PG is waiting for a reply, the message "waiting for data from CP" is displayed. Meaning of the output fields: SSNR,ANR: Interface and job number. ENABLE The ENABLE field contains the default text AUTOMATIC. This status can be changed over with function key F1. LINK Status of the layer 4 connection (see table in Section STATUS: 6.5.1). TF JOB TF job (see table in Section 6.5.1). JOB (see table in Section 6.5.1.) STATUS: Function keys (additional keys or keys with a special significance): Fl This changes the type of enable as displayed in the AUT/MAN ENABLE F2 in the AUTOMATIC enable mode, an "enable TF job test START job is sent to the CP 143, the message "waiting for data from CP" is displayed and when the reply is received with the data, the display including the JOB STATUS is updated. Any additional information is displayed below JOB STATUS. This sequence is repeated until either F3 or F1 is pressed. F4, F5 and F6 are not permitted during this time. 8-35 Volume 2TE Interface Configuration, Test B8976049/01 If the MANUAL enable mode is selected, after pressing F2 the message "waiting for enable" appears. The enable TF job test" is only sent to the CP 143 after you press this key. On reception of the reply, the display is updated and the PG then waits for the next enable. While the PG is waiting for the next enable, you can also use the functions of F4, F5 and F6. F3 You can stop the job test with F3, particularly in the STOP AUTOMATIC enable mode to request more information with F4, F5 or F6. The job test is continued with F2. FS The output TF-PDU" job is sent to the CP 143. The TF-PDU content of the current TF-PDU is displayed in a special screen form (screen M4-4.5). If no PDU exists, the message "no TF-PDU exists" is displayed. Volume 2 8 - 36B8976049/01 PGLOAD 9 PGLOAD The PGLOAD tool provides useful and user-friendly functions with which you can address programmable logic controllers (PLCs) via the TF interface conforming with the MMS standard. PGLOAD is also required to structure a PLC with domain and program invocation objects in keeping with the TF services. This chapter tells you how to use the PGLOAD tool for the following purposes > To supply PLCS with programs either directly using the TF domain services or dynamically via fileservers and so keep up to data with the current tasks in the process. > To monitor and control PLC using the TF program invocation services. The tool is integrated in COM 143 TF. You can activate it with the menu item "Utilities". 9-1 Volume 2PGLOAD B8976049/01 9.1 Overview 9.1.1 Adapting Programmable Logic Controllers to the Process with PGLOAD Domain and PI services The SINEC technological functions include not only variable services but also domain and program invocation services, as follows: > A domain corresponds to a loadabie data area in a PLC. > Single domains are collected together to form a program invocation (PI), that represents an executable program for an automation task. > Program invocations can be monitored and controlled with the Pl services. Example lf the algorithmic sequence of an automation task is always the same and only the parameters and data/variables change from time to time (red, green, blue cars), then the program can be structured as follows: > the algorithmic sequence in a "program" domain > the changing parameters in their own parameter domain. Depending on the requirements, the program domain can be combined with one or more parameter domain(s) to form an executable PLC program. Volume 2 9-2B8976049/01 PGLOAD Using domain and PI services without programming With the PGLOAD tool, you use off-the-shelf load and control programs and with them ihe facilities of the domain and PI services without needing to program. With the PGLOAD user interface, you simply specify the connections for data exchange and select objects for the transfer (domains) to the controller (Pls). The PGLOAD host computer functions allow you to intervene in the running of the PLC again using the PGLOAD user interface and so you implicitly use the TF services. Structuring the PLC with PGLOAD for TF services PGLOAD is responsible for forming domains from blocks and generating loadable domain files. PGLOAD is therefore needed for PLC structuring in terms of the TF services. 9-3 Volume 2~ PGLOAD - B8976049/01 9.1.2 Range of Functions TF services under PGLOAD The PGLOAD program supports the following domain and program invocation services: > Domain services: - uploading a domain from the PG into a fileserver (triggered by the PG) - downloading a domain from the fileserver to the PG (triggered by the PG) triggering the load sequence in the PLC from a fileserver or PG (trig- gered by the PG) - triggering the uploading from the PLC into a fileserver or PG (trigge- red by the PG) ~ deleting domains in the PLC. > Program invocation services: - start program invocation ~ stop program invocation - create program invocation - delete program invocation TF services and the SIMATIC S5 view PGLOAD is designed for the domain and PI model on which a SIMATIC S5 programmable logic controller is modelled. The following rules apply to domains: > APLC contains up to 8 domains. > A domain consists of any combination of blocks. It is useful to separate blocks containing program (logic) and those containing parameters (data). The following applies to Pls: A PLC consists of two Pls: a system Pl and an application-specific Pl. The application-specific PI includes all the domains loaded on the PLC. Volume 2 9-4B8976049/01 . PGLOAD 9.2. Description of the Tool The structure of PGLOAD is reflected in the menu: [=] Init | Edit | Transfer | Test PG-Load Clock functions Transfer Functions Host Functions Fileserver AA PLC AA Setup initialization With the initialization function, you select the files for configuring application associations. PLC AA With PLC AA, you specify an application association between the PG and the selected PLC (PI services). Fileserver AA You specify a third-party association. This determines which PLC is supplied with data from which fileserver. The PG with PGLOAD assumes the initiative in this three-way association. 9-5 Volume 2PGLOAD B8976049/01 Transfer Functions Transfer functions are used to transfer load files to a PLC or to convert and retransfer load files to the PG. Load files contain the program and data blocks put together to form domains. Host Functions With the host computer functions, you have direct control over a PLC addressed via an application association. You can therefore use the TF program invocation services without needing to write programs. Volume 2 9-6B8976049/01 PGLOAD 9.3. Functional Description 9.3.1 System Configuration and Device Functions This section describes the use and functions of PGLOAD. To simplify the explanation, the following network of devices is assumed. PLC | wee PLC | N [ F interface ' TF interface i SINEC HI [i nietace Y (irene) fTreoe PC Fle] FILE- with PGLOAD SERVER SERVER 4) Fig. 9.1 Example of a Network when using PGLOAD Programmer PG The PG is integrated in the automation system via SINEC H1. With PGLOAD it is responsible for controlling the PLC program and data supply and for monitoring the PLC programs (host function). Programmable logic controllers PLC 1 to n Programmable logic controllers are responsible for controlling the process. PLCs are supplied with programs and data (domains) either on their own initiative or instigated externally (PGLOAD). 9-7 Volume 2PGLOAD B8976049/01 Fileserver 1..m Fileservers are devices with capacity for storing the programs and data required on the PLCs. in special cases, a PG can also be used as a fileserver. PGLOAD supports the situation in which the PG is used both for the PGLOAD functions and for data storage as a fileserver. 9.3.2 Configuring Links and Selection Functions Aims and Procedure The logical partners, i.e. the PLCs and fileservers can be defined using a link editor. The link definitions are written as link blocks in a file for the PLC links and fileserver application associations. Existing application associations can be selected in the current data link file and can be stipulated as defaults for transfer and host functions. PLC links PLC links are links between the PG and a PLC. These links are used to transfer jobs for fileserver access and PI service jobs. Configuring a PLC link simply involves specifying the Ethernet address of the partner a link name used locally on the PG. The local and remote TSAPs are formed implicitly. The link blocks for PLC links are stored in a file with the name: <XXXXxxxCP.LOD> (xxxxxx is any 6-character long ASCH character string). Server application associations Server application associations are links between a PLC and a fileserver. The data transfer from and to a fileserver is triggered by a third party, in this case the PG. This is known as a third-party association . Configuring therefore requires the specification of the Ethernet address and the service access point on the PLC (known here as the local address) and the appropriate specification for the fileserver (known here as the remote address). The link blocks for fileserver application associations are stored in a file with the name :<xxxxxxPG.LOD> = (xxxxxx is any 6-character long ASCII character string). Volume 2 9-8B8976049/01 9.3.3 Transfer Functions Support of data storage PGLOAD The transfer functions support the conversion and transfer of S5 program files to the fileserver. They also support retransfer and reconversion when the programs require modification with the programming tools (LAD, CSF PLC N I TF Interface 3 and STL). PLC , woe ee eee I TF interface B SINEC H1 PG with PGLOAD TF Interface Key: < = Transfer function Fig. 9.2 Direction of the Transfer Functions in a Network Volume 2PGLOAD B8976049/01 The following functions are available Transferring domains Domains on the PG are iransferred to a fileserver from the PG to a for data storage. fileserver. An $5 program file is converted and transferred to the server along with local variable definitions (if they exist) as a loadable "domain file" using the upload function. Transferring domains Domains on the fileserver are transferred to the from the fileserver PG with the load domain TF service. to the PG The received data are converted to a program file and, if applicable, a variables file that can be processed with "S5 resources" (LAD, CSF, STL). The name of the variables file is <xxxxxxST.VAR>. This is generated automatically by the tool from the name of the program file.. File conversion The conversion functions can also be started separately. This means it is possible to store data on the PG (PG is fileserver) when transfer to a different fileserver is not required. Restrictions Dynamic loading and supply of programs and data (domains) for the PLCs is only possible with the fileserver functions. This also applies when the PG itself is used as the fileserver. This is then triggered by the host functions in PGLOAD (load PLC and save PLC). Volume 2 9-10B8976049/01 PGLOAD 9.3.4 Host Computer Functions Aims Whereas the functions introduced so far are used to prepare the system and the PG, the host functions support the system during operation. The following functions are available: Load PLC: Save PLC: Delete PLC: Start/stop PLC: One or a maximum of two domains in a screen can be transferred from the fileserver to a CPU of the PLC (the fileserver can also be the local PG). Situation a: third-party configuration If the link name of the server is not "PG", a PLC (destination station) is instructed to load the do- mains from the fileserver. Situation b: PG = fileserver If, however, the link name of the server is "PG", the domains are transferred directly from the PG to the PLC = destination station A PLC domain can be saved on the fileserver. This means that the PG instructs the PLC to send the data to the server. The link name is handled in the same way as in the load PLC function. The distinction between a third-party configuration and PG=fileserver is analogous to the load PLC function. Domains in the PLC are deleted provided they are marked as deletable and their current status al- lows them to be deleted. The PLC is started or stopped (depending on its mode). implicitly: this means creating/deleting a program invocation. 9-11 Volume 2PGLOAD B8976049/01 Start program: The domains collected under the program invocati- on are started. Stop program: If a program invocation with the specified name has been started, it will be stopped. The following diagram illustrates the host functions: PLC N TF Interface 3 TF Interface B SINEC H1 Trees | PG with PGLOAD TF Interface TF interface FILE- SERVER, Key: << = Host functions -+ =Load/save PLC Fig. 9.3 Direction of the Host Functions in a Network Note: The PG load program only operates via the integrated Ethernet interface, i.e. CP 141, CP 1413. Volume 2 9-12B8976049/01 PGLOAD 9.4 PGLOAD - Application 9.4.1 PGLOAD | Initialization The data link files specify the destination devices that can be accessed via PGLOAD. The first task to perform with PGLOAD is therefore to specify these data link files. After selecting PGLOAD | Initialization, PGLOAD displays the following screen: PGLOAD CP 143 (EXIT) Initialization PGLOAD for H1 interface SINEC NCM DATA LINK FILE (FILESERVER) :DR: 6B] Name: [J PG.LOD DATA LINK FILE (PLC) DR: B] Name: [__J cp.op FL JFL df Je[ _lFi ]F | JF Fd 1 2 3 4 5 6 7 g SELECT Fig. 9.4 Start screen Input fields DATA LINK FILE Depending on the functions you require, you can {FILESERVER): specify a data link file for server application associations with the format: 9-13 Volume 2PGLOAD B8976049/01 DR:=A,...,N NAME : <XXXXXXPG.LOD> where <XXXXXX>: = can be freely selected. The suffix PG.LOD is fixed and cannot be changed. DATA LINK FILE (PLC)Here, you specify the data link file for PLC links . Format : DR:=A,...,N NAME : <XXXXXX> CP.LOD where <XXXXXX>: = can be freely selected. The suffix CP.LOD is also fixed and cannot be changed. Volume 2 9-14B8976049/01 PGLOAD 9.4.2 Link Configuration / Server Selection By selecting PGLOAD | Server Links, you can configure fileserver application associations. Server application associations are links between a PLC and a fileserver. PGLOAD . CP 143 (EXIT) Link Configuration / Server Selection SINEC NCM LINK NAME : fe ] LOCAL TSAP : LENGTH ] HEX [SS aso Co] REMOTE TSAP : LENGTH [J HEX ([ asc [4 REMOTE ETHERNET ADDRESS : F| iF | JF[ al lF[ | F | | F F CHEre 1 +1 2 1 3 INPUT 4 5 DELLINK 6 DELFILE 7 OK 8 SELECT Fig. 9.5 Link screen: fileserver Input fields: LINK NAME: Name of the fileserver application association (must be unique for the file) Range of values : 32 characters LOCAL TSAP Service access point of the PLC on which domains will be loaded or from which they will be saved. REMOTE TSAP Service access point of the fileserver. 9-15 Volume 2PGLOAD B8976049/01 Representation and input of the TSAP: LENGTH: HEX: ASC: REMOTE ETHERNET ADRESS: This field has the default "8" entered. If you require links to non-SIMATIC $5 stations it may be necessary to specify shorter lengths. Range of values: 1 character The individual bytes of the TSAP ID must be entered in hexadecimal format in groups of two. These groups should be separated by blanks. With this format, the TSAP ID can also be numerical. If you only enter zeros, the TSAP counts as unspecified. Range of values: 8 bytes The TSAP ID entered in the hex field is displayed here as an ASCII string. Blanks and non-interpretable characters are displayed as underscores. A TSAP ID entered here in ASCII characters is displayed in the HEX field in hexadecimal notation. Range of values: 8 characters Example: Length: 5 HEX: 31 32 33 34 35 ASCII: 12345 Note: The distinction between hex and ASCII has two advantages: - TSAPs can be entered conveniently as an ASCII string - The TSAP ID is not restricted to only ASCII characters . The default Ethernet address 080006010000 is displayed, this can, however, be modified. Range of values: 12 characters Volume 2B8976049/01 Function keys: Fi, F2 +1, -1 F3 INPUT Fa DEL LINK FS DEL FILE F7 OK PGLOAD With these function keys, you can load and edit the next or previous link block in the file. You can set up a new link block. An empty LINK CONFIGURATION / SERVER SELECTION screen is displayed. The only available function key is then F7 OK and F8 SELECT/HELP. With F7 OK, the new link block is entered but not yet saved. The data are saved by pressing F7 again as described below. The currently displayed link block can be deleted. You can delete the whole data link file. You will first be prompted to confirm your intention: delete yes/no? The currently displayed link is selected and is used as the default for subsequent functions. You exit the screen form, all changes are saved. Possible errors and messages include the following: File too long: i.e. already contains 30 link blocks. No link defined:: this appears when you start with an empty file after deleting the last block. Link name the link name already exists not unique: 9-17 Volume 2PGLOAD _ B8976049/01 9.4.3. Link Configuration / PLC links By selecting PGLOAD | PLC links, you can configure PLC links. PLC links are links between the PG and a PLC. These links are used to transfer jobs for fileserver access and PI service jobs. PGLOAD CP 143 (EXIT) Link Configuration / PLC Selection SINEC NCM LINK NAME : Ee J REMOTE ETHERNET ADDRESS : 080006010000 F | Jel JFL JF[ }F| JFL | F F HELP _] 1 +1 2 4 3 INPUT 4 5 DELLINK 6 DELFILE 7 OK 8 SELECT Fig. 9.6 Link Configuration PLC Selection Input fields: Link name: Name of the link to the PLC (must be unique for the file). Range of values. 32 characters Ethernet address: The default Ethernet address 080006010000 is displayed, this can, however, be modified. Range of values: 12 characters Volume 2 9-18B8976049/01 PGLOAD Function keys: Fi, F2 With these function keys, you can load and edit the next or +1, -1 previous link block in the file. F3 You can set up a new link block. An empty LINK INPUT CONFIGURATION / PLC SELECTION screen is displayed. The only available function key is then F7 OK and F8 SELECT/HELP. With F7 OK, the new link block is entered but not yet saved. The data are saved by pressing F7 again as described below. F4 The currently displayed link block can be deleted. DEL LINK F5 You can delete the whole data link file. You will first be DEL FILE prompted to confirm your intention: delete yes/no? F7 The currently displayed link is selected and is used as the OK. default for subsequent functions. You exit the screen form, all changes are entered. Possible errors and messages include the following:: File too long: i.e. already contains 30 link blocks. No link defined: this appears when you start with an empty file after deleting the last block. Link name the link name already exists not unique: 9-19 Volume 2PGLOAD . B8976049/01 9.4.4 Using Transfer Functions The transfer functions support the conversion and transfer of S5 program files to the fileserver. They also support retransfer and reconversion when the programs require modification with the programming tools (LAD, CSF and STL). SEND: Transfer domains from the PG to a fileserver. Specifying the name of the S5 program file on the PG determines the domain to be sent. The destination is the file name specified using the conventions of the fileserver. The link to the destination is established by selecting the destination station in the data link file for the fileserver. Domain-specific variables that can be defined with the PG load system are part of the load file. You can define variables using this screen by calling the variables editor for domain-specific variables. The variables are stored in a file whose name is derived from the name of the S5 program file: <XXXXXXST.VAR> FETCH: Transfer domains from fileserver to PG Specifying the server file determines the domain to be transferred with fetch function. the destination is the local S5 program file. Domain-specific variables, which can also be defined with the PGLOAD program, are automatically transferred along with the domain and reconverted into the file <xxxxxxST.VAR>. Volume 2 9 - 20B8976049/01 PGLOAD The input screen for the transfer functions: PGLOAD CP 143 (EXIT) Transter Functions SINEC NCM DEST STATION (FILESERVER) : [ ] SERVER FILE : LOCAL S5 PROGRAM FILE DR: = [[7] NAME: [[___~] ST.SsD COMMENT : cS ] CS ] F| ]F { JF[ Jel 1FL | F[ }F[_] F[_HeLP 1 2 VARIABLES, SEND 4 CREATE 5 FETCH gCRSSFILE 7 SERVER g SELECT Fig. 9.7 Transfer Functions for Load Files Screen Input fields:: DEST. STATION In this case, the logical partner name of the last {(FILESERVER): selected fileserver application association is displayed. With F7, (server) you can page through the data link file and select a new partner = destination station. SERVER FILE : File under which the load file will be stored (in the syntax of the destination system) on the server (destination) station. Range of values: max. 64 characters LOCAL SS PROGRAM Name of the program file from which the load file will FILE: be generated. 9-21 Volume 2PGLOAD B8976049/01 Comment : Freely selectable character string, e.g. for documentation or for administration functions. Range of values: max. 128 characters Function keys: FI Analogous to the COM function (VMD variables editor), you VARIABLES can define domain-specific variables, to be stored in the variables file. The screen PGLOAD DOMAIN SPECIFIC VARIABLES is displayed. In terms of use and possible inputs, the screen corresponds to the COM screen M2-5.1 (see accompanying supplement with COM 143 TF screens) and Chapter 8 Configuring VMD-specific variables. F3 Transfer load file to the specified server. SEND F4 The load file is created from the specified local S5 file" and CREATE from the variables file (if it exists). F5 The specified load file is fetched from the fileserver or from FETCH the PLC and stored on the PG under the name specified for the local S5 file. F6 An S5 program file is created from a load file and any CR SSFILE existing variables are converted to a variables file. F7 With this function, the servers entered in the data link file SERVER (fileserver) are displayed. The selected server is displayed in the DESTINATION STATION output field. Volume 2 9-22B8976049/01 PGLOAD 9.4.5 Using Host Computer Functions Whereas the functions introduced so far (link configuration and transfer functions) are used to prepare the system and the PG, the host functions support the automation system during operation. From the initial screen form you call the host computer functions by PGLOAD CP 143 (EXIT) Host Computer Functions SINEC NCM STATION (PLC): [ J Fi: TRANSFER DOMAIN FROM FILESERVER TO PLC F2 : SAVE PLC DOMAIN ON FILESERVER F3.: DELETE DOMAIN IN PLC F4: START/STOP PLC (CREATE/DELETE PROGRAM INVOCATION) FS: START APPLICATION F6 : STOP APPLICATION F7 : SELECT DEST STATION (PLC) NAME OF APPLICATION (PROGRAM INVOCATION NAME): FL JF | aa JFL dF Jel [F 1 Coe] 1 2 3 4 5 6 7 8 SELECT Fig. 9.8 Input Screen - Host Functions selecting PGLOAD | Host computer and the screen below is displayed Input fields STATION (PLC): The destination station (PLC) to which the following services refer. You can select a station with F7. Range of values: max. 32 characters 9-23 Volume 2PGLOAD Pi name: Function keys: B8976049/01 Name to which services selected with the keys F4 to F7 refer: - create program invocation, - delete program invocation, - Start program Range of values: max. 32 characters Along with user PI on the PLC, which may or may not exist, there is also a system PI. This system PI can be controlled with the Pl name PLC_START_STOP. FA Load a PLC (-> next screen PGLOAD Load PLC) LOAD F2 Save the domains of a PLC (-> next screen PGLOAD Save SAVE PLC) F3 Delete all the domains in the PLC (confirmation prompted) DELETE F4 Create/delete a program invocation. If you select the system PLC START/ | PI this means start/stop the PLC. RESET FS The program invocation with the specified name is started PRG START] on the PLC from the existing domains. F6 Providing a program invocation with the specified name PRG STOP exists in the PLC, it is stopped {if possible). Note: Only one (application-specific) program invocation can exist at any one time on the PLC. F7 With this function key you can page through the PLC data STATION link file to find a required destination station. Volume 2 9 - 24B8976049/01 PGLOAD Errors and messages: > "Program invocation does not exist": the PI specified in the PLC does not exist. > "A program invocation exists already: when starting a program, there is already a Pl in the PLC. > "No program invocation exists": when stopping a program, there is no PI. > "No domain(s) loaded": when starting a program there are no domains loaded in the PLC. > "Function impossible: domain status = ?": when starting a program or deleting the PLC, the domains are not in the correct status. 9-25 Volume 2PGLOAD 9.4.5.1 Load PLC B8976049/01 One or a maximum of two domains in a screen can be transferred from the fileserver to a CPU of the PLC (the fileserver can also be the local PG). PGLOAD Load PLC PLC LINK SERVER AA PROGRAM (DOMAIN) STORED INFILE : [Ee PARAMETERS (DOMAIN) STORED IN FILE : fe CPU NO F | JF LF 1 2 3 JF JF | | F FL) F Gere 4 5 6 7 OK g SELECT Fig. 9.9 Load PLC Screen Output fields: PLC LINK: Name of the link to the PLC to be loaded with domains. The displayed PLC was selected in the basic screen form for host computer functions). Range of values: (32 characters) Input fields: SERVER AA: Application association name of the server from which the domains will be loaded, (must be configured on the CP). Range of values: 32 characters Volume 2 9-26B8976049/01 Note: PGLOAD Situation a: third-party configuration lf the link name of the server is not "PG", a PLC (destination station) is instructed to load the domains from the fileserver. Situation b: PG = fileserver If, however, the link name of the server is "PG", the domains are transferred directly from the PG to the PLC = destination station. (The name of the file is then <xxxxxx>ST.S5D). PROGRAM (DOMAIN): STORED IN FILE: PARAMETER (DOMAIN): STORED IN FILE: CPU NO: Name of the program domain to be loaded. Range of values: 32 characters: Name of the server file in the syntax of the server system. Range of values: 64 characters: Name of the data domain to be loaded. Range of values: 32 characters: Name of the server file in the syntax of the server system. Range of values: 64 characters: With the CPU number, you specify the CPU in the programmable controller in which the domains will be loaded. In single processor operation: the value is always 1 In the multiprocessor mode this is the slot number of the CPU (1 to 4). 1S The load file must be generated explicitly. If a loadable file (xxxxST.DOM) was created from an S5 file (xxxxST.S5D) then this loadable file is loaded on the PLC. If you make changes in the S5 file, and if no loadable file is regenerated, these changes are ignored when the PLC is loaded. 9-27 Volume 2PGLOAD Is Softtkey: F7 OK B8976049/01 The standard function blocks integrated in the operating sy- stem (e.g. send and receive blocks in the S5-115U) must not be included in the load file. The specified domains are loaded from the server into the destination station via the specified PLC configuration. The PLC configuration is entered in the capabilities list of the load domain content" job and is interpreted there by the CP. During a job, a message is displayed to indicate which job is currently being processed. Volume 2B8976049/01 9.4.5.2 Save PLC A PLC domain can be saved on the fileserver instructs the PLC to send the data to the server in the same way as in the load PLC function. PGLOAD . This means that the PG . The link name is handled PGLOAD CP 143 (EXIT) Save PLC SINEC NCM PLC LINK | SERVER AA t 7 FOLLOWING DOMAINS EXIST IN THE DEST STATION : DOMAINNAME _[ ] SAVE IN FILE: E J F | lF [ Je[ Jel JF[ Jel | F F HELP ht 2 7 3 4 5 6 7 OK g SELECT Fig. 9.10 Save PLC Screen Output fields: computer functions). PLC LINK: Name of the link to the PLC from which the domains will be saved. The displayed PLC was selected in the basic screen form for host Range of values: (32 characters) DOMAIN NAME: Name of a domain existing on the destination station. The domain displayed here can be saved. You select a on the destination statio Fe. n with function keys F1 or Volume 2PGLOAD Input fields: SERVER AA : B8976049/01 Name of the application association to the server on which the domain will be saved. (The link must be configured on the CP) Range of values: 32 characters Situation a: third-party configuration If the application association name of the server is not "PG", a PLC (destination station) is instructed to load the domains from the fileserver. Situation b: PG = fileserver If, however, the link name of the server is "PG", the domains are transferred directly from the PG to the PLC = destination station. (The name of the file is then <xxxxxx>ST.S5D). Note: The PLC configuration (CPU number) is omitted, since the CP records the configuration when the PLC is loaded. The PLCs domain must then be saved using the same capability. SAVE IN FILE : Name of the file in the syntax of the server system. If the file is to be stored on the PG, the name is <xxxxxxST.S5D> and an S5-DOS file is automatically generated. Range of values: (64 characters) IS If a domain was loaded on the CPU via the CP 143 using Load PLC, and then further blocks added there using LAD/CSF/STL, these additional blocks are not saved with the Save PLC function. Volume 2B8976049/01 . PGLOAD Function keys: Fi Selects the next domain found in the destination station. +1 Fi Selects the previous domain found in the destination station. t: F7 The specified domains are transferred from the source OK station (PLC) to the server. 9 - 31 Volume 2NotesB89 76049/01 Request Editor Tool 10 Request Editor User-Friendly User Interface for Generating Job Buffers The Request Editor tool supports you when creating job buffers required for programming TF communications services on your SIMATIC programmable logic controller. This chapter explains the range of functions of the tool and how to use it. It is intended for first-time users and as a source of reference when configuring the various TF services. The chapter contains the following information: > The structure of job buffers > The structure of the tool > The steps necessary for creating and documenting job buffers > How to make modifications > The layout of the screens for the job buffers of the individual TF services. 10-1 Volume 2Request Editor Tool B8976049/01 10.1 Overview 10.1.1 Mode of Operation and Requirements Creating job buffers With the graphics-oriented user interface of the Request Editor, (similar to a control system flowchart), you enter the communications parameters in the job buffers for the individual services. The tool enters these job buffers in the selectable data blocks. Using the transfer functions, you can then load these data blocks on the PLC. The transfer functions are part of S5DOS-KOMI. Integration in SINEC NCM The tool runs as a component of the COM 143 TF configuration environment under SINEC NCM. With its user interface resembling a control system flowchart, the parameters of the individual services are entered and the corresponding job buffers stored in a data block of an S5 program file. NCM conventions When using this tool, the general rules for handling the NCM user interface apply. The most important of these rules are as follows: > The screen is divided into a screen header, dialog area, message line and function key menu. > The functions of the tool can be called using the COM 143 TF menu bar. > Help texts can be called using the help key or function key ->F8. > Input options can be displayed using the selection key F8. A first impression | To gain a first impression, call the tool on your PG and select the available functions one after the other. Volume 2 10-2B8976049/01 Request Editor Tool 10.1.2 Meaning of the Job Buffer Requesting communications services Job buffers are used in the PLC to describe a communications service requested by a PLC program. In its communications job, the PLC program refers to the data block containing the job buffers. To specify the job, the program also refers to the data word within the data block at which the required job buffer is located. Referencing the job buffers when programming the PLC When configuring the job buffers, the Request Editor specifies the parameters required in the PLC program to formulate the communications job. This information can be documented and is therefore available for programming the PLC. Explanation of the structure of the data block with job buffers To help you understand the inputs you can make using the tool, the basic structure of a data block and the job buffers it contains is explained below. The following aspects are important: 1. The length of each job buffer is store in words before the job buffer. 2. Each job buffer begins with a fixed structure - Opcode (2 words, 4 characters) - Timeout (1 word, 16 bit fixed point), possibly reserved - Reserve (1 word) 3. The structure following this is adapted dynamically to the type. The length of the structure depends both on the type and the parameters. 4. No job buffer can exceed the maximum length of 256 bytes. 10-3 Volume 2Request Editor Tool B8976049/01 Overview of the structure 1st job buffer: KF: Length DW 0 KS: DW 1 KS: Opcode DW2 KF: Timeout DW 3 reserved DW 4 Spec. part of T the job buffer ~~ 2nd job buffer: KF: Length KS: KS: Opcode KF: Timeout reserved Spec. part of TT the job buffer ~~] Job buffer T continued TT last KF: Length job buffer - 7] max. DW 2042 Fig. 10.1 Structure of a Data Block with Job Buffers Number of buffers A data block can contain several job buffers. The number of job buffers in the DB is limited by its length (2042 words). The typical length of a job buffer is 10 to 20 words. Volume 2 10-4B8976049/01 Request Editor Tool 10.2 Description of the Request Editor The procedures supported by the Request Editor tool can be seen in the menu structure. Init Edit Transfer || Test Utilities | | }[Fest_| ik Create Job Buffer Job Buffer Overview ' TAT Delete Job DB Overview Job Buffer With the menu items, you can obtain the following functions:: Init You select an S5 program file and a data block to which the job buffers you then edit are assigned. Create Job Buffer You create the job buffers using the type selection screen. job Buffer Overview This function provides you with a general overview of the job buffers configured in the program file. Delete Job DB The configured data block can be deleted. Documentation The configuration data are displayed on the screen or printed. 10-5 Volume 2Request Editor Tool B8976049/01 Using the Request Editor To create job buffers with the Request Editor tool, follow the sequence outlined below: | Steps and corresponding tool functions | Start tool | Utilities | Request Editor-> sporty Ss progam | file and data block Section 10.3 Specify job buffer Create Job Buffer for TFservices Sections 10.4 .. 10.6 ed a Delete Job DB Document job buffer Section 10.7 ee Job Buffer Transfer data blocks to the PLC SS5DOS-KOMI function Fig. 10.2: Configuring TF job buffers Volume 2 10-6B8976049/01 Request Editor Tool 10.3 Request Editor | Init The first step is to select an S5 program file and a data block using this function. All the job buffers you then define are assigned to this data block. The initialization screen has the following layout: CP TYPE:(___]} Request Editor Initialization PROGRAM FILE [__] st.ssp Bock aa F| le | tal lF[ jF| a ) FI |F 1 2 3 4 5 6 7 oK 8 SELECTIOH Fig. 10.3: Request Editor initialization screen Input fields: PROGRAM Specifies the S5 program file to which the job buffer will be FILE: assigned. If the file does not exist it is created. If the specified file is read-only, an appropriate message is displayed in the message line. In this case, no new job buffers can be edited, but only existing buffers output. 10-7 Volume 2Request Editor Tool B8976049/01 BLOCK: 1st input field: Specifies the type of block containing the job buffer or that will contain the job buffer. Possible values: DB, DX (In the following descriptions, both block types are simply described as data blocks. Default: DB 2nd input field: Number of the data block containing the job buffer or that will contain the job buffer. If the data block does not yet exist in the program file, it is created. In this case the following message is displayed in the message line: BLOCK DOES NOT EXIST Neither a data block preheader nor comment block is created or managed. Function keys (extra or with special meaning): F7 Enters the data you have input. OK Volume 2 10-8B8976049/01 Request Editor Tool 10.4 Specifying the Job Buffers for TF Services 10.4.1 Create Job buffer Depending on the status of the program file you selected in the initialization screen, you obtain either an empty screen or the input screen of an existing job buffer. The input screen appears as follows: . CPTYPE: [__] R t Edit eaves r Source: st.ss0 C__] 1st job buffer in selected DB is displayed if it exists Layout depends on the type of job buffer F | Je LC |F| je ]F| J F[ ]F FL 1 af 2 64 3 NEW 4 EDIT gDELETE 6 COMP 7 OK g SELECT Fig. 10.4 Input Screen If there is no job buffer in the selected DB, the following message is displayed in the message line: NO JOB BUFFER EXISTS. In this case, select the function key F3 (NEW) to input a job buffer lf the data block exists, but does not contain a job buffer, the following message is output: DATA BLOCK INCORRECT, DELETE? 10-9 Volume 2Request Editor Tool B8976049/01 Function keys (extra or with special meaning): FA Finds the next job buffer in the data block and displays it. +1 Fe Finds and displays the previous job buffer. 1 F3 Input of a new job buffer at the end of the current data NEW block. Next screen form: type selection (see next section). lf the selected data block cannot accept any more job buffers, but sufficient space would result from compressing the block (see below), the following message appears: BLOCK TOO LONG, FIRST COMPRESS if compressing the block would still not provide sufficient space for a further job buffer, the following message is displayed: BLOCK TOO LONG, COMPRESSING NO HELP F4 Allows you to modify an existing job buffer. The original job EDIT buffer is deleted automatically and a new buffer appended to the end of the block. cS This changes the call parameters of the "SEND DIR" for trig- gering the service. F5 Deletes the current job buffer from the data block. To DELETE prevent the remaining job buffers in the data block from being shifted together, the job buffer is not deleted but declared invalid, it can nevertheless no longer be restored. To prevent you accidentally deleting a job buffer, you must confirm the prompt: delete (YES/NO). You remain in the input screen form. Volume 2 10-10B8976049/01 F6 COMP. F7 Request Editor Tool Compresses the selected data block. This means that all invalid job buffers are removed and the valid job buffers are shifted together. The following message then appears in the message line: CAUTION: X-REF (start address of job buffer) WILL CHANGE, PLEASE CONFIRM (xxx BYTES FREE) Xxx indicates the number of free bytes in the data block. To prevent accidental compressing of the data block, you must confirm your intention. On completion of the function, the following text appears in the message line: COMPRESSING ENDED, xxx BYTES FREE If the data block does not contain any invalid job buffers, the following text appears in the message line: NO INVALID JOB BUFFER EXISTS, xxx BYTES FREE If there are one or more invalid job buffers in the data block, but compressing does not mean that further job buffers can be accepted, the following text appears in the message line: COMPRESSING NO HELP, GO AHEAD OR NOT? Following this, you can decide whether you want to compress the data block or abort the function. Completes the entry of new job buffers and writes the data block back to the program file. 10-11 Volume 2Request Editor Tool B8976049/01 10.4.2 Type Selection Screen Form for TF and Other Services The type selection screen provides you with an overview of the job types available for communication. This screen is displayed by selecting Request Editor | Create job buffer and pressing the NEW function key. CP TYPE: [] Request Editor Service Selection Source: [___] ST.S5D [[_] EO STATUS AG UNSOL. STATUS INFORMATION REPORT IDENTIFY VMD LOAD DOMAIN CONTENT READ BYTE STRING STORE DOMAIN CONTENT WRITE BYTE STRING DELETE DOMAIN CONTENT REQUEST 8YTE STRING LENGTH GET DOMAIN ATTRIBUTES TRANSPARENT DATA EXCHANGE CREATE Pl START Pl CONFIGURE ANZW (local) RESUME PI Bre by FREE FORMAT WRITE KILL PI FREE FORMAT READ DELETE PI LOCAL PROGRAM STOP GET PI ATTRIBUTES FL lef lF{ JF[ JF | F | ]F FL Fl 1 2 3 4 5 6 7 OK 8 Fig. 10.5: Type Selection Screen Select the TF service you require or the type of function by positioning the cursor on the appropriate field and pressing return or by clicking on the field with the mouse. The selected field is displayed on a gray background. Press the OK key to confirm your selection and you then move on to the specific screen for entering a job buffer. Function keys (extra or with special meaning): F7 generates a job buffer for the currently selected function OK Next screen: depends on the function selected Volume 2 10-12B8976049/01 Request Editor Tool The following TF services and job types are available Variable services READ VARIABLE WRITE VARIABLE INFORMATION REPORT Read the current value of a variable from another station. Transfer the current value of a variable to another station. Spontaneous transmission of the current value of a variable to another station without being triggered by the other station and without being acknowledged by the other station. At the end of the list in the screen: FREE FORMAT WRITE FREE FORMAT READ Domain services LOAD DOMAIN CONTENT STORE DOMAIN CONTENT DELETE DOMAIN CONTENT GET DOMAIN- ATTRIBUTES Transfer the current value of a variable to another station identified by the free format address. Read the current value of a variable identified by the free format address. Load a program or parameters of a program in the local CPU or in a remote CPU from the fileserver. Save a program or parameters of a program of the local CPU or a remote CPU on a fileserver (also known as upload domain) Delete a program or parameters of a program in the local or remote CPU. Request the attributes of a program or of parameters of a program from another CPU. 10 - 13 Volume 2Request Editor Tool B8976049/01 Selectable TF Services (continued) Program invocation services CREATE Pi START PI STOP Pl RESUME PI RESET PI KILL Pl DELETE Pl LOCAL PROGRAM STOP Assignment of one or more domains to form an executable program invocation in the local or remote station. The previously created program invocation is changed to the RUN status, i.e. the program now runs in the local or remote CPU The previously started program invocation is stopped again in the local or remote CPU. The previously stopped program invocation is started again in the local or remote CPU. The previously stopped program invocation is changed to the deletable status in the local or remote CPU. a) if Pl re-usable -> to IDLE state b) if Pl not re-usable -> to unrunnable state instant termination of a program invocation in the local or remote CPU. A previously reset program invocation is deleted in the local or remote CPU. The local program invocation is stopped by the user program (transition from running to stopped). GET Pl Request the attributes of a program invocation from a ATTRIBUTES different CPU. Volume 2 10-14B8976049/01 Request Editor Tool Selectable TF Services (continued) VMD services STATUS UNSOLICITED STATUS IDENTIFY VMD Request the status (physical and logical) of another CPU. Send the local station information (physical and logical) spontaneously to another station without being triggered externally and without requesting acknowledgement. Request information about the type and characteristics of a remote station. Transparent data exchange (non-open services) READ BYTE STRING WRITE BYTE STRING REQUEST BYTE STRING LENGTH TRANSPARENT DATA EXCHANGE Other jobs CONFIGURE ANZW (local) Read a byte string from another station. Transfer a byte string to another station. Request the number of bytes accepted by the partner during the last write byte string job to be transferred to the PLC (local job). Trigger the non-open TF service transparent data exchange". Transfers the configuration parameters for an application association to the local network interface. Select a function with the cursor keys, the currently selected function is displayed inversely on the screen. Default: READ VARIABLE. 10-15 Volume 2Request Editor Tool B8976049/01 10.4.3 Variable Services Read Variable . CP TYPE: C7 Request Editor Job Buffer Source: L.jstss [__) TIMEOUT $5 DEST ADD SCOPE VAR ID DOM ID VAR TYPE NUMBER PARAMETERS FOR SEND DIR CALL TO ACTIVATE THE SERVICE Q-TYP: DB-NR: O-ANF: QLAE: F [ JFL JF JFL al JF J Fi }FC~) 1 2 3 4 6 7 OK 8 SELECT Fig. 10.6: Read Variable Screen Input fields TIMEOUT Acknowledgement monitoring time for the job in units of 0.1 sec. Default: 10 sec. If the job is not completed within this time, the CP aborts the job. If you do not enter a value in the field, the CP assumes that no time monitoring is required for the job. $5 DESTINATION The address in the S5 system at which the value of ADDRESS the requested variable will be stored by the CP. Dest. type: DB, DX DB no.: = 1..255 Start: 0..2042 Example: DB 12 0 If you specify DB no. = 0, this means that the variable must be completely configured. This is mandatory for complex and structured variables. Volume 2 10-16B8976049/01 Read Variable (continued) SCOPE VAR ID: Request Editor Tool The configuration is then specified during the link or VMD configuration in the REMOTE DEFINITIONS screen. When you press F7, the Request Editor indicates that variable configuration is necessary. <VAR NAME MUST BE CONFIGURED!> It is not possible to specify the length, this is determined implicitly by the type of variable. The address is input as normal in COM programming by separating the individual parameters of the S5 address with blanks. Specifies the validity of the requested variable in the other system. Permitted values: VM: VMD-specific The requested variable is valid throughout the other station (no restrictions). DO: Domain-specific The requested variable is only valid in the other station within the area specified by the domain name". VB: Link-specific The requested variable is only accessible in the other station via a particular link. The link is identified by the SEND-DIR call parameters "SSNR" and "ANR" when the job buffer is transferred. Default: VM The name of the requested variable in the other system. 10-17 Volume 2Request Editor Tool B8976049/01 Read Variable (continued) DOM ID: This parameter is only specified if the "SCOPE = DO". It identifies the domain to which the variable is assigned via scope. VARIABLE TYPE: Specifies the type of the requested variable. 1st input field: Input of the basic type, see table. 2nd input field: Length of the type specified in the first input field (specification as in COM 143). Default: IN 16 Note: It is not possible to access complex or structured variables (structures or arrays) using the Request Editor. In this case, you must use the remote definitions" of variables. NUMBER: Number of elements in arrays Default: 1 (no array) Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DiR" Call to trigger the service are also displayed. Volume 2 10 - 18B8976049/01 Request Editor Tool Read Variable (continued) The table lists the types that can be specified under variable type: TF TYPE Meaning Corr. to TYPE. |Description S5Type BO No entry Boolean - IN 8 Integer, 8 bits - 16 Integer, 16 bits KF 32 Integer, 32 bits - UN 8 Unsigned, 8 bits - 16 Unsigned, 16 bits KH 32 Unsigned, 32 bits - FP 32 Floating point number in KG MC5 format, 32 bits TI 4 Time, 4 bytes format see below - TD 6 Time with date format see below - Table 10.4: TF Type and Meaning Function keys (extra or with special meaning): F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10 - 19 Volume 2Request Editor Tool B8976049/01 Example of using a HELP menu This section is intended as a reminder of the help and selection functions which make configuration easier and ensure the correctness of entries. To illustrate these functions, it is assumed that you want a job buffer for the read variable service. You want to make an entry in the "VAR TYPE" input field and you cannot remember the abbreviations for the types (press the SELECT key on the PG). By moving the inversely displayed line in the help window with the cursor up and cursor down keys, you can select the required type and enter it in the field by pressing the enter key or carriage return key. The help window then disappears. For the second input field specifying the type, a selection window is dis- played to help you make the input, only the options allowed for the selection made in the first window are displayed. Volume 2 10-20B8976049/01 Request Editor Too! Write Variable Request Editor Job Butfer CP TYPE: [__] ea Source: ST.S5D WRITE TIMEOUT $5 SOURCE ADD SCOPE VAR ID DOM ID VAR TYPE NUMBER $5 ADDRESS OF THE VARIABLE PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F[ |r | le[ lel JF [ J Fl _|F FL] 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.7: Write Variable Screen Input fields: TIMEOUT: Same as for read variable. $5 SOURCE Address in the S5 system at which the user program ADDRESS has stored the value of the variable to be sent. Source type: DB, DX, DA DB no.: 1..255 Start: 0..2042 Example: DB 12 0 If you specify DB no. = 0, this means that the variable must be completely configured. This is mandatory for complex and structured variables. 10 - 21 Volume 2Request Editor Tool Write Variable (continued) B8976049/01 The configuration is then specified during the link or VMD configuration in the REMOTE DEFINITIONS screen. When you press F7, the Request Editor indicates that variable configuration is necessary. <VAR NAME MUST BE CONFIGURED!> It is not possible to specify the length, this is determined implicitly by the type of variable. SCOPE Specifies the validity of the requested variable in the other system. Permitted values: VM: VMD-specific The requested variable is valid throughout the other station (no restrictions). DO: Domain-specific The requested variable is only valid in the other station within the area specified by the domain name. VB: Link-specific The requested variable is only accessible in the other station via a particular link. The link is identified by the SEND-DIR call parameters "SSNR" and "ANR" when the job buffer is transferred. Default: VM VAR ID: The name of the requested variable in the other system. DOM ID: This parameter is only specified if the "SCOPE = DO". It identifies the domain to which the variable is assigned via scope. Volume 2 10 - 22B8976049/01 Request Editor Tool Write Variable (continued) VARIABLE TYPE: Specifies the type of the requested variable. ist input field: Input of the basic type, see table. 2nd input field: Length of the type specified in the first input field (specification as in COM 143). Default: IN 16 Note: It is not possible to access complex or structured variables (structures or arrays) using the Request Editor. In this case, you must use the remote definitions of variables. NUMBER: Number of elements in arrays Default: 1 (no array) Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Note on the source type "DA": This means that the user program stores the value of the variables after the parameters. in this case, the parameters "DB no" and start are invalid. Since the job buffers have different lengths depending on the length of the variables and domain names, the complete S5 address of the variables is output after you press F7 (OK). (Output field "SS ADDRESS OF VARIABLES"). Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen form: input. 10-23 Volume 2Request Editor Tool B8976049/01 Information Report Request Editor Job Buffer CP TYPE: Souree: [(C_] ST.S5D CF SCOPE VAR ID DOM ID MULTIPLE ACCESS PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE FL_ jr [ JF{ ]F[ tal | Ff ] FI | 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.8: Information Report Screen input fields: SCOPE Specifies the validity of the requested variable in the local system. Permitted values: VM: VMD-specific The requested variable is valid throughout the local station (no restrictions). DO: Domain-specific The requested variable is only valid in the local station within the area specified by the domain name". VB: Link-specific The requested variable is only accessible in the local station via a particular link. The link is identified by Volume 2 10 - 24B8976049/01 Request Editor Tool Information Report (continued) the SEND-DIR call parameters "SSNR" and "ANR" when the job buffer is transferred. Default: VM VAR ID Name of the variable to be reported in the local system. If multiple access = YES, the group name is displayed here. DOM ID The parameter is only specified when "SCOPE = DO". It indicates the domain to which the variable is assigned via the scope. Multiple access If you specify "yes" here, several variables are sent in a message. In this case the variable group must be configured in the COM in the "Group Definitions" screen (VMD variables editor). Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10-25 Volume 2Request Editor Tool Free Format Write B8976049/01 Request Editor Job Buffer cp type: L_] Source: [[_] ST.S5DC_] WRITE TIMEOUT $5 SOURCE ADD SCOPE VAR TYPE ADDRESS S5 ADDRESS OF THE VARIABLE PARAMETERS FOR "SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP : DB OB-NA: Q-ANF: Q-LAE: F {| JF [ JF | Je[ JF[ ial JF FL 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.9: Write Free Format Screen Input fields: TEMEOUT Same as for read variable. 5 SOURCE Address in the S5 system at which the user program ADDRESS has stored the value of the variable to be sent. Source type:DB, DX, DA DB no.:1-255 Start 0...2042 Volume 2 10 - 26B8976049/01 Request Editor Tool Write Free Format (continued) SCOPE VARIABLE TYPE ADDRESS Output fields: Specifies the area in which the variable to be written is valid in the other system. Permitted value: VM: The requested variable is valid throughout the whole station (no restrictions). Specifies the type of the requested variable. 1st input field specifies the basic type always OS"(octet string) 2nd input field length of the type specified in the 1st input field "OS" 1...4086 octet string, length = number of bytes in user data string You can define a maximum of 32 characters for a free format address. The entry is made _ in hexadecimal (see also function description of free-format write). After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10 - 27 Volume 2Request Editor Tool B8976049/01 Free Format Read Request Editor Job Buffer cP TYPE: CJ Source: ([7_] ST.S5D (I READ TIMEOUT $5 DEST ADD SCOPE VAR TYPE ADDRESS PARAMETERS FOR SEND DIR CALL TO ACTIVATE THE SERVICE Q-TYP : DB DB-NR: Q-ANF: Q-LAE: F| JF [ Je[ lel ]F al ]F F [HELP 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.10: Read Free Format Variable Screen Input fields: TIMEOUT Same as for read variable. $8 SOURCE Address in the S5 system at which the value of the ADDRESS variable will be stored. Source type:DB, DX DBno.: 1-255 Start 0...2042. SCOPE Specifies the area in which the requested variable is valid in the other system. Permitted value: VM: The requested variable is valid throughout the station (no restriction). Volume 2 10 - 28B8976049/01 Request Editor Tool Read Free Format (continued) VARIABLE TYPE Specifies the type of the requested variable. 1st input field specifies the basic type always "OS"(octet string) 2 input field length of the type specified in the 1st input field "OS" 1...4086 octet string, length = number of bytes in string ADDRESS You can define a maximum of 32 characters for a format-free address. The entry is made in hexadecimal (see also function description free format write). Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. eee S: F7 y Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10-29 Volume 2Request Editor Tool B8976049/01 10.4.4 Domain Services Load Domain Request Editor Job Butter CP TYPE: (4 Source: [__]) ST.S5D [__] TIMEOUT BOM ID FILE SERVER FILE NAME CPU NO IN THE OTHER STATION PARAMETERS FOR "SEND DIR* CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR Q-ANF Q-LAE F | lF [ JF | Jel JF ] Fl J F[ a | 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.11: Load Domain Content Screen Input fields: TIMEOUT Acknowledgement monitoring time for the job in units of 0.1 sec. Default: 10 sec. If the job is not completed within this time, the CP aborts the job. If you do not enter a value in the field, the CP assumes that no time monitoring is required for the job. DOM ID The domain (group of blocks) is managed on the destination system using this name. FILE SERVER Specifies the name of the application association to be established to the fileserver. Volume 2 10 - 30B8976049/01 Request Editor Tool Load Domain Content (continued) FILE NAME The file specified here contains the domain to be loaded. CPU NO IN THE Specifies the number of the CPU in which the domain OTHER STATION: will be loaded in the other station (SIMATIC S5) Permitted values: 1 to 4. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10 - 31 Volume 2Request Editor Tool B8976049/01 Store Domain Content Request Editor Job Buffer cP TYPE: (__] Source: [[__] ST.S5D [__] TIMEOUT DOM ID FILE SERVICE FILE NAME PARAMETERS FOR "SEND DIR" CALL TO ACTIVATE THE SERVICE STORE Q-TYP DB-NR: Q-ANF Q-LAE F Jel lF[ JFl JF | &[ | F FEL 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.12: Store Domain Content Screen Input fields: TIMEOUT Same as for load domain DOM 1D The domain specified here will be saved on the fileserver. FILE SERVER Specifies the name of the application association to be established to the fileserver. FILE NAME The domain will be stored on the fileserver under the name specified here. Volume 2 10-32B8976049/01 Request Editor Tool Store Domain Content (continued) Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 OK Completes the input and stores the newly edited job buffer in the main memory of the programmer. Next screen: input. 10-33 Volume 2Request Editor Tool B8976049/01 Delete Domain Request Editor Job Buffer CP TYPE: [7] Source: [| ST.S5D (__] DELETE TIMEOUT 100 DOM ID es : ] PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F | Je [ JF JF JF[ al JF FL___ 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.13: Delete Domain Content-Screen input fields: TMEOUT Same as for load domain DOM ID The domain specified here will be deleted. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job OK buffer in the main memory of the programmer. Next screen: input. Volume 2 10 - 34B8976049/01 Request Editor Tool Get Domain Attributes . CP TYPE:C_] ff Request Editor Job Buffer Source: ST.S5D DOM-ATTR TIMEOUT [10d] i DOM ID i SSDESTADD [= LENGTH ES PARAMETERS FOR SEND DIR CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F[ lr [ JFL lel al JFf al JF ] 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.14: Get Domain Attributes Input fields: TIMEOUT DOM ID $5 DEST ADDRESS Length Same as for load domain The attributes of the domain specified here are requested. Address in the S5 system at which the requested domain attributes will be stored by the CP. Dest. type: DB, DX DB no.: 1..255 Start: 0.2042. The "length" parameter specifies how many data words can be written by the CP into the data block. The value -1 means that all data of the acknowledgement can be entered. 10 - 35 Volume 2Request Editor Tool B8976049/01 Get Domain Attributes (continued) Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job OK buffer in the main memory of the programmer. Next screen: input. Volume 2 10 - 36B8976049/01 Request Editor Tool 10.4.5 Program invocation services Create Pl Request Editor Job Buffer CP TYPE: Source: C3 C) sT.s5) C7 TIMEOUT PINAME DOM ID 1 DOM ID 2 DOM ID 3 DOM ID4 DOM ID5 DOM ID6 DOM ID7 DOM ID 8 Q-TYP PARAMETERS FOR SEND DIR CALL TO ACTIVATE THE SERVICE CREATE Pi DB-NR: Q-ANF Q-LAE F | JF | 1 2 je [FL Jel JF FL} 3 4 5 6 7 OK 8 SELECT Fig. 10.15: Create PI Screen Input fields: TIMEQUT PENAME DOM ID 1.8 Acknowledgement monitoring time for the job in units of 0.1 sec. Default: 10 sec. If the job is not completed within this time, the CP aborts the job. If you do not enter a value in the field, the CP assumes that no time monitoring is required for the job. The created program invocation is assigned the name specified here. Name of the domain belonging to the program invocation. For SIMATIC S5, up to eight domain names are possible. Input fields can, however, also remain empty. Remember that if you use longer names, the maximum length of a job buffer (256 10 - 37 Volume 2Request Editor Tool B8976049/01 Create PI! (continued) bytes) must not be exceeded. The Request Editor monitors this and displays the message "JOB BUFFER TOO LONG'" if this limit is exceeded. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 38B8976049/01 Request Editor Tool Start Pl Request Editor Job Buffer CP TYPE: (__] Source: (7 ST.ss0 (1 START Pl TIMEOUT PINAME PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP OB-NRA: Q-ANF Q-LAE Fl JFL Jel ]F| JF | _jF[ hal TF | 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.16: Start Pl Screen input fields: TIMEOUT Same as for create PI. PI NAME The program invocation created with this name will be started. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10-39 Volume 2Request Editor Tool B8976049/01 Stop Pl Request Editor Job Butfer CP TYPE: C_] Source: [7_] ST.S5D CJ STOP Pi TIMEOUT P! NAME PARAMETERS FOR "SEND DIR CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F[ Jr [ Je[ 1F | JF [ JF J Fi }FL 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.17: Stop Pl Screen Input fields: TIMEOUT Same as for create PI. PI NAME The program invocation created with this name will be stopped. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input.. Volume 2 10 - 40B8976049/01 Request Editor Tool Resume PI Request Editor Job Buffer CP TYPE: (_]J Source: C7 T.s50 [7] RESUME PI TIMEOUT PI NAME PARAMETERS FOR SEND OIR CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F| IF lF[ Jel |F | J F[ JF FL 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.18: Resume P! Screen Input fields: TIMEQUT Same as for create PI. P} NAME The program invocation with this name will be resumed. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10 - 41 Volume 2Request Editor Tool B8976049/01 Reset Pl Request Editor Job Buffer CP TYPE: [_] Source: ([7) ST.ssD (C1 RESET PI TIMEOUT Pl NAME PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF O-LAE F [ JF [ JF | JF | JF | | Ff al a ] 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.19: Reset P! Screen Input fields: TIMEOUT Same as for create PI. PI NAME The program invocation with this name will be reset. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 42B8976049/01 Request Editor Tool Kill Pl Request Editor Job Buffer cp TYPE: (_} Source: [7] ST.S5D [Ll] KILL PI TIMEOUT P| NAME PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP OB-NR: Q-ANF Q-LAE F | je [ lF| JF jF{ J F[ _] F | 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.20: Kill PE Screen Input fields: TIMEOUT Same as for create PI. PY NAME The program invocation with this name will be aborted. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 OK Completes the input and stores the newly edited job buffer in the main memory of the programmer. Next screen: input. 10-43 Volume 2Request Editor Tool B8976049/01 Delete Pl Request Editor Job Buffer CP TYPE: [) Source: C77 $T.ssD Co DELETE Pl TIMEOUT PI NAME PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F[ lF | JF [ 1F[ jF[ al ]F FC 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.21: Delete Pl Screen Input fields: TIMEOUT Same as for create PI. PY NAME The program invocation with this name will be deleted. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 44B8976049/01 Request Editor Tool Local Program Stop Request Editor Job Buffer CP TYPE: C7] Source: [C7] ST.S5D (__] Loc. STOP PI NAME PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE FL_ JF | JFL JeL JFL JF ] F[ 1FL 7 1 2 3 4 5 6 7 OK g SELECT Fig. 10.22: Local Program Stop Screen Input fields: PI NAME The program invocation with this name will be stopped. Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10 - 45 Volume 2Request Editor Tool B8976049/01 Get PI Attributes Request Editor Job Buffer CP TYPE: C__) a Source: [_] ST.S5D [7 PLATTR TIMEOUT PI NAME 85 DEST ADD LENGTH PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F [ lr | JF [ JF i JF J) F[ JF JF | 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.23: Pl Attributes Screen Input fields: TIMEOUT Same as for create PI. PI NAME The attributes of the program invocation specified here are requested. $5 DESTINATION Address in the S5 system at which the requested Pl ADDRESS attributes will be stored by the CP. Dest. type: DB, DX DBno.: = 1..255 Start: 0..2042 Length The "length" parameter specifies how many data words can be written by the CP into the data block. The value -1 means that all data of the acknowledgement can be entered. Volume 2 10 - 46B8976049/01 Request Editor Tool Get PI Attributes (continued) Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. 10 - 47 Volume 2Request Editor Tool B8976049/01 10.4.6 VMD Services Status Request Editor Job Butfer CP TYPE: C] Source: (_] ST.S5D [7 STATUS TIMEOUT $5 DEST ADD LENGTH PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F | Je L JFL JF[ JF | J Ff J F[ JF 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.24: Status Screen Input fields: TIMEOUT $5 DESTINATION Acknowledgement monitoring time for the job in units of 0.1 sec. Default: 10 sec. If the job is not completed within this time, the CP aborts the job. If you do not enter a value in the field, the CP assumes that no time monitoring is required for the job. Address in the S5 system at which the requested ADDRESS status information will be stored by the CP. Dest. type: DB, DX DB no.: 1..255 Start: 0..2042 Volume 2 10 - 48B8976049/01 Request Editor Too! VMD Status (continued) Length: Output fields: The "length" parameter specifies how many data words can be written by the CP into the data block. The value -1 means that all data of the acknowledgement can be entered. After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR? call to trigger the service are also displayed. Function keys: F7 OK Completes the input and stores the newly edited job buffer in the main memory of the programmer. Next screen: input. 10 - 49 Volume 2Request Editor Tool B8976049/01 Unsolicited Status Request Editor Job Buffer cp TYPE: CJ Source: [7_}ST.S5D (C_J UNSOL STATUS PARAMETERS FOR "SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP: DB DB-NR: 100 Q-ANF Q-LAE F[ JF [ TF | jF[ }F I | F[ JF al 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.25: Unsolicited Status Screen For the unsolicited status" service, no entry is required in the screen. The Request Editor simply generates the required buffer in the job data block and displays the address of the job buffer Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 50B8976049/01 Request Editor Tool Identify VMD Request Editor CP TYPE: C_) Source: ST.S5D IDENTIFY TIMEOUT $5 DEST ADD LENGTH PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANE Q-LAE F[ Je [ JF | cal 1F[ Jel |F FL. sd 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.26: Identify VMD Screen Input fields: TIMEOUT Same as for status S5 DESTINATION Address in the S5 system at which the requested ADDRESS information will be stored by the CP.. Dest. type: DB, DX DB no.: 1..255 Start: 0..2042 Length: The "length" parameter specifies how many data words can be written by the CP into the data block. The value -1 means that all data of the acknowledgement can be entered. 10 - 51 Volume 2Request Editor Tool B8976049/01 Identify VMD (continued) Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 52B8976049/0 1 Request Editor Tool 10.4.7 Transparent Data Exchange (non-open services) Read Byte String Request Editor Job Buffer CP TYPE: (__] Source: [[_] ST.S5D TC] READ BS TIMEOUT $5 DEST ADD LENGTH PARAMETERS FOR "SEND-DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F | JF | jr IF | JF } eC ee CE] 1 2 3 4 5 6 7 OK g SELECT Fig. 10.27 Read BS Screen Input fields: TIMEOUT Acknowledgement monitoring time for the job in units of 0.1 sec. Default: 10 sec. If the job is not completed within this time, the CP aborts the job. If you do not enter a value in the field, the CP assumes that no time monitoring is required for the job. S85 DESTINATION Address in the S5 system at which the requested ADDRESS byte string will be stored by the CP. Dest. type: DB, DX DB no.: 1..255 Start: 0..2042 10-53 Volume 2Request Editor Tool B8976049/01 Read Byte String (continued) Length: The "length" parameter specifies how many data words can be written by the CP into the data block. Range of values: 1 .. 2043 Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 54B89 76049/01 Request Editor Too! Write Byte String Request Editor Job Butter CP TYPE: [] Source: [__] ST.S5D [Cj WRITE BS TIMEOUT $5 SOURC ADD LENGTH ACKNOWLEDGE $5 ADDRESS OF BYTE STRING: PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F| JF | _jr[ JF [ JF | ial JF FL 1 2 3 4 5 6 7 OK gs SELECT Fig. 10.28 Write BS Screen Input fields: TIMEOUT Same as for Read byte string $5 SOURCE Address in the S5 system at which the user program ADDRESS stored the byte string to be sent. Source type: DB, DX, DA DB no.: 1..255 Start: 0..2042 Note on the source type "DA": This means that the user program stored the byte after the parameters in the job buffer. In this case, the parameters "DB no" and "Start" are invalid. If you press the softkey F7 (OK) the complete S5 address of the byte string is displayed (output field "S5 ADDRESS OF BYTE STRING"). 10 - 55 Volume 2Request Editor Tool B8976049/01 Write Byte String (continued) Length: ACKNOWLEDGE Output fields: The length parameter specifies the number of data words contained in the byte string. This input field is used to specify the service to be triggered in more detail. Permitted values: YES: The "write byte string with acknowledgement" service is triggered. NO: The "write byte string without acknowledgemeni" service is triggered After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 56B8976049/01 Request Editor Tool Request Byte String Length Request Editor Job Buffer CP TYPE: L_]J Source: [~_] ST.S5D [ 8S LENGTH TIMEOUT 100;| $5 DEST ADD nee] s PARAMETERS FOR "SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE F[ le [ Je[ JF | lF | | F[ jF F{ FEL | 1 2 3 4 5 6 7 OK g SELECT Fig. 10.29 BS Length Screen Input fields: TIMEOUT Same as for read byte string $5 DESTINATION Address in the S5 system at which the length of the ADDRESS byte string that could be accepted by the other station during the last write byte string" job will be stored. One word is always required. Dest. type: DB, DX DB no.: 1..255 Start: 0..2042 10 - 57 Volume 2Request Editor Tool B8976049/01 Request Byte String Length (continued) Output fields: After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 58B8976049/01 Request Editor Tool Transparent Data Exchange Request Editor Job Buffer CP TYPE: Source: [7 _] ST.S5D [__] TIMEOUT $5 SOURC ADD S LENGTH $5 DEST ADD D LENGTH ACKNOWLEDGE S5 ADDRESS OF SOURCE DATA: PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TyP DB-NR: Q-ANF O-LAE F | JF | JF | JF| JF JF [ )F[ | F[_FELF | 1 2 3 4 5 6 7 OK 8 SELECT Fig. 10.30 Transparent Data Exchange Input fields: TIMEOUT Same as for read byte string $5 SOURCE Address in the S5 system at which the user program ADORESS stored the useful data to be sent. Source type: DB, DX, DA DB no.: 1..255 Start: 0..2042 $ length The "S length" parameter specifies how many useful data bytes the job contains. Note on source type "DA": This means that the user program stores the useful data of the job after the parameters in the job buffer. In this case, the parameters "DB no" and "Start" are 10 - 59 Volume 2Request Editor Tool B8976049/01 Transparent Data exchange (continued) $5 DESTINATION ADDRESS D length: ACKNOWLEDGE Output fields: invalid. After pressing F7 (OK), the complete S5 address of the useful data is displayed (output field "S5 ADDRESS OF SOURCE DATA"). Address in the S5 system at which the data in the acknowledgement will be stored by the CP. Dest. type: DB, DX DB no.: 1..255 Start: 0..2042 The "D length" parameter specifies how many data words can be written to the data block by the CP. The value -1 means that all the data of the acknowledgement can be accepted. This input field is used to define the service to be triggered in more detail. Permitted values: YES: The "TRADA with acknowledgement" service is triggered. NO: The "TRADA without acknowledgement service is triggered. After entering the data with F7, the parameters of the last edited job buffer are displayed on the screen. In addition to this, call parameters for the "SEND DIR" call to trigger the service are also displayed. Function keys: F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input. Volume 2 10 - 60B89 76049/01 Request Editor Tool 10.4.8 Other Jobs Configure ANZW (local) With this function, a job buffer for transferring configuration parameters to the local network interface is generated. This job buffer is also transferred to the CP with a SEND-DIR job. fj cp TvPe: LJ Request Editor Job Buffer Source: [] 87-850 CI STATUS Fi: | STATUS WORD FOR CLIENT JOBS NOT INCLUDED F2: SOURCE ADDRESS FOR READ BYTE STRING (SERVER) NOT INCLUDED F3: DEST ADDRESS FOR WRITE BYTE STRING (SERVER) NOT INCLUDED F4: DEST ADDRESS FOR UNSOLICITED STATUS (SERVER) NOT INCLUDED PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE Q-TYP DB-NR: Q-ANF Q-LAE FL JF [ jF| | FL Jel J F[ JF FC 4 ANZW 2SADDR ,DADDW 4, STATUS 5 6 7 OK g SELECT Fig. 10.31: Configure ANZW Screen Parameters are entered in the job buffer depending on the selections you make from the four available parameter sets. In the status column, the Request Editor indicates whether or not the parameter is contained in the job buffer. 10 - 61 Volume 2Request Editor Tool B8976049/01 Configure ANZW (continued) i ys: Fi ANZW You can input the address of the status word to be addressed in client jobs on the link used with the SEND direct. The address transferred with a configuration job has priority over the address configured in the COM-application association configuration. Next screen form: see subfunction F1 F2 You can input the address in the S5 system at which the S ADD R data for the read byte string job are stored Next screen : see subfunction F2 F3 You can input the address in the S5 system at which the D ADD W CP stores the byte string contained in the TF-PDU in a "write byte string indication". Next screen: see subfunction F3 F4 You can input the address in the S5 system at which the STATUS CP will store the data for an unsolicited VMD status indication" Next screen: see subfunction F4 F7 Completes the input and stores the newly edited job buffer OK in the main memory of the programmer. Next screen: input.. Volume 2 10 - 62B8976049/01 Request Editor Tool Configure ANZW (continued) Configure ANZW (local) oo. Subfunction F1: status word for client jobs You select the address of the status word to be addressed on the link for SEND direct in client jobs. The address transferred with a configuration job has priority over the address configured in the COM-application association configuration. CP TYPE: L__] Request Editor Job Buffer Source: ([7_] ST.S5D ("7 CONFIG STATUS WORD FOR CLIENT JOBS ANZW AOD { F | F F F[ al ] FI lF FL Perr] 1 2 3 4 5 6 7 OK g SELECT Fig. 10.32: Status Word for Client Jobs Screen Input fields: ANZW ADD Address of the status word to be addressed on the link for SEND direct in client jobs. This consist of the following: Anzw type: FW, DB, DX Anzw no.: FW number or DB/DX number DW no: data word number for ANZW type = DB or DX 10-63 Volume 2Request Editor Tool B8976049/01 Configure ANZW (continued) Function keys: Example: FW 100, if flag word 100 to 102 is to be used as the status word. DB 20 10, if data block 20, data words 10-12 are to be used as the status word. F7 The parameters are entered in the job buffer. If you do not OK make an entry in the input field and the parameter already exists, it is deleted from the job buffer. Next screen: configure ANZW (local). Volume 2 10 - 64B8976049/01 Request Editor Tool Configure ANZW (continued) Configure ANZW (local) ; Subfunction F2:Source address for read byte string (server): The function is used to input the address in the S5 system at which the data for the "read byte string indication" are stored You also specify the status word to be used with such jobs. Request Editor Job Butfer CP TYPE: LJ Source: [-_] S1S5D CJ CONFIG SOURCE ADDRESS FOR READ BYTE STRING (SERVER) $5 SOURC ADD S$ LENGTH ANZW ADD F | JF [ Jel |F | JF | J Fl ]F | F [_FEtP 1 2 3 4 6 7 OK 8 Fig. 10.33 Source Address Read BS Screen input fields: $5 SQURCE Source type: DB, DX ADDRESS: DB no.: 1..255 Start: 0..2042 S$ length The "S length" parameter specifies how many data words will be entered in the job acknowledgement by the CP. 10-65 Volume 2Request Editor Tool B8976049/01 Configure ANZW (continued) ANZW ADD Address of the status word for such jobs. The entry is the same as for the ANZW parameter. Function keys: F7 The parameter is entered in the job buffer. If you do not OK make an entry in the input field and the parameter already exists, it is deleted from the job buffer. Next screen: configure ANZW. Volume 2 10 - 66B8976049/01 Request Editor Tool Configure ANZW (continued) Configure ANZW (local) . ; Subfunction F3:Destination address for write byte string The function is used to input the address in the S5 system at which the CP stores the byte string contained in the TF-PDU in a write byte string indication. You also specify the status word to be used with such jobs. Request Editor Job Buffer CP TYPE: (-_] Source: [_] ST.SSD [J CONFIG DEST ADDRESS FOR WRITE BYTE STRING (SERVER) SS DEST ADD DLENGTH ANZW ADD F[ JF [ lF[ JF{ tal Jel JF F {FEL | 1 2 3 4 5 6 7 OK g SELECT Fig. 10.34 Dest. Address Write BS Screen input fields: $5 DESTINATION Dest. type: DB, DX ADDRESS DB no.: 1..255 Start: 0..2042 D fength: The "D length" parameter specifies the maximum number of words the byte string can contain 10 - 67 Volume 2Request Editor Tool B8976049/01 Configure ANZW (continued) ANZW ADD Address of the status word for such jobs. The entry is the same as for the ANZW parameter. Function keys: F7 The parameters are entered in the job buffer. If you do not OK make an entry in the input field and the parameter already exists, it is deleted from the job buffer. Next screen: configure ANZW. Volume 2 10 - 68B8976049/01 Configure ANZW (continued) Configure ANZW (local) Request Editor Tool Subfunction F4: Destination address for unsolicited VMD status The function is used to input the address in the S5 system at which the CP will store the data for an "unsolicited VMD status indication" You also specify the status word to be used with such jobs. Request Editor Job Buffer CP TYPE: (__] Source: [_] ST.S5D (_j CONFIG DEST ADDRESS FOR UNSOLICITED STATUS JOBS (SERVER) $6 DEST ADD ANZW ADD (ial F[ _IF[ lF | JFL lF[ JF| al ] F [Retr 1 2 3 4 $ 6 7 OK g SELECT Fig. 10.35: Unsolicited VMD Siatus Input fields: $5 DESTINATION Dest. type: DB, DX ADDRESS DB no.: 1..255 Start: 0..2042 ANZY ADD Address of the status word for such jobs. Function keys: F7 The parameters are entered in the job buffer. If you do not OK make an entry in the input field and the parameter already exists, it is deleted from the job buffer. 10 - 69 Volume 2Request Editor Tool B8976049/01 10.5 Displaying and Evaluating the Job Buffer Overview With the Request Editor, you can display a list of the job buffers contained in the selected data block. Each output line corresponds to a job buffer in the data block. : CP TYPE: [__J Request Editor Job Buifer Source: [} ST.S5D [7 OPCD $5 ADDR.JOB B. NAME / INDEX $5 ADDRESS V-RE OB 10129 PRESSURE_IN_STEAM_CHAMBER DB 31102 V-WR DB 1031 24 SETPOINT_FOR_PRESSURE CONFIGURED P.ST DB 1056 17 PRESSURE_CONTROL_PROGRAM F | JF [ JF[ JF{ al | F [ ] F FLCC 1 +1 2 1 3 4 SEARCH 5 6 7 OK g SELECT Fig. 10.36 Job Buffers in a Data Block Output fields: OPCD Displays the selected service contained in the job buffer. The abbreviations for the service are explained in the following table. S5 ADDR. JOB B. Displays the data block number and data word number in the data block. NAME/INDEX Displays a job-specific name such as variable name or program invocation name. Volume 2 10 - 70B8976049/01 Request Editor Tool Output Job Buffer (continued) $5 ADDRESS Displays the source address for calling "SEND DIR" to trigger the service The S5 address contained in the job buffer is displayed. With variables services, this is the source or destination address of the variables. Since there is no S5 address contained in certain job buffer types, this display may be omitted. Overview of the OPCD abbreviations OPCD Meaning V-RE Read Variable V-WR Write Variable V-IN Information Report D-LO Load Domain Content D-ST Store Domain Content D-DE Delete Domain Content D-GE Get Domain Attributes P-CR Create Program Invocation P-ST Start Program Invocation P-RE Resume Program Invocation P-SP Stop Program Invocation P-RS Reset Program Invocation P-AB Kill Program Invocation P-DE Delete Program Invocation P-HL Local Program Stop P-GE Get Program Invocation Attributes M-ST Status M-SU Unsolicited Status M-ID Identify VMD B-RQ Read Byte String B-WQ Write Byte String with Acknowledgment B-WO Write Byte String without Acknowledgment B-WI Request Byte String Length T-DQ Transparent Data Exchange with Acknowledgment T-DO Transparent Data Exchange without Acknowledgment A-CF Configure ANZW [local] 10 - 71 Volume 2Request Editor Tool B8976049/01 Output Job Buffer (continued) Function keys (extra or with special meaning): F4 Using the cursor keys (up/down) you can mark a job buffer SEARCH in the screen (line displayed inversely) and select it with the function key F4 or F7. F7 With this function, you can select the marked job buffer for OK display or processing. Explanation of the example:: 1. Read the variable "PRESSURE_IN_STEAM_CHAMBER" The variable is defined in data block 31 from data word 10 and occupies two words (the type in the job buffer is floating point). The job buffer was created in data block 10 beginning at data word 1. When this service is triggered, 29 words must be transferred to the CP. Write the variable "SETPOINT_FOR_PRESSURE" This variable must be programmed with the COM. The job buffer was created in data block 10 beginning at data word 31. When the service is triggered, 24 words must be sent to the CP. Start the program "PRESSURE_CONTROL_PROGRAM" The job buffer was created in data block 10 beginning at data word 56. When the service is triggered, 17 words must be sent to the CP. There is no S5 address in the job buffer. Volume 2 10 - 72B8976049/0 1 Request Editor Tool 10.6 Delete Data Block You can delete a data block completely. When you use this function, all the information about the job buffers in the selected data block is lost. 10.7 Documenting Job Buffers Using the documentation functions, you can output the configuration data either on the screen or on a printer. The output depends on the selections you make in the screen in which you specify the configuration environment. The functions always relate to the currently selected program file and selected data block. 10.7.1 Documentation | All Both the job buffers and the overview list are output. 10.7.2 Documentation | Overview You obtain a printout of the overview list. The explanation of the individual fields can be found in the function description overview of job buffers. 10.7.3. Documentation | Job Buffers The job buffers for the selected program file and the selected data block are output based on the representation on the screen..g 10 - 73 Volume 2NotesB8976008/1 Example Programs 11 Example Programs 11.1. Overview and Requirements Aims This chapter is intended to familiarize you with the TF interface on the SINEC H1 bus system for SIMATIC S5. Emphasis is on the services and the parameter assignment for the CP 143 using the software package COM 143. The aim of this chapter is to provide an overview of the services by creating a small communications system. The example leads step by step to the TF services: > Example 1: using variable services to transfer process values to a host computer and to supply a programmable logic controller (VMD) with current control information. The function of the monitoring computer is handled by a second PLC. > Example 2: using domain and program invocation services to adapt PLC programs to process requirements dynamically and to control the programs. > Example 3: transparent data exchange for simple transfer of data without structural information between S5 PLCs. 11-1 Volume 2Example Programs B89 76008/1 Requirements lt is assumed that you are familiar with the CP handling blocks. The CP handling blocks are standard function blocks allowing the use of the communications functions of the PLC programs. The following minimum hardware must be available: > 2 programmable logic controllers (e.g. S5 155 U) with memory and additional 15 V modules in the power supply. > 2 CP 143 communications processors > 2 EPROMs each with 16 K words (=32 Kbytes) > a transmission line consisting of: 2 transceivers, 2 transceiver cables, 2 terminators 1 bus cable with coaxial connectors > 2 programmers (e.g. PG 730/PG 750) The following software packages are also required: > COM 143 TF > PG software for the STEP 5 programming language, > handling blocks for your PLCs. > the example files supplied with COM 143 TF. cS Note that the lists of function and data blocks shown in this chapter are intended to illustrate the text. The actual values are in the example files on the diskette. Use these files to assign parameters to the PLC! Volume 2 11-2B8976008/1 Example Programs 11.2. Example 1: Using Variable Services 11.2.1 Task in this example, the TF variable services are used to exchange structured data between two stations a programmable logic controller and a monitoring computer. Two SIMATIC PLCs are used as the stations. The host operates as the client and the PLC as server. Server PLC The following simulation exists on the server PLC.: There is an array of five process values, each of which is represented as a whole number (integer 16). The following process is simulated in an FB: Each of the analog values is incremented by a fixed value at a certain time interval. When the preset upper limit is reached, each process value once again assumes the preset default value (lower limit). The graph of the process values is therefore a sawtooth function. The variables that can be influenced by the process control include the time interval and the upper and lower limits of the analog values. Client PLC The client PLC, here the monitoring computer, has the following tasks: You want to monitor and influence the process in the server from the client PLC. The values transferred by the server are stored in a data block and can be monitored at a PG. In addition to this, the client PLC program must be able to preset the process parameters of the server PLC (write a variable) at the request of the user (setting a bit in the flag). 11-3 Volume 2Example Programs B8976008/1 In the same way, the client must be able to read the title of the simulation in the server. These requirements produce the following sequence of events for storing Monitoring computer Programmable logic controller Control programs (OBs,FBs,PBs) Process data area Process values (variables are declared as link-specific) Process names Data area for process control and process management (variables are declared as VMD-specific) Process parameters Process names Process parameters Control process SINEC H1 Application \. association f Sues SSTGH Fig. 11.1. Example Configuration for Stage 1 - Variable Services the data and using the variable services: Tasks of the client PLC : > Read process name (TF service: read variable) Volume 2 11-4B8976008/1 Example Programs Task of the server PLC: > Report process values (TF service: information report) 11.2.2 Defining Variables Based on the tasks described above, the data definitions discussed below are necessary and must be defined and in some cases configured for TF access. The following objects are stored on the server PLC: > 5 PROCESS VALUES These are of the type integer 16, and are therefore whole numbers and are stored in the data block in 16-bit representation. The 5 process values are stored as an array of 5 whole numbers. The scope of the process values is link-specific, so that the values can be only accessed via one link. > PROCESS PARAMETERS The following parameters are stored to control the process: Speed of change (type: integer 16). This parameter specifies the rate at which the process values will change. This is the same rate for all process values. To simplify programming, the value specified for the rate of change is decremented once per PC cycle until it reaches the value zero. Following this, the process values are updated and the process cycle begins again. Upper limits (type: array with 5 elements of type integer 16): For each process value, an upper limit is fixed in an array of 5 elements, and must not be exceeded. Lower limits (type: array with 5 elements of type integer 16): An array of 5 whole numbers specifies the values at which the process values should start (default values). 11-5 Volume 2Example Programs B8976008/1 This produces the following data structure: PROCESS PARAMETERS { RATE OF CHANGE IN 16 UPPER LIMITS AR 5 IN16 LOWER LIMITS AR 5 IN16 } The scope of the process parameters is selected as VMD-specific. since it is assumed that the data areas for managing and controlling the PLC process are maintained as global data (VMD) on the PLC. > PROCESS NAME This object contains a title for the current process. The object is of the type "visible string" (i.e. "KS" for SIMATIC S5) and consists of 32 characters. The scope of this object is also selected as VMD-specific, since the process title and the process parameters belong to the process control and process monitoring data area. Data transfer The current process values are to be reported to the client by the server cyclically as often as possible, so that the client always has an up-to-date process image of the server. On the other hand, the PROCESS PARAMETERS and the PROCESS NAME are transferred on the initiative of the host. Volume 2 11-6B8976008/1 Example Programs 11.2.3 TF Services Required To transfer the data required for the tasks between the two devices, the following TF services are required: > Read variable The process name must be read by the client. Configuration on the server: The process name is VMD-specific and must be configured in COM 143. Name: PROCESS NAME Configuration on the client: Since the process name is a simple data type (string with 32 ASCIl characters}, no configuration is necessary. A corresponding job buffer must simply be created for the PLC program > Write variable The process parameters must be written to the server PLC by the client. Configuration on the server: The process parameters are VMD-specific and must be configured in COM 143. Name: PROCESS PARAMETERS Configuration on the Client: Since this variable is of a complex type (structure) and a complete de- scription of the variables in the job buffer is not possible, this variable must be configured as a remote object (i.e. an object that is not de- fined on the local machine, but on a remote machine). This definition is made in COM 143 when defining the link via which the variable will be written. Name: PROCESS PARAMETERS In addition to this, a job buffer containing the name of the variable must also be defined to trigger the service in the client PLC program. 11-7 Volume 2Example Programs B8976008/1 > Information report The program in the server PLC reports the process values to the client. Configuration on the Server: Since the process values are local objects in the server with the link- specific" scope of validity, they must be configured in COM 143 as link- specific, local objects. To trigger the service, a job buffer must be created in the PLC program. Name: PROCESS VALUE Configuration on the Client: To process the indication in the client, the process values must be confi- gured as remote objects. These are defined when configuring the link via which the values are indicated. Name: PROCESS VALUE The listed services must be executed via an application association. This is established actively by the client. This means that the establishment type on the client must be "A7" and "P7" on the server. Volume 2 11-8B8976008/1 Example Programs 11.2.4 Creating the Client Configuration File Start COM 143 as described in the Section Introduction to the Configuration Software NCM/COM 143. If you have worked through the example of configuring the transport interface in Volume 1, Chapter 5, you are already familiar with the next two steps in basic configuration. Specifying the configuration environment Select the function Init | Edit, to specify the configuration environment. Make the following entries or accept the proposed values if they are suitable: CP TYPE: CP143 STATUS: OFFLINE FD DATABASE FILENAME: PBU1PLC1.CP1 Enter your selections. The PG automatically recognizes whether or not a file with the name "PBU1PLC1.CP1 already exists and if it does not, generates the file on the hard disk (after initializing the SYSID block, see below.). CP basic configuration The next step is to create the SYSID block. Select the function Edit | CP Basic Initialization. In the screen displayed, you will see the CP type and the name of the selected database file. Some of the fields already have defaults entered or are purely display fields. The field "VERSION" is simply a display field. The "PASSWORD" is intended to prevent unauthorized access to a CP 143 via the SINEC H1 bus. Since the SYSID block of the module is being called for the first time, no password is entered. To simplify matters, the password field can remain empty for this example. In the field "DATE", enter the current date (free format). The base interface number "BASE SSNR" of module 1 is set to the default value "0" (set the hardware accordingly!). "MODULE SIZE" is already set to 32K BYTES. If you are using 64 Kbyte modules, this entry must be changed. The Ethernet address can be entered either in this screen or in the "CP INITIALIZATION BLOCK" screen as in this example, You can call the "CP INITIALIZATION BLOCK screen by pressing F2 (Init). 11-9 Volume 2Example Programs B8976008/1 | In the "CP INITIALIZATION BLOCK" screen, only change the Ethernet address to 08000601B010. All the other parameters remain unchanged or empty. Complete your entries with F7 (OK). The file PBU1PLC1.CP1 is then set up on the hard disk. This completes input of the data specific to the CP 143. For the next step, select the Edit | Links | Appl. Associations in the selection menu. Volume 2 11-10B8976008/1 Example Programs Configuring the application association You now specify the application association and its assignment to the transport connection. Make your entries according to the section of screen shown below. Application association configuration SSNR : 0 ANR :1 ANZW : FW 100 LOCAL TSAP:- LENGTH:6 HEX: 43 4C 49 45 4E 54 ASC : CLIENT EST TYPE (A4/A7/D4/D7/P4/P7) :A7 MUX ADDRESS: 0 APPL. ASS. NAME :PLC-PLC LINK REMOTE TSAP:- LENGTH:6 HEX: 53 45 52 56 45 52 ASC : SERVER REMOTE ETHERNET ADDRESS :08000601B8030 TT Fig. 11.2 Application Association Now press F5 (Remote) to call the screen for configuring remote variables. 11-11 Volume 2Example Programs B8976008/1 Configuring the link-specific variables You now configure the variables managed on the partner device which are to be accessed by the PLC configured here using write or read jobs. The variables which report information on the initiative of the server PLC must also be specified here. Make the entries according to the section of screen shown below. Remote Definition SCOPE NAME TYPE $5 ADDRESS ANZW VB - PROCESS VALUE AR 5 DB 100 FW 50 IN 16 VM PROCESS PARAMETERS | 3 DB0O FWo RATE OF CHANGE IN 16 DBOO Fwo UPPER LIMITS AR 5 DBO1 FWO IN 16 LOWER LIMITS AR 5 OBO6 FWwo IN 16 Fig. 11.3 Remote Definition Complete your entries with F7 (OK). You return to the application association configuration screen. Complete your input by pressing F7 (OK). Confirm the prompt about entering the data with YES. Volume 2 11-12B89 76008/1 Example Programs 11.2.5 Creating the Server Configuration File Carry out the basic configuration the same way as for the client PLC. The name of the file in this case is "PBSPL.SRV". The Ethernet address is 08000601B030. For this link, a local link-specific object will be defined in the next step (PROCESS VALUE). Following this, the VMD-specific variable structure PROCESS PARAMETERS must be configured. 11-13 Volume 2Example Programs B89 76008/1 Configuring an application association You now specify the application association and its assignment to the transport connection. Make your entries based on the section of screen shown below. Application association configuration SSNR <0 ANR 31 ANZW : FW 100 LOCAL TSAP : LENGTH :6 HEX: 83 4552.56 45 52 ASC : SERVER EST TYPE (A4/A7/04D7/P4/P7) :P7 MUX-ADDRESS: 0 APPL. ASS. NAME :PLO-PLC LINK REMOTE TSAP:- LENGTH :6 HEX : 43 4C 49 45 2E 54 ASC : CLIENT REMOTE ETHERNET ADORESS 708000601B010 NUMBER OF APPL. ASS. FOR CURRENT TSAP: 1 CURRENT JOB; 1 ee ee Fig. 11.4 Application Association Now press F4 (LOCAL) to call the screen for configuring local variables. Volume 2 11-14B8976008/1 Example Programs Configuring link-specific variables You now configure the variables managed on the server and accessed by ~ the client with read or write jobs. The variables reported on the initiative of the server PLC must also be specified. Make your entries based on the section of screen shown below; first for PROCESS VALUE. Local Definition NAME TYPE ACC $5 ADDRESS ANZW SSNR PROCESS VALUE AR 5 DB 100 FW 50 0 IN 16 TT Fig. 11.5 Local Variable Definition (VMD) Complete your input with F7 (OK). You return to the application association configuration screen. Complete your input with F7 (OK). Confirm the prompt about entering data with YES. 11-15 Volume 2Example Programs B89 76008/1 Configuring VMD-specific variables You now define the structure PROCESS PARAMETERS. This is a VMD-specific variable. You call this configuration screen using the menu bar Edit | VMD Variables. After inputting the data, complete the entry by pressing F7 (OK). Confirm the prompt about entering the data with YES. Local Definitions NAME TYPE ACC $5 ADDRESS ANZW SSNR PROCESS PARAMETERS { 3 RATE OF CHANGE IN. 16 UPPER LIMITS AR 5 IN 16 LOWER LIMITS AR 5 PROCES NAME Automatic, after adopting inserted entries! Fig. 11.6 Local Variable Definition - Process Parameters Volume 2 11-16B8976008/1 Example Programs 11.2.6 Creating the Job Buffers with the Request Editor Client PLC To create the job buffers, you must start the Request Editor | Request Editor | Init. You should first create the job buffers for the PLC program of the client. The program file in our example is BSPC@@ST.S5D. The job buffers are stored in DB 20. Request Editor Initialization PROGRAM FILE C: BSPC@@ST.S5D BLOCK DB 20 Fig. 11.7 Request Editor - Client PLC 11-17 Volume 2Example Programs B89 76008/1 Creating the job buffer First you must select the TF service to be defined in the job buffer. To do this, select Utilities | Request Editor | Create Job Buffer. the following selection list is then displayed: Request editor service selection READ VARIABLE : STATUS : WRITE VARIABLE : UNSOLICITED STATUS : INFORMATION REPORT : IDENTIFY VMD : LOAD DOMAIN CONTENT : READ BYTE STRING: STORE DOMAIN CONTENT : WRITE BYTE STRING : DELETE DOMAIN CONTENT : REQUEST BYTE STRING LENGTH : GET DOMAIN ATTRIBUTES : TRANSPARENT DATA EXCH: CREATE PI: CONFIGURE ANZW (local): START Pl: STOP PI: RESUME P!: FREE FORMAT WRITE RESET PI: FREE FORMAT READ KILL PI: DELETE Pl: LOCAL PROGRAM STOP : GET Pl ATTRIBUTES : $$$ \ oor Fig. 11.8 Request Editor - Selection list Select the job type read variable. The appropriate screen is then displayed. Volume 2 11-18B8976008/1 Example Programs Job buffer for the TF service read variable Enter the variables as shown in the section of screen below for the variable PROCESS NAME. Request editor READ TIMEOUT 100 $5 DEST ADD DB 110 SCOPE vM VAR NAME PROCESS NAME DOM NAME VAR TYPE vs 32 NUMBER 1 PARAMETERS FOR SEND DIR" CALL TO ACTIVATE THE SERVICE QTYP : OB OB-NR : 20 Q-ANF : QLAE: [et Fig. 11.9 Job Buffer- Read Variable After entering the data, you return to the overview by pressing F7 (OK) and F3 (NEW). The select the job type write variable. 11-19 Volume 2Example Programs B8976008/1 Job buffer for the TF service write variable Enter the values according to the section of screen shown below for the variable PROCESS PARAMETERS. Request Editor WRITE TIMEOUT 100 SS DEST ADD DBIO 65 SCOPE vm VAR NAME PROCESS PARAMETERS DOM NAME VAR TYPE NUMBER 1 PARAMETERS FOR SEND DIR CALL TO TRIGGER THE SERVICE Q@TYP : DB DB-NR : 20 Q-ANF : QLAE: ene Fig. 11.10 Job Buffer - Write Variable Volume 2 11-20B8976008/1 Printout of the job buffer Example Programs Once you have created the job buffers, you can use the menu function Utilities || Request Editor | Job Buffer Overview to print out the job buffers and addresses. Request Editor Fig. 11.11 Job Buffer - Printout OPCD $5 ADDR.JOB.B. NAME SS ADDRESS V-RE DB20 1 19 PROCESS NAME DB 11 0 16 V-WR DB20 21 21 PROCESS PARAMETERS DB 10 5 11 11-21 Volume 2Example Programs B8976008/1 Server PLC The next step is to create a job buffer for reporting the process values in the program file of the server. The program file will be called BSP1S@@ST.S5D. The job buffer will be entered in DB 20. Request Editor Initialization PROGRAM FILE C: BSP1S@@ST.S5D BLOCK DB 20 Fig. 11.12 Request Editor - Initialization of Server PLC Volume 2 11-22B8976008/1 Example Programs Job buffer for the TF service information report Enter the values according to the section of screen shown below for the variable PROCESS VALUE. Request Editor REPORT SCOPE VB VAR NAME PROCESS VALUE DOM NAME MULTIPLE ACCESS N PARAMETERS FOR SEND DIR" CALL TO TRIGGER THE SERVICE QTYP : OB OB-NR : 20 C-ANF : O-LAE: eee Fig. 11.13 Job Buffer - Information Report 11-23 Volume 2Example Programs B8976008/1 Printout of the job buffer Once you have created the job buffers, you can use the menu function Utilities | Request Editor | Job Buffer Overview to print out the job buffers and addresses. Request Editor OPCD $5 ADDR.JOB.B. NAME S& ADDRESS VIN DB201 12 PROCESS VALUE PROJECT Fig. 11.14 Job Buffer - Printout Volume 2 11 - 24B8976008/1 Example Programs 11.2.7. PLC Programs The following pages contain printouts of the PLC blocks that must be created for the simulation. The program structure is illustrated in the two following diagrams. Following this, the data and function blocks are listed. In both files, DB 20 contains job buffers created with the TF DB editor. The preheader of these blocks is not created automatically. You must create this yourself to make the blocks easier to read. The preheader is, however, not necessary. The other data blocks contain the data structures recognizable from the configuring of the modules. The handling blocks called in these listings must be those belonging to the particular PLC. cS Note that the lists of function and data blocks shown in this chapter are intended to illustrate the text. The actual values are in the example files on the diskette. Use these files to assign parameters to the PLC! 11-25 Volume 2Example Programs B8976008/1 Client PLC (host) - OBI | JU FB184 CONTROL JU FB10 | VAR-DIEN | F14.0=1 JU FB180 7 Start reading process name Fi4.1=1 JU FB180 Start writing process parameters JU FB180 | SEND ALL (send process parameters) JU FB181 RECEIVE ALL (read process name or receive process data cyclically from server) Fig. 11.15 Program Structure of the PLC Programs on the Client PLC Volume 2 11-26B8976008/1 Example Programs Server PLC (programmable logic controller) JU PB10 DBI | | DB11 | JU FB10 | TT 7 Simulation | | Lo LL | JCFB11 _ MELDEN JU FB120 Start process data indication | JU FB126 SEND ALL (transier the process data) JU FB127 RECEIVE ALL (receive process parameters from the remote partner or read process name job) Fig. 11.16 Program Structure of the PLC Programs on the Server PLC 11-27 Volume 2Example Programs B89 76008/1 PLC program on the client DB10 B:BSPC@@ST.S5D LEN= 21 /4 PAGE 1 0: KF = +00018: Process value 1 1: KF = -00020; \=\ 2 2: KF = +00015; \e\ 3 3: KF = + 00002; \=\ 4 4: KF = - 00041; \=\ 5 5: KF = +00050; Update factor 6: KF = + 00050; Process upper limit 1 7: KF = + 00060; \=\ 2 8: KF = + 00070; \=\ 3 9: KF = + 00080; \=\ 4 10: KF = + 00090; \=\ 5 a | KF = + 00000; Process lower limit 1 12 KF = - 00020; \=\ 2 13 KF = +00000; \=\ 3 14: KF = - 00040; \e\ 4 15: KF = - 00050; \=\ 5 16: DB11 B:BSPC@@ST.S5D LEN= 21/4 PAGE 1 0: KS = 5 12: KS = ' 5 16: Volume 2 11-28B8976008/1 DB20 TP ONINMAAHARWA-O SSSESRSSBSISARBRSR SHA Example Programs B:BSPC@@ST.S5D LEN = 52 /62 PAGE 1 KH = 0014; KS = * V-RE; KF = + 00100; KH = 0000; KS = DB; KY = 000,011; KF = + 00000; KS = VS; KF = + 00032; KS = , 5 KF + 00000; KS VM: KY = 000,011; KS = PROCESS NAME; KY 000,022; KS = *V-WR'; KF = + 00100; KH = 0000; KS = * DB; KY 000,010; KF = + 00005; KS = ys KF + 00000; KS nN KF = + 00000; KS = VM: KY 000,016; KS "PROCESS PARAMETERS; KY = 255,255; KS = TF_EDIT; 11-29 Volume 2Example Programs B8976008/1 FB 10 B:BSPC@@ST.S5D LEN= 50 PAGE 1 SEGMENT 1 0000 NAME :VAR-DIE Variables services of client 0005 : see also: 0006 TF instructions for $5; 0007 1.1.4 Variables Services 0008 : 0009 A F 14.0 The current process name can be 000A RF 14.0 read using flag bit 14.0; 000B : the bit is set to 1 here; 000c DB11 from DWO onwards o00D Start the READ VAR service OOOE : OOOF JU FB 180 Read process name from server 0010 NAME : SEND 0011 SSNR: KY0,0 0012 A-NR : KY 0,1 0013 ANZW: FW 100 Specify in configuration 0014 QTYP: KS DB 0015 DBNR- : KY 0,20 0016 QANF: KF +1 Taken from configuration 0017 QLAE: KF +19 Taken from configuration 0018 PAFE : FY 106 0019 001A : 001B AF 14.1 The current process parameters 001C ROOF 14,1 can be written using flag bit 14.1. 001D : O01E 0O01F Start the WRITE VAR service 0020 : 0021 JU FB 180 Write parameters in server 0022 NAME :SEND 0023 SSNR_: KY 0,0 0024 A-NR KY 0,1 0025 ANZW : FW 100 0026 QTYP: KS DB 0027 DBNR: KY 0,20 0028 QANF: KF +21 Taken from configuration 0029 QLAE: KF +21 Taken from configuration 002A PAFE : FY 106 002B : 002C BE Volume 2 11 - 30B8976008/1 OB 1 B:BSPC@@ST.S5D SEGMENT 7 0000 0000 : 0001 JU FB 184 0002 NAME = :CONTROL 0003 SSNR_: KY 0,0 0004 A-NR : KY 0,1 0005 ANZW : FW 100 0006 PAFE : FY 106 0007 : 0008 0009 000A 000B o00c : 000D JU FB 10 OOOE NAME:VAR-DIEN OOOF : 0010 10 F 00 0011 ON F 0.0 0012 : 0013 :JU FB 180 0014 NAME:SEND OO15SSNR_: KY 0,0 0016 A-NR : KY 0,0 0017 ANZW: FW 110 0018 QTYP : KS NN 0019 DBNR: KY0,0 OO1A QANF: KF +0 001B QLAE: KF +0 001C PAFE: FY 114 001D : OO1E OO F 00 001F (ON F 0.0 0020 : 0021 0022 : 0023 JU FB 181 0024 NAME:RECEIVE 0025 SSNR : KY 0,0 0026 A-NR : KY 0,0 0027 ANZW : FW 115 0028 ZTYP : KS NN 0029 DBNR _ : KY 0,0 002A ZANF : KF +0 002B ZLAE : KF +0 002C PAFE: FY 119 002D : 002E BE Example Programs LEN= 52 PAGE 1 Check the PLC-PLC link Transfer the job buffer for receiving the process name or for sending the process parameters to the CP; depends on FY14 SEND ALL for the background communication RECEIVE ALL for the background communication 41-31 Volume 2Example Programs OB 20 B:BSPC@@ST.S5D SEGMENT 1 0000 0000 : 0001 JU FB 185 0002 NAME :SYNCHRON 0003 SSNR : KY 0,0 0004 BLGR : KY 0,0 0005 PAFE : FY 2 0006 : 0007 BE OB 21 B:BSPC@@ST.S5D SEGMENT 1 0000 0000 : 0001 JU FB 185 0002 NAME :SYNCHRON 0003 SSNR: KY 0,0 0004 BLGR: KY0O,0 0005 PAFE : FY 2 0006 : 0007 BE B8976008/1 LEN= 13 PAGE 1 LEN= 13 PAGE 1 Volume 2 11 - 32B8976008/1 Example Programs OB 22 B:BSPC@@ST.S5D LEN= 13 PAGE 1 SEGMENT 1 0000 0000 : 0001 JU FB 185 0002 NAME = :SYNCHRON 0003 SSNR_: KY 0,0 0004 BLGR KY 0,0 0005 PAFE FY 2 0006 : 0007 BE 11-33 Volume 2Example Programs 889 76008/1 PLC program on the server DB10 B:BSP1S@ST.S5D LEN= 21 /4 PAGE 1 0: KF = +00000; Process value 1 (default values) 1: KF = + 00000; \=\ 2 2: KF = +00000; \=\ 3 3: KF = +00000; \=\ 4 4: KF = + 00000; \=\ 5: KF = + 00500; Update factor 6: KF = + 00100; Process upper limit 1 7: KF = +00110; \=\ 2 8: KF = +00120; \=\ 3 9: KF = +00130; \=\ 4 10: KF = +00140; , \=\ 5 It: KF = -00140; Process lower limit 1 12: KF = -00130; \=\ 2 13: KF = -00120; \=\ 3 14: KF = -00110; \e\ 4 15: KF = -00100; \=\ 5 16: Volume 2 11 - 34B8976008/1 Example Programs DB11 B:BSP1S@ST.S5D LEN=21 /4 11 PAGE 1 0: KS = sawtooth function ; 32 ASCI! characters 12: KS =' ; are available for the process name 16: DB20 B:BSP1S@ST.S5D LEN=23 /20 PAGE 1 0: KH = o0o0oD; 1: KS = "V-IN'; 3: KF = +00100; 4: KH = 0000; 8: KS = VB; 6: KY = 000,011; 7: KS = PROCESS VALUE; 13: KH = FFFF; 14: KS = TF_EDIT; 18: PB 10 B:BSP1S@ST.S5D LEN= 11 PAGE 1 SEGMENT 1 0000 0000 : Jump block that calls the 0001 : simulation blocks. 0002 JU FB 10 0003 NAME :SIMUL1 0004 : 0005 BE 11-35 Volume 2Example Programs B8976008/1 FB 10 B:BSP1S@ST.S5D LEN= 107 PAGE 1 SEGMENT 1 0000 NAME SIMUL1 Sawtooth function 0005 : 0006 C DB 10lnitialize current DB 0007 : 0008 :L KH 0005 5 processes to be simulated; 000A T FW 10 fixed value! 000B : 000c L DW 5 Test, whether FW 12 is in o000D -L FW 12 valid area 0O0E i<F FW12 update factor 000F JC =MO010 0010 L KH 0000 0012 i> =F FW12 = 0 (not negative value) 0013 JC =M020 0014 : 0015 M010 L DW Initialization 0016 T FW 12 - Load update factor in FW 12 0017 L KH 0000 - Preset process values with 0 0019 7T DW O OO1A 7T DW 1 001B T DW 2 001C T DW 3 001D T DW 4 001E 001F : 0020 Mo20 L FW 12 Scan whether update factor 0021 L_ KH 0000 is already 0: 0023 I> F =0-> update process values 0024 JC =M030 l= O-> decrement update factor 0025 : 0026 : 0027 -L DW O Update process 1 0028 ADD KF +2 Add constant value 002A -L DW 6 Process upper limit (PU) 002B TAK o02c i> = F PU reached? 002D JC =M040 OO2E 7-L DW 11 Process lower limit (PL) 002F M040 7T DW 0 Update process value 0030 : 0031 :-L DW i Update process 2 0032 ADD KF +4 Add constant value 0034 -L DW 7 Process upper limit (PU) 0035 TAK 0036 i> =F PU reached? 0037 JC =M041 0038 :L DW 12 Process lower limit (PL) 0039 M041 T DW 1 Update process value Volume 2 11 - 36B89 76008/1 Example Programs 003B -L DW 2 Update process 3 003C ADD KF +5 Add constant value 0O3E -L DW 8 Process upper limit (PU) 003F TAK 0040 D> =F PU reached? 0041 JC =M042 0042 -L DW 13 Process lower limit (PL) 0043 M042 7T DW 2 Update process value 0044 : 0045 L DW 3 Update process 4 0046 ADD KF +7 Add constant value 0048 L DW 9 Process upper limit (PU) 0049 TAK 11-37 Volume 2Example Programs B8976008/1 FB 10 B:BSP1S@ST.S5D LEN= 107 PAGE 2 004A i> = F PU reached?? 004B JC = M043 004C -L DW 14 Process lower limit (PL) 004D M043 7T DW 3 Update process value 0O4E : 0O4F lL DW 4 Update process 5 0050 ADD KF +9 Add constant value 0052 -L DW 10 Process upper limit (PU) 0053 TAK 0054 >= F PU reached? 0055 WC = M044 0056 <L DW 15 Process lower limit (PL) 0057 M044 TT DW 4 Update process value 0058 : 0059 : OOSA iL DW 5 Update the update factor 005B T FW 12 005C JU = ENDE 005D : OO5SE : OOSF M030 L FW 12 Decrement update factor 0060 ADD KF -1 0062 T FW 12 0063 : 0064 : 0065 ENDE :BE Volume 2 11 - 38B8976008/1 FB 11 B:BSP1S@ST.S5D SEGMENT 1 0000 NAME :MELDEN 0005 : 0006 JU FB 120 0007 NAME :SEND 0008 SSNR: KY0,0 0009 A-NR KY 0,1 OOOAANZW SS: FW 100 OOOB QTYP: KS DB Current PLC link 000C DBNR: KY 0,20 OOOD QANF : KF +1 OOOE QLEN: KF +12 OOOF PAFE : FY 106 0010 : 0011 BE OB 1 B:BSP 1S@ST.S5D SEGMENT 1 0000 0000 : 0001 : 0002 JU PB 10 0003 : 0004 (0 F 00 0005 (ON F 0.0 0006 : 0007 JC FB 11 0008 NAME :INDIC 0009 : OOOA (0 F 0.0 000B (ON F 0.0 000C : o00D JU FB 126 OOOE NAME :SEND-A OOOF SSNR : KY 0,0 0010 A-NR : KY 0,0 0011 ANZW : FW 110 0012 PAFE FY 114 0013 : 0014 (0 F 0.0 0015 ON F 0.0 0016 : 0017 JU FB 127 0018 NAME :REC-A 0O19SSNR : KYO 0 001A A-NR : KYO 001B ANZW FW 115 Example Programs LEN= 23 PAGE 1 Send "INDICATE" job buffer 5 process values are transferred in two words LEN= 36 PAGE 1 Jump file to call the simulation Cyclic indication of process data to the PLC remote partner (RLO = 1) SEND ALL for transferring the process data RECEIVE ALL for receiving process parameters from the remote partner 11-39 Volume 2Example Programs B8976008/1 QO1iC PAFE: FY 119 001D : OO1E BE OB 20 B:BSP1S@ST.S5D LEN= 13 PAGE 1 SEGMENT 1 0000 0000 : Synchronization PLC-CP 0001 JU FB 125 0002 NAME :SYNCHRON 0003 SSNR_: KY 0,0 0004 BLGR : KY 0,0 0005 PAFE : FY 2 0006 : 0007 BE OB 21 B:BSP1S@ST.S5D LEN= 13 PAGE 1 SEGMENT 1 0000 0000 ; 0001 JU FB 125 0002 NAME :SYNCHRON 0003 SSNR __ : KY 0,0 0004 BLGR_: KY 0,0 0005 PAFE : FY 2 0006 : 0007 BE OB 22 B:BSP1S@ST.SD LEN=13 PAGE 1 SEGMENT 1 0000 0000 : 0001 JU FB 125 0002 NAME :SYNCHRON 0003 SSNR_: KY 0,0 0004 BLGR :: KY 0,0 0005 PAFE : FY 2 0006 : 0007 BE Volume 2 11 - 40B89 76008/1 Example Programs 11.2.8 Starting Up To start up, the configuration data must be transferred to the PLCs. Use the following functions: > Transfer | Transfer database for the files PBSPL.CLT -> client PLC and PBSPL.SRV -> server PLC > The load function under SSDOS-KOMI to transfer the PLC data base created with the REQUEST-EDITOR. 11.2.9 Monitoring the Process at the PG To monitor the process, the PG must be online with the CPU of the client. This connection can be established by the AS 511 interface or via the SINEC H1 bus. Using the function "FORCE VAR", you can monitor the current process values and the status of the link (status word). In addition to this, you can also read the process name and write the process parameters. FW 100 Status word for the job (job number 1) FW 102 Length word for this job FW 104 TF error number, if a TF error occurs FY 14 BitQ Read the process name Bit1 Write the process parameters DB 10 DW 0 to 4 Current process values from the server DW 5 to 15 Process parameters transferred to the server DB 11 DW 0 to 15 After reading, the process name is stored here 11 - 41 Volume 2Example Programs B89 76008/1 11.3. Example 2: Using the Domain and Program Invocation Services The server PLC program written for the first example can be used in modified form in the second example. First, the additional tasks are explained. 11.3.1 Task for the Domain Services The task The server PLC simulates a certain process response by incrementing process values on the PLC with a selectable rate of rise until a certain limit value is reached (sawtooth function). It is now assumed that a different manufacturing process with a different process response is to be monitored. This process response is a continuous rise and fall in the process values (delta function). The PLC program must therefore be able to change its simulated process response when requested to. The solution The solution to this task is provided by the domain services. They permit loadable program sections to be defined. Implementation The program developed in the first example for the server PLC is extended by a further simulation in the second example. The program and data sections responsible for the sawtooth are taken out and copied. The copy is changed so that a delta function is implemented. Loading and activating the simulation To be able to load and activate the required process simulation on the PLC, domain services are used. These are available under the program package PGLOAD on the programmer and can be activated in various screens. A PG is also connected to the system via a SINEC-H1 link and used as the host computer in the example. Volume 2 11 - 42B8976008/1 Example Programs 11.3.2 Tasks for the Program Invocation Services The task It must be possible to influence the running of the simulation program using the host. Certain status requests must be transferred to the PLC to the simulation program reacts with certain actions. The following program invocation (Pl) statuses are requested and the PLC must respond with the specified actions: > IDLE The simulation is not intended to run. This means that PB 10 must not be called > STARTING In this status, all process values must be set to the default (0). Following this, the transition is acknowledged positively. > RUNNING The simulation process is run without any restrictions. > STOPPING The simulation is to be stopped, the transition must be acknowledged. > STOPPED As IDLE > RESUMING As STARTING > RESETTING As Stopping The solution The program invocation services allow the process to be combined with a status. With these services, the status information can be transferred and the required actions triggered on the PLC. Implementation The program invocation services can be called directly using the PGLOAD package in various screens. The PG connected to the system via the 11-43 Volume 2Example Programs B8976008/1 SINEC H1 link is used to control the PLC simulation with the PGLOAD functions. Overview of the device configuration Monitoring device programmable logic contrcSiexver PLC Monitor process Process values Process names EEE Control process Process parameters KS K SINEC H1 PG as host and File server Fig. 11.17 Device Configuration in Example 2 Volume 2 11 - 44B89 76008/1 Example Programs 11.3.3 Preparing Programs and Data The sections of the program responsible for the simulation must be removed from the program file "BSP1S@ST.S5D" and stored in the file "SIMULIST.S5D". These involve the blocks: PB.10 call block FB 10 actual simulation DB 10 process values/process parameters DB 11 ~=process name. These four blocks must once again be contained In the program file "SIMUL2ST.S5D" that will contain the delta function, and FB 10 modified accordingly. The name is replaced by "DELTA FUNCTION". The program files "SIMUL1ST.S5D" and "SIMUL2ST.S5D" can be loaded alternatively as domains in the server station. All other blocks from the program file "BSP1S@ST.S5D" are transferred to the new program "BSP2S@ST.S5D". To integrate the program invocation services, a control sequence is programmed in FB 1 that allows a specific program section to be called depending on the status of the program invocation generated by the host computer. The status of the program invocation is scanned using FB 103 (FB PI-ZUSTD). If the invocation is to change to a different status, this can also be achieved with this block (acknowledgement). The following pages contain the blocks of the three program files that exist for the server in the second example. Notes on the restart blocks (OB 20, 21, 22). In contrast to the first example, when using the program invocation services in the cold restart branch (OB 20, 21), the biock for synchronization (FB SYNCHRON) must not necessarily be called. A new synchronization must only be carried out if the CP 143 is in the non-synchronized status. The CP status can also be scanned using FB PI-ZUSTD. In the warm restart branch, following power down, synchronization must always be carried out. 11 - 45 Volume 2Example Programs B8976008/1 The following diagram illustrates how the domain is taken from the original program file of the server PLC. - OB 1 JU FBI JU FB103 ~~ T valuate | status Pl status - UNRUNNABLE - IDLE - STOPPED fH - - -- Pl status - RUNNING Simul1ST.SsD ~ tes __ Simul1ST.Ss5D / Simul2ST.S5D 1 L_ utero a | ns 7 Simulation | ($ ra Se T | | Pl status | "STARTING 3 JC FB12 cR Set proceds vases to default values fame ee PI statu: STOPPING lurats ~~] JU FB103 7d Acknowledgement to Pl status request J JU FB11 MELDEN JU FB120 Start cyclic transfer of process data JU FB126 SEND ALL (transfer process data) JU FB127 neceive ALL Receive process parameters from remote partner or read name job) Fig. 11.18 Extracting the Domain from the Original Program File of the Server PLC Volume 2 11-46B8976008/1 DB20 B:BSP2S@ST.S5D 0: KH = OOOoD; 1: KS = "V-IN'; 3: KF = +00100; 4: KH = 0000; 5: KS = VB; 8: KY = 000,011; 7: KS = PROCESS VALUE; 13: KH = FFFF; 14: KS = TF_EDIT; 18: FB 1 B:BSP2S@ST.S5D SEGMENT 1 0000 NAME :CONTROL 0005 : 0006 A F 00 0007 AN F 0.0 0008 : 0009 OOOA 000B : 000c JU FB 103 000D NAME :P!-ZUSTD QOOE SSNR ES: KY 0,0 OOOF Q/ZT : KS FW 0010 DBNR: KYO,0 0011 Q/ZA : KF +60 0012 PAFE FY 62 0013 : 0014 A F 61.0 0015 JC = ENDE 0016 : 0017 A F 61.1 0018 JC = ENDE 0019 : OO1A AF 61.2 001B JC PB 10 001C : 001D A F 61.2 OO1E JC = ENDE 0O1F : 0020 A F 613 0021 JC = ENDE 0022 : 0023 AF 61.4 0024 : 0025 0026 Example Programs LEN= 23 /20 PAGE 1 LEN= 77 PAGE 1 RLO = 0; PI status scan See also: TF instructions for $5; 1.2.4.3 function block "PI-ZUSTD" (FB103) Status in FW60 PI status = UNRUNNABLE PI status = IDLE PI status = RUNNING Jump block for calling the simulation Pl status = STOPPED PI status = STARTING If the STARTING status is activated, the process data are preset with a 11 - 47 Volume 2Example Programs B8976008/1 0027 : fixed value. 0028 JC FB 12 0029 NAME :STARTING 002A A F 614 There is an acknowledgement 0028 : to the Pi status scan 002C JC FB 13 002D NAME:ACKNOWL 002E A F 61.4 002F WC = ENDE 0030 : 0031 A F 615 Pi status = STOPPING 0032 : There is an acknowledgement 0033 : to the PI status scan 0034 JC FB 13 0035 NAME:ACKNOWL 0036 A F 615 0037 JC = ENDE 0038 : 0039 A F 616 PI status = RESUMING 003A : There is an acknowledgement 003B : to the Pi status scan 003C JC FB 13 003D NAME:ACKNOWL 003E A F 616 003F JC = ENDE 0040 : 0041 AA F 61.7 PI status = RESETTING Volume 2 11-48B89 76008/1 Example Programs FB 1 B:BSP2S@ST.S5D LEN= 77 PAGE 2 0042 There is an acknowledgement 0043 : to the P| status scan 0044 JC FB 13 0045 NAME :ACKNOWL 0046 : 0047 ENDE :BE FB 11 B:BSP2S@ST.S5D LEN= 23 PAGE 1 SEGMENT 1 0000 NAME INDIC 0005 : Send "INDICATE" job buffer 0006 JU FB 120 0007 NAME :SEND 0008 SSNR_: KY 0,0 0009 A-NR KY 0,1 OOOA ANZW - s: FW 100 Specified in the configuration 000B QTYP: KS DB 000C DBNR : KY 0,20 000D QANF: KF +1 Taken from configuration OOOE QLAE: KF +12 Taken from configuration OOOF PAFE FY 106 0010 : 0011 BE FB 12 B:BSP2S@ST.S5D LEN=24 PAGE 1 SEGMENT 1 0000 NAME STARTING 0005 : Set process values to default 0006 : DB 10 0007 L KH 0000 0009 T DW 0 000A 7T DW 1 000B T DW 2 000c T DW 3 000D T DW 4 0O0E :L KF +500 0010 TT DW 5 0011 : 0012 BE 11 - 49 Volume 2Example Programs B8976008/1 FB 13 B:BSP2S@ST.S5D LEN= 23 PAGE 1 SEGMENT 1 0000 NAME ACKNOWL 0005 : 0006 (0 F 00 RLO = 1 0007 (ON F 0.0 0008 : Acknowledge PI status 0009 JU FB 103 000A NAME :PI-ZUSTD 000B SSNR: KY 0,0 000C Q/ZT : KS FW 000D DBNR: KY0,0 OQO0E Q/ZA KF + 60 OOOF PAFE FY 62 0010 : 0011 BE OB 1 B:BSP2S@ST.S5D LEN= 38 PAGE 1 SEGMENT 1 0000 0000 : 0001 There is no evaluation 0002 : of the Pl statuses 0003 JUFB 1 0004 NAME = :CONTROL 0005 : 0006 10 F 0.0 There is no cyclic indication 0007 (ON F 0.0 of process data to the PLC 0008 : remote partner (RLO = 1) 0009 JU FB 11 000A NAME ~ :INDIC 000B : o00c (0 F 0.0 SEND ALL for transferring the 000D (ON F 00 process data OOOE : OOOF JU FB 126 0010 NAME :SEND-A 0011 SSNR _: KY 0,0 0012 A-NR : KY 0,0 0013 ANZW: FW 115 0014 PAFE FY 119 0015 : 0016 (0 F 00 RECEIVE ALL for transferring 0017 ON F 0.0 process parameters of 0018 : the remote partner 0019 JU FB 127 OO1A NAME :REC-A OO1BSSNR_: KY 0,0 Volume 2 11 - 50B89 76008/1 Example Programs 001C A-NR KY 0,0 001D ANZW: FW 120 001E PAFE : FY 124 OO1F : 0020 BE OB 20 B:BSP2S@ST.S5D LEN= 27 PAGE 1 SEGMENT 1 0000 0000 : 0001 AF 0.0 RLO = 0; PI status scan 0002 AN F 0.0 0003 : 0004 JU FB 103 0005 NAME - :PI-ZUSTD 0006 SSNR : KY 0,0 0007 Q/ZT KS FW 0008 DBNR KY 0,0 0009 Q/ZA KF + 60 OQO0A PAFE FY 62 000B : 000c A F 606 Scan CP status 000D A F 60.7 - not synchronized OOOE : OOOF JC FB 125 0010 NAME :SYNCHRON 0011 SSNR : KY 0,0 0012 BLGR KY 0,0 0013 PAFE FY 2 0014 : 0015 BE OB 21 B:BSP2S@ST.S5D LEN= 27 PAGE 1 SEGMENT 1 0000 0000 : 0001 A F 0.0 RLO = 0; PI status scan 0002 AN F 0.0 0003 : 0004 JU FB 103 0005 NAME _ :PI-ZUSTD 0006 SSNR_: KY 0,0 0007 Q/ZT : KS FW 0008 DBNR: KY 0,0 0009 Q/ZA : KF +60 OQO0A PAFE FY 62 11-51 Volume 2Example Programs 000B : o00c AA F 606 o00D AF 60.7 OOOE : OOOF JC FB 125 0010 NAME :SYNCHRON 0011 SSNR : KY 0,0 0012 BLGR : KY 0,0 0013 PAFE : FY 2 0014 : 0015 BE Scan CP status - not synchronized B8976008/1 Volume 2 11 - 52B8976008/1 Example Programs OB 22 B:BSP2S@ST.S5D LEN=13 PAGE 1 SEGMENT 1 0000 0000 Synchronization PLC-CP 0001 JU FB 125 0002 NAME :SYNCHRON 0003 SSNR_ : KY 0,0 0004 BLGR_ SS: KY 0,0 0005 PAFE : FY 2 0006 : 0007 BE Simulation of the sawtooth function: DB10 B:SIMUL1ST.S5D LEN= 21 /4 PAGE 1 0: KF = + 00000; Process value 1 (Default values) 1: KF = + 00000; \=\ 2 2: KF = + 00000; \=\ 3 3: KF = + 00000; \e\ 4 4: KF = + 00000; \e\ 5 5: KF = + 00500; Update factor 6: KF = + 00100; Process upper limit 1 7: KF = + 00110; \=\ 2 8: KF = + 00120; \=\ 3 9: KF = + 00130; \=\ 4 10: KF = + 00140; \=\ 5 11: KF = - 00140; Process lower limit 1 12: KF = - 00130; \=\ 2 13: KF = - 00120; \e\ 3 14: KF = - 00110; \=\ 4 15: KF = - 00100; \=\ 5 16: DB11 B:SIMUL1ST.S5D LEN= 21 /4 PAGE 1 0 :KS = Sawtooth function '; 32 ASCII characters are 12 KS = ' . available for the process name 16: 11-53 Volume 2Example Programs B8976008/i PB 10 B:SIMUL1ST.S5D LEN=11 PAGE 1 SEGMENT 1 0000 0000 : Jump biock that calls the 0001 : simulation blocks. 0002 :JUFB 10 0003 NAME - :SIMUL1 0004 Do 0005 BE FB 10 B:SIMUL1ST.S5D LEN=107 PAGE 1 SEGMENT 1 0000 NAME SIMUL1 Sawtooth function 0005 : 0006 : DB 10 Initialize current DB 0007 : 0008 :L . KH 0005 5 processes to be simulated; 000A T FW 10 fixed value! 000B : 000C lL DW 5 Test whether FW12 is in o0o00D LFW 12 valid area OOOE i<=F FW12 update factor OOOF JC =M010 0010 :L KH 0000 0012 i>=F FW12 = 0 (not negative value) 0013 JC =M020 0014 : 0015 M010 -L DW 5 Initialization 0016 T FW 12 - Load update factor in FW12 0017 kL KH 0000 - Preset process values with 0 0019 T DW 0 OO1A T DW 1 001B T DW 2 001C T DW 3 001D T DW 4 0O1E 001F : 0020 M020 L FW 12 Scan whether the update factor 0021 :L KH 0000 is already 0: 0023 i>=F = 0 - update process values 0024 JC = M030 != 0 - decrement update factor 0025 : 0026 : 0027 -L DW O Update process 1 0028 ADD KF +2 Add constant value 002A i DW 6 Process upper limit (PU) 002B TAK 002C i> =F PU reached? Volume 2 11 - 54B8976008/1 002D 002E 002F M040 0030 0031 0032 0034 0035 0036 0037 0038 0039 M041 003A 003B 003C 003E 003F 0040 0041 0042 0043 M042 0044 0045 0046 0048 0049 JC =M040 -L DW 11 T DW O -L DW 1 ADD KF +4 -L DW 7 TAK i> =F :JC =M041 :L DW 12 T DW 1 L DW 2 ADD KF +5 :L DW 8 [TAK > =F JC =M042 -L DW 13 TT DW 2 :-L DW 3 ADD KF +7 :-L DW 9 TAK Process lower limit (PL) Update process value Update process 2 Add constant value Process upper limit (PU) PU reached? Process lower limit (PL) Update process value Update process 3 Add constant value Process upper limit (PU) PU reached? Process lower limit (PL) Update process value Update process 4 Add constant value Process upper limit (PU) Example Programs 11-55 Volume 2Example Programs B8976008/1 FB 10 B:SIMUL1ST.S5D LEN= 107 PAGE 2 004A iDe F PU reached? 004B JC = M043 004C -L DW 14 Process lower limit (PL) 004D M043. :T DW 3 004E : 004F i DW 4 0050 ADD KF +9 0052 7L DW 10 0053 TAK 0054 D> = F 0055 JC = M044 0056 L DW 15 0057 M044 T DW 4 0058 : Update process value Update process 5 Add constant value Process upper limit (PU) PU reached? Process lower limit (PL) Update process value 0059 : OOSA -L DW 5 Update update factor 005B T FW 12 005C JU = ENDE 005D : 0O5E : OO5F M030 L FW 12 Decrement update factor 0060 ADD KF -1 0062 T FW 12 0063 : 0064 : 0065 ENDE :BE Volume 2 11 - 56B8976008/1 Simulation of the delta function Example Programs DB1i0 B:SIMUL2ST.S5D LEN= 21 /4 PAGE 1 OQ: KF = + 00000; Process value 1 (Default values) 1: KF = + 00000; \=\ 2 2: KF = + 00000; \F\ 3 3: KF = + 00000; \=\ 4 4: KF = + 00000; \=\ 5 5: KF = + 00500; Update factor 6: KF = + 00100; Process upper limit 1 7: KF = + 00110; \=\ 2 8: KF = + 00120; \=\ 3 9: KF = + 00130; \=\ 4 10: KF = + 00140; \=\ 5 11: KF = -00140; Process lower limit 1 12: KF = -00130; \e\ 2 13: KF = -00120; \=\ 3 14: KF = -00110; \=\ 4 15: KF = -00100; \=\ 5 16: DB11 B:SIMUL2ST.S5D LEN= 21 /4 PAGE 1 0: KS = Delta function; 32 ASCII characters are available 12: KS = 5 for the process name 16: PB 10 B:BSIMUL2ST.S5D LEN= 11 PAGE 1 SEGMENT 1 0000 0000 : Jump block that caused the 0001 : simulation blocks 0002 JU FB 10 0003 NAME ~ :SIMUL2 0004 : 0005 BE FB 10 B:SIMUL2ST.S5D LEN=166 PAGE 1 SEGMENT 1 0000 NAME SIMUL2 Delta function 0005 : 0006 : DB 10 0007 : 0008 iL KH 0005 Initialize current DB 5 processes to be simulated; 11-57 Volume 2Example Programs B8976008/1 OCO0A T FW 10 fixed value! 000B : o000c -L DW 5 Test whether FW12 is in oo0D LFW 12 valid area OOOE L<F FW12 > update factor OOOF JC =MO10 0010 L. KH 0000 0012 i>=F FW12 = 0 (not negative value) 0013 JC =M020 0014 : 0015 M010 L DW Initialization 0016 T FW 12 - Load update factor in FW 12 0017 L KH 0000 - Preset process values with 0 0019 T DW O 001A 7T DW 1 001B T DW 2 001C T DW 3 001D T DW 4 001E 001F : 0020 M020 L FW 12 Scan whether the update factor 0021 :L KH 0000 is already 0: 0023 i> F = 0 - update process values 0024 JC =MO030 != 0 - decrement update factor 0025 : 0026 : 0027 M021 L DW 0 Update process 1 0028 AN F 14.0 Rising or falling edge? 0029 JC = M040 = 0 - process value falling 002A : = 1 - process value rising 002B ADD KF +2 Add constant value 002D L DW 6 Process upper limit (PU) 002E i<=F PU reached? 002F JC =M041 0030 -R_ F 14.0 From here, failing edge 0031 :L DW 0 0032 M040 ADD KF -2 Subtract constant value 0034 -L DW 11 Process lower limit (PL) 0035 i> F PL reached? 0036 JC =M041 0037 F 140 From here, rising edge 0038 JU =MO021 0039 M041 TAK Update process value 003A TT DW 0 0038 : 003C : 003D M022 -L DW 1 Update process 2 003E AN F 14.1 Edge rising or falling? 003F JC =M042 = 0 - process value falling 0040 : = 1 - process value rising 0041 ADD KF +4 Add constant value Volume 2 11 - 58B8976008/1 0043 :L DW 7 0044 i<=F 0045 WC =M043 0046 ROOF 14.4 0047 lL DW 1 0048 M042 ADD KF -4 Example Programs Process upper limit (PU) PU reached? From here, falling edge Subtract constant value LEN= 166 PAGE 2 Process lower limit (PL) PL reached? From here, rising edge Update process value Update process 3 Edge rising or falling? = 0 - process value falling = 1 - process value rising Add constant value Process upper limit (PU) PU reached? From here, falling edge Process lower limit (PL) PL reached? From here, rising edge Update process vaiue Update process 4 Edge rising or falling? = 0 - process value falling = 1 - process value rising Add constant value Process upper fimit (PU) PU reached? From here, falling edge FB 10 B:SIMUL2ST.S5D OO4A :-L DW 12 004B t>F 004C JC = M043 004D SF 14.1 004E JU = M022 004F M043 TAK 0050 7T DW 1 0051 : 0052 : 0053 M023 -L DW 2 0054 AN F 14.2 0055 :JC = M044 0056 : 0057 ADD KF +5 0059 -L DW 8 OO5A 1<=F 005B JC = M045 005C RF 14.2 005D L DW 2 OO5E M044 :ADD KF -5 Subtract constant value 0060 iL DW 13 0061 i> F 0062 JC =M045 0063 SS F 14.2 0064 JU = M023 0065 M045 TAK 0066 T DW 2 0067 : 0068 : 0069 M024 :-L DW 3 OO6A AN F 14.3 006B JC =M046 006C : 006D ADD KF +7 OO6F :-L DW 9 0070 <= F 0071 JC = M047 0072 R F 143 0073 :-L DW 3 0074 M046 ADD KF -7 Subtract constant value 11 - 59 Volume 2Example Programs B8976008/1 0076 -L DW 14 Process lower limit (PL) 0077 t>F PL reached? 0078 JC = M047 0079 SS F 143 From here, rising edge 007A JU = M024 007B M047 [TAK Update process value 007 7T DW 3 007D : 007E : 007F M025 lL DW 4 Update process 5 0080 AN F 14.4 Edge rising or falling? 0081 JC = M048 = 0 - process value falling 0082 : = 1 - process value rising 0083 ADD KF +9 Add constant value 0085 -L DW 10 Process upper fimit (PU) 0086 <=F PU reached? 0087 JC = M049 0088 ROOF 14.4 From here, falling edge 0089 7L DW 4 008A M048 ADD KF -9 Subtract constant value 008C -L DW 15 Process lower limit (PL) 008D i> F PL reached? 008E JC = M049 0O8F F 14.4 From here, rising edge FB 10 B:SIMUL2ST.S5D LEN= 166 PAGE 3 0090 JU = M025 0091 M049 TAK Upate process value oos2 T DW 4 0093 : 0094 : 0095 L DW 5 Update update factor 0096 T FW 12 0097 JU =ENDE 0098 : 0099 : 009A M030 -L FW 12 Decrement update factor 009B ADD KF -1 009D T FW 12 009E : 0O9F : OOAO ENDE :BE Volume 2 11 - 60B8976008/1 Example Programs 11.3.4 Executing Domain and PI Services The server PLC is set to STOP at the PG and an overall reset carried out. The file "BSP2S@ST.S5D" is transferred to the server PLC. In this status, no domain is loaded and no program invocation created. Monitoring the processes As described in the first example, the process is monitored at a PG connected ONLINE to the client station. From the process values (e.g. whether or not they change) you can recognize the current status of the process in the server. By reading the process name, you can also determine which process is currently loaded. As in the first example, you can preset the process parameters. Loading domains, handling the program invocation As already explained, a PG serves as the host to be able to manipulate domains and Pls. In the server PLC, an AS 511 cable connection between the CP 143 and PLC-CPU must be established ("swing cable"). The "PGLOAD" package is started on the host PG equipped with a SINEC H1 interface module In the initialization screen form, you specify the name of a file containing the information about the PG link to the required PLC (in this case "SERVERCP.LOD") After selecting the function PGLOAD | PLC Links, you can input the Ether- net address of the server PLC. The additional name of the link allows you to display the currently selected PLC link in the PGLOAD package. 11-61 Volume 2Example Programs B8976008/1 After storing the information with "OK" (F7) and pressing F1, you return to the basic screen. PGLOAD LINK CONFIGURATION / PLC SELECTION CP 143 (END) LINK NAME : SERVER REMOTE ETHERNET ADDRESS: 080006018030 F | __|F[ |F[ lel JF J) F[ tal | FI ] H 2 3 4 5 6 7 OK g SELECT Fig. 11.19 PGLOAD Link Configuration / Select PLC Volume 2 11 - 62B8976008/1 Example Programs Generating loadable domains Before an S5-DOS program file can be transferred to the PLC using the domain services, a load file must first be generated. To do this, select the function PGLOAD | Transfer Functions. In the next screen form, you enter the name of the local $5-DOS program file (SIMUL1ST.S5D) from which the load file is generated with "CREATE" (F4). PGLOAD CP 143 (END) TRANSFER FUNCTIONS SINEC NCM DEST STATION (FILE SERVER): SINEC NCM SERVER FILE : LOCAL S5 PROGRAM FILE : DR: B NAME: SIMUL1 ST.SSD COMMENT : F | jr [ JF | je[ jF[ J F[ J FI ] F [_HELP H 2 VARIABLES 3 SEND 4 CREATE 5 FETCH 6 SSFILCR 7 SERVER g SELECT Fig. 11.20 PGLOAD Transfer Functions Follow the same procedure with the file SIMUL2ST.S5D. Generating load files produces files with the names "SIMUL1ST.DOM" or SIMUL2ST.DOM" on the local drive. The program files remain unchanged. When you exit the screen form with "RETURN" you retum to the main menu. 11-63 Volume 2Example Programs B8976008/1 Loading domains Now select the function PGLOAD | Host computer functions. By pressing PLC LOAD in the currently displayed screen, call the screen PGLOAD LOAD PLC. Firstly, the file "SIMUL1ST.S5D" should be loaded as a domain in the server station. Enter the following parameters: "PG" as the server link: this means that the load file exists on the PG and will be loaded from the PG to the PLC. The name of the domain on the server station will be "SAWTOOTH". As file name, use the name of the local program file (not the name of the load file), i.e. "SIMUL1ST.S5D". The other input fields remain unchanged or empty. PGLOAD CP 143 (END) LOAD PLC SINEC NCM PLC LINK: SERVER SERVER LINK: PG PROGRAM (DOMAIN) : SAWTOOTH STORED IN FILE : B: SIMUL1ST.S5D PARAMETERS (DOMAIN) : STORED IN FILE : CPU NO:1 F | JF | JF l Jef JF [ Jel JF FL. Hu 2 3 4 5 6 7 OK 8 SELECT Fig. 11.21 PGLOAD Load PLC Volume 2 11 - 64B8976008/1 Example Programs If you press the "OK" key (F7), the file is transferred to the PLC as a domain. If you press "RETURN" (F8) you exit the screen form and return to the screen PGBLOAD HOST COMPUTER FUNCTIONS: With this screen displayed, you can control the system by selecting the required program statuses and transferring them to the PLC. The reaction of the process simulated on the PLC can be monitored using the displays on the monitoring device. The function keys and their significance in controlling the example process are described below. In this screen (PGLOAD HOST COMPUTER FUNCTIONS), the function keys have the following effects: F3 Domains on the PLC are deleted. PLC DELETE F4 Depending on the PLC mode, a program invocation (PI) is re SrAany created or deleted. If you delete a Pl, the PLC changes to the STOP mode. If you create a Pl, the PLC changes to the RUN mode, the Pl is in the IDLE status. After creating a PI, process parameters can be set by the client PLC or the process name can be read. The process values are indicated by the server to the client, however, since the process has not yet started, the process values do not change. 11-65 Volume 2Example Programs B89 76008/1 F5 The PI is changed to the STARTING status. The PLC PROGRAM program in the server sets the process values to the default, START acknowledges the STARTING or RESUMING status and the process begins. This can be monitored at the PG of the CLIENT station. The Pl is then in the RUNNING status. F6 The Pl is changed to the STOPPING status. The PLC PROGRAM program in the server acknowledges this transition STOP immediately and the PI changes to the STOPPED status. This can be monitored at the client, since the process values no longer change from this point onwards. F7 Using this key, you can select the next link in the link file Sureor (SERVER CP.LOD). Since there is only one link in this example, the key does not have any effect. You can press keys F5 and F6 alternately. The process is then started and stopped alternately. When the process is stopped, you can delete the PI with F4. After this, the domain can then be deleted with F3 and the other simulation (e.g. "DELTA") can be loaded. Volume 2 11-66B8976008/1 Example Programs 11.4 Example 3: Transparent Data Exchange with Acknowledgement (T-DQ) The task You want to exchange data without checking the transfer and without transmitting structural information as simply as possible within a SIMATIC network In concrete terms, in this example 18 data words are transferred from PLC 1 DX 10 to PLC2 DB 20 and in the opposite direction (acknowledgment) 7 data words from PLC 2 DB 21 to PLC 1 DX 11. The solution The Transparent data exchange services allow data transfer under such conditions. Implementation: "Transparent data exchange with acknowledgment" (TDQ) This communications service transfers data from the client to a server and from the server to the client in the acknowledgement. CLIENT SERVER Ln | | _Communications system SINEC Hi Fig. 11.22 Transparent Data Exchange with Acknowledgment 11 - 67 Volume 2Example Programs B8976008/1 Using the configuration too! The following example illustrates the configuration steps required. To configure this service, you require the two software packages COM 143, TF editor and LAD, CSF, STL" which are started on the PG 685 or PG 675 under S5-DOS. Within COM 143 TF, the Request Editor is also used when creating job buffers. COM 143 TF Using COM 143, you assign the station address to the CPs and set up an application association (logical link layer 7) between CP 1 and CP 2 (layer 4 is also possible). Request Editor With the Request Editor, you create the job buffer T-DQ for the client. S5DOS-KOMI Using the transfer functions of SSDOS-KOMI you transfer the job buffer from the PG to the client (PC 1) and write a user program with handling blocks in the client (PLC1) and in the server (PLC2) that triggers the job and transfers the data between the CP and PLC. The values used for this example can be found in Fig. 11.33. Volume 2 11-68B89 76008/1 Example Programs Configuration procedure +h To configure the "transparent data exchange service", proceed as follows: 1. With the COM 143 package > Set up station address (6 bytes long Ethernet address) in both CP 1 and CP 2 if this does not yet exist. (Here you require the online mode) Menu: Edit -> CP basic initialization (CP in STOP status) > Set up application association (logical link layer 7a) from CP 1 to CP 2. Menu: Edit-> Links-> Appl. Associations Link block for client (CP1) Enter the following parameters in the screen form: - SSNR (same as SSNR of SYNCHRON in PLC 1) - ANR. (only use odd job numbers) - ANZW (FW, occupies three words) - LOCAL TSAP (CLIE T-DQ) - EST TYPE (A7) CP 1 activates the connection establishment - MUX ADDRESS (0 = no multiplexing) REMOTE TSAP (SERV T-DQ) ~ APPL. ASS. NAME (only for information) - REMOTE ETHERNET ADDRESS _ ( address of CP 2) - NUMBER OF APPL. ASS. FOR CURRENT TSAP (see also VOLUME 2 Configuring Application Associations") Link block for server (CP2) Enter the following parameters in this screen form: - SSNR (same as SSNR of SYNCHRON in PLC 2) ANR. (only use odd job numbers) - ANZW (FW, occupies three words) - LOCAL TSAP (SERV T-DQ) - EST TYPE (P7) - MUX ADDRESS (0 =no multiplexing) - REMOTE TSAP (CLIE T-DQ) 11-69 Volume 2Example Programs B89 76008/1 - APPL. ASS. NAME (only for information) REMOTE ETHERNET ADDRESS (address of CP 1) NUMBER OF APPL. ASS. FOR CURRENT TSAP (see also VOLUME 2 "Programming Application Associations") 2. With the TF editor package Set up the job buffer T-DQ for the CLIENT (PLC 1) as follows: Load the Request Editor and specify the program file in the initial screen form and select the data block. Menu: Tools -> Request editor -> Init -> Create job buffer Select transparent data exchange and enter the following parameters: source address (data block) source length (length of the useful data) dest. address (data block) dest. length (length of the useful data) After you have input the data, press OK. A job buffer is set up, that you must load in PLC 1 (the CLIENT). Transfer this data block with LAD, CSF, STL. 3. With LAD, CSF, STL > For PLC 1 (CLIENT) Note: Program OB 20, OB 21, OB 22, SYNCHRON block if they do not yet exist (see VOLUME 1) Transfer the job buffer you created with the TF editor to PLC 1. Program SEND DIRECT, that transfers the job buffer to the CP. Use the job number (ANR) you selected in the link block for CP 1. Program RECEIVE ALL and SEND ALL that transfer the data be- tween the CP and PLC. The data block for the data source and for the data destination must exist. Volume 2 11-70B8976008/1 Example Programs > For PLC 2 (SERVER) ih - Program OB 20, OB 21, OB 22, SYNCHRON block if they do not yet exist (see VOLUME 1). Program RECEIVE DIRECT that transfers the receive job to the CP. Select job number ANR+1, as selected in the link block for CP 2. In this standard function block, you specify the S5 address of the desti- nation data block. In the destination data block, you must enter a job header consisting of three words. DEST DATA BLOCK Word 0 Service ID:B001h Word 1 Reserved Word 2 Length of the useful data Word 3 Data - Program SEND DIRECT that transfers the acknowledgement to the CP. Select job number ANR+1 as selected in the link block for CP 2. In this standard function block, you specify the S5 address of the source data block. In the source data block, you must enter a job header consisting of three words. SOURCE DATA BLOCK Word 0 Service ID:BOO1h Word 1 Reserved Word 2 Length of the useful data Word 3 Data - Program SEND ALL and RECEIVE ALL 11-71 Volume 2B8976008/1 Example Programs fi S5ho ay) (OO 91049 Sd eVL WOOD WHA 4901 YNIT PUD UNIUOK[ | Ty-ON3S US 48D GV UUM 849019 DIOP pun sgqH WoiBoig [_] TIv-3N9ORI JOppe 41S YA LYNG Gof epery [C__]] 0 is = a ZIMG tl aivd 10 =Ay Ol WIE XG. =Sx 0 ANVO git =4y 120 Nad MOMOU LH OINIS = aa ae O10 = 10 OZMd MAZNY = O NV Xd. 35H in NSS | 0000 =H g0H OOL+ = 4y : gy, aS . + = . _ Q)0AD OW mt. : = TMd @Ad dvd l+=34 || oma \Z awiz : ood oz ana Loo010900080 storppo joueuty wasina ad AZ SsEIPPD JOWeULA [ TIV-GN3S gor OZMd IMZNY TO XOOTE INI OTR INI | vo UNV nae TWv-3A130324 ald-AN3IDRI 7d 3d . spiom {6 Ma Zl+ 3v10 MQ op inyesnf L dvSl_ 1nd 30) yuY 4IS ON L dVSi IND 40) YUL dIS ON L+ INVO . Pit =D ma | dd0010900080. Yday UIa ejowey 190010900080 day uls eJoWeEY O00 UNad eel cima G000= HIT ma | Sarno dvs] ejowey SALANIS dySt ejower ona te Mest coma L008=Hy}0 ma | ININO FUL AIS 12907 IN3ND = FUL AIS 10907 02. UNV Teo . -] 0 -ssqudayv XAW 0 sssauddv xnw 0.0:INSS sounds id 3dAL 184 W 3d 1S vod COALAUSS : dSL 1990} oarano AVI j90) aqH : oz MZNV oz WNY IG-GNas LIM . NW NY : 9e+ SII: . i : pentesel % ng o UNSS 0 UNSS | SPIOM 81 m An 10.08=H] 0 Ma 4OOTd ANIT y4OO18 ANN $ Ae shee \ 7 X / olxa COM Lou eWedss INSND Fig. 11.23 Transparent Data Exchange with Acknowledgment (T-DQ) between two SS Programmable Logic Controllers 0 11-72 Volume 2B89 76049/01 Appendix A TF Error Numbers used by the CP 143 A.1 Preface This appendix describes the error numbers and the causes of errors that can occur when operating the CP 143. The error numbers consist of the parameters ERRCLS and ERRCOD of the AP protocol. There are two possible reasons for errors occurring: > The CP 143 receives a job from the PLC (S5 as client) that is either incorrect or cannot be executed at the present time. The job is acknowledged negatively to the PLC (job terminated with error) without a TF-PDU being transferred. > The CP 143 receives a TF indication (S5 as server) that is incorrect or cannot be executed. The CP 143 sends a reply with the corresponding error number back to the client. The error number is made available to the user either via the test functions in COM 143 or at the client end by transferring it to the PLC. When the error number is transferred to the PLC, it is written to the second word after the programmed or configured condition codeword. It remains entered here until it is overwritten by the application or by a second error number. An error number is transferred to the PLC in the following situations: > When an error occurs in a job from the PLC. > When a TF reply is received with ERRCLS and ERRCOD. > When the access result is negative in a read or write reply. In this case, the value 8240 H (response) or 3040 H (request) is added to the access result to create the error number.Appendix A.2 A.2.1 B8976049/01 Errors Arranged According to Service Groups Non-Service Dependent Errors (NONS) Errors occurring at the client end: 0000 0881 1041 2041 2843 3001 3002 9041 9044 9045 A041 A042 No error Error message from the transport connection (INA) or connection establishment was aborted There are no resources available for the current job (request field) The monitoring time between issuing the request and the reply has elapsed The negotiated PDU length is too short for the current job The job buffer is not long enough for all the parameters belonging to the job The job buffer contains an illegal opcode Protocol error: the received reply does not belong to the request TF service unknown TF service not negotiated when the application association was set up The application association is being terminated so that this request can no longer be processed The application association is no longer establishedB8976049/01 Appendix Errors occurring at the server end: 09c2 TF service not implemented or unknown 2902 Protocol error: 1. The received indication in the AP header is PDULG22+PARLG+DATLG 2. The PDULG is too short for this type 2903 Protocol error: 1. The transport buffer (INA) is shorter than the AP header 2. The PDULG is shorter than the AP header. 3. The DATLG has an illegal value for this service 2904 Protocol error: the parameter length in the AP header of the indication is inconsistent with the lengths in the PDU (e.g. the parameter length is shorter than the total of the name lengths) 5101 TF service is not permitted in the current CP status (stop, unsynchronized) 61C1 Protocol error: in the AP header of the received indication, ROSCTR has an illegal value 6102 Protocol error: in the AP header of the received indication, MODFR1 has an illegal value (0) 61C3 Protocol error: in the AP header of the received indication, MODFR2 has an illegal value (0) 6901 Protocol error: in the AP header of the received indication, MPXADR has an illegal value 69C2 Protocol error: in the AP header of the received indication, PROTID has a value that is not supported 69C3 Protocol error: in the TF header of the received indication, COMCLS has a value that is not supported 69C4 Protocol error: in the TF header of the received indication, COMCOD has a value that is not supportedAppendix 69C5 69C6 69C7 9041 9101 A042 B8976049/01 Protocol error: in the AP header of the received indication, TACTID has an illegal value (0) Protocol error: in the AP header of the received indications, TASQNR has an illegal value (0) The received indication was not negotiated when the application association was set up Protocol errors 1. DATLG is not equal to the length segment +4 in the AP header 2. PARLG is not equal to 0 in the AP header, so that no service ID exists 3. The field SPARE in the AP header has an illegal value 4. In the AP header, the contents of ROSCTR and COMCLS are incompatible Protocol error: in the AP header of the received indication, SGSQNR has an illegal value (0) The application association is no longer establishedB89 76049/01 Appendix A.2.2 Errors in the General Services (GEN) Get capabilities list: Errors occurring at the server end: 8305 Start capability unknown Identify virtual device: Errors that occur at the client end 3003 The S5 address specified in the job buffer contains illegal parameters: 1. The code is not DB, DX or DA, 2. The data block number is 0 3026 Error in the data transfer from the CP to the PLC (e.g. data block does not exist) 3027 The data from the acknowledgement transferred from the PLC are longer than the data area available in the PLC based on the specification in the job buffer Errors that occur at the server end: 2905 The negotiated PDU length is too short for the reply Status: Errors occurring at the client end: 3003 The S5 address specified in the job buffer contains illegal parameters: 1. The code is not DB, DX or DA, 2. The data block number is 0 3026 Error transferring data from the CP to the PLC (e.g. data block does not exist) 3027 The data transferred to the PLC in the acknowledgement are longer than the data area available in the PLC based on the specification in the job bufferAppendix B8976049/01 Unsolicited status: Errors occurring at the client end 3018 The local expansion in the job buffer is too long Errors occurring at the server end: 8701 1. The $5 address for storing the data in the PLC is not configured 2. The configured area for storing the data is not long enough 3. Error in the data transfer from the CP to the PLC (e.g. data block does not exist) Get name list Errors occurring at the server end: 8201 The start object specified in the indication is unknown 8206 Protocol error: the specifications for class or for scope are illegal 8701 Access to expanded object class is not supported 8702 When accessing a list of domain-specific variables, the domain is unknownB8976049/01 Appendix A.2.3 Errors in Application Association Management (APPL) Errors occurring at the client end: 9046 Connection establishment already active when a request to set up an application association is received Errors occurring at the server end: 8000 Negative acknowledgement of terminate application association request 8001 Set up application association is not possible in the current connection status 8100 Application association already exists when set up application link" job is sent 8800 1. A local expansion is not supported when setting up the link 2. The version number when setting up the link is 0 8801 Termination cannot be executed, since acknowledgements are still expected 8810 1. The number syntax = 0 when setting up 2. When setting up, no syntax was acceptedAppendix B8976049/01 A.2.4_ Errors in the Variable Services(VAR) Errors occurring at the client end 3003 The S5 address specified in the job buffer contains illegal parameters: 1. The code is not DB, DX or DA, 2. The data block number is 0 3005 The data are contained in the job buffer and the job buffer is not long enough 3006 The coding of the data type in the job buffer is incorrect 3007 The coding of the scope in the job buffer is incorrect 3008 The variables or group name in the job buffer is incorrect (e.g. too long) 3010 The variable in the job buffer is not programmed in the remote definitions 3011 Nothing is programmed in the remote definitions under the scope specified in the job buffer 3012 The variable in the job buffer is not programmed locally 3013 1. Nothing is programmed locally under the scope specified in the job buffer 2. With local domain-specific variables, the domain is in an illegal status, since a load or delete function has not yet been completed with this domain (permitted status: ready, in use, D4, D5, D6, D7) 3014 Multiple variable access: the group specified in the job buffer does not exist or is empty 3019 The value of the "box identifier" specified in the job buffer does not correspond to the TF identifier for addressing via the format-free addressB8976049/01 3021 3022 3023 3024 3025 3026 3030 3032 3037 3038 3039 303F Appendix Conversion error converting floating point from TF format: the TF number is larger than the range that can be represented in MC 5 Conversion error converting time or time and date from MC 5 format to TF format: the date in the PLC has illegal values (e.g.: 33.1.89 or 17:62). Conversion error converting time or time and date from TF format to MC 5 format: the time is greater than 24 hours or the date is after 31.12.2083. Conversion error with integer 8 or unsigned 8. The data word in the PLC contains a value for integer 8 less than -128 or greater than +127 or with unsigned 8 greater than 255 Error in the data transfer from the PLC to the CP (e.g. data block does not exist) Error in the data transfer from the CP to the PLC (e.g. data block does not exist) Protocol: the parameter header of the received acknowledgement has illegal values Access to a variable is currently disabled (e.g. because it is being accessed via a different link) Data type inconsistent: the data type received with the acknowledgement does not correspond to the data type expected for the variable Protocol error in a received acknowledgement. The attributes belonging to the variabies are inconsistent The interface via which the variable is to be accessed is not synchronized Error in memory submoduleAppendix 29C5 8201 8241 8242 8243 8244 8245 8247 B8976049/01 Errors occurring at the server end: (note: error numbers 824x are calculated at the client end from the access result) The negotiated PDU length is too short for the reply The variable requested with request variable attributes does not exist There are not enough resources available on the CP or in the PLC (e.g. a data block for storing the variables content is too short or does not exist) 1. The access to a variable is currently disabled (e.g. because it is being accessed via another link) 2. With domain-specific variables, the domain is in an illegal state, since a load or delete function on this domain is not yet completed (permitted statuses: ready, in use, D4, D5, D6, D7) The variable can only be read and not written to Variable access via name: the variable does not exist (has not been programmed) Variable access via address: the variable does not exist (has not been programmed) Inconsistent data types: 1. The data type programmed for a variable does not match the type description received in the indication 2. An error occurred converting from TF to MC 5 format or vice-versa 3. When addressing using the format-free address, the type is not octet string ("OS") or the string length in the data field of the TF-PDU is inconsistent with the parameter "number" in the job buffer described in the S5 address. A- 10B8976049/01 8248 8249 9041 Appendix 1. Protocol error: the received indication contains inconsistent attributes (e.g. the length of the variables data block is shorter than the number of type descriptions) 2. When addressing using the format-free address, the scope is not VM or an illegal partial access has been attempted 1. The type of variables access is not supported 2.The interface via which the variable is to be accessed is not synchronized 3. The CPU number of the format-free address is greater than 4 (CPU number 4) Protocol error: the scope or the number of variables is incorrectAppendix B8976049/01 A.2.5 Errors in the Domain Services (DOM) Errors occurring at the client end: 3003 The S5 address specified in the job buffer contains illegal parameters: 1. The code is not DB or DX, 2. The data block number is 0, the sum of the start address and length is greater than the maximum data block length 3009 The domain name in the job buffer is incorrect (e.g. too long) 300A The file name in the job buffer is incorrect (e.g. too long) 300B The logical partner name in the job buffer is incorrect (e.g. too long) 300D The resources length in the job buffer is incorrect (e.g. too long) 3026 Error transferring data from the CPU to the PLC (e.g. data block does not exist) 3027 The data transferred to the PLC from the acknowledgement are longer than the data area available in the PLC based on the specification in the job buffer Errors occurring at the server end: 8000 Negative acknowledgement accessing the memory submodule 8102 1. The link to the file server was aborted 2. The link on which the load function was requested has broken down 8205 With load request: a domain with this name already exists 8210 1. The file server indicated the end of the file, although data are still expectedB8976049/01 8301 8304 8304 8305 8400 8405 8702 Appendix 2. The domain to be loaded contains PLC blocks that already exist in another domain 3. The content of the domain is inconsistent (e.g. less variables than specified) 1. The CP has insufficient buffer space (request fields) for the load function 2. There is not enough memory in the PLC for the blocks (compress) 1. The serial 511 link to the PLC cannot be switched through 2. Physical error accessing the PLC via the serial link 3. Logical or protocol error accessing the PLC via the serial link There is not enough space left in the background memory to store the file The upload/load path does not exist or has incorrect syntax 1. Protocol error handling the upload/load function with the file server 2. No load function was started for the domain specified in the indication 3. The received indication contains an HLM ID for which no upload sequence was started 1. Access to the domain is not possible at present, since the memory module is already being accessed 2. The domain cannot be deleted because a variable is currently being accessed The domain specified in the indication does not existAppendix 8703 8710 8811 A041 B8976049/01 The domain cannot be deleted The indication does not contain a domain name The syntax ID for the load data is not known to the file server 1. The link to the file server cannot be established 2. There is no server path specified in the indication (length of logical partner name = 0)B8976049/01 Appendix A.2.6 Errors in the Program Invocation Services Errors occurring at the client end: 3003 The S5 address specified in the job buffer contains illegal parameters: 1. The code is not DB or DX, 2. The data block number is 0, 3. The sum of the start address and length is greater than the maximum data block length 3009 The domain name in the job buffer is incorrect (e.g. too long) 300C The program invocation name in the job buffer is incorrect (e.g. too long) 3015 The domain name is missing in the job buffer 301F The local stop (P-HL) is not permitted with this job number 3026 Error in the data transfer from the CP to the PLC (e.g. data block does not exist) 3027 The data transferred to the PLC in the acknowledgement are longer than the data area available in the PLC based on the specification in the job buffer Errors occurring at the server end: 2905 The negotiated PDU jength is too short for the reply 8205 Attempt to create a program invocation when a program invocation already exists 8206 Protocol error: the specifications for the Pl name length or number of domains are illegal 8300 The PLC type is not supported (e.g. S5 100)Appendix 8304 8402 8405 8702 8703 B8976049/01 1. Error in the serial transfer via the 511 interface to the PLC 2. The serial interface is no longer plugged into the PLC-CPU programmed as master The service is not permissible in the current program invocation status (e.g. starting in the unrunnable status) Access to the program invocation is not possible at present, since it is already occupied by a different link 1. The program invocation specified in the indication does not exist 2. A domain specified in the create program invocation" job does not exist 1. The Pl status change was negatively acknowledged by the application in the PLC 2. The Pl status change was acknowledged negatively (destructive) by the application in the PLCB8976049/01 Appendix A.2.7__ Errors during Serial Transfer(SER) Errors occurring at the client end: 3003 The S5 address specified in the job buffer contains illegal parameters: 1. The job is not DB or DX, 2. The data block number is 0, 3. The sum of the start address and length is greater than the maximum data block length 3005 The data are contained in the job buffer and the job buffer is not long enough 3025 Error transferring data from the PLC to the CP (e.g. data block does not exist 3026 Error transferring data from the CP to the PLC (e.g. data block does not exist) 3027 The data transferred to the PLC from the acknowledgement are longer than the data area available in the PLC based on the specification in the job buffer Errors occurring at the server end: 29C5 The negotiated PDU length is too short for the reply 2A01 More data are to be read or written than permitted by the configured length or current length of the data block 2A02 Less data are to be read or written than permitted by the configured length 2A04 Access to the PLC is not possible, since no S5 address is configuredAppendix B8976049/01 A.2.8 Errors during Configuration (CONF) 3003 The S5 address specified in the job buffer contains illegal parameters: 1. The code is not DB or DX, 2. The data block number is 0, 3. The sum of the start address and length is greater than the maximum data block length 3004 The condition codeword specified in the job buffer contains illegal parameters: 1. The code is not FW, FY, DB or DX, 2. The address of the flag word or data word is outside the permitted area 3017 The job buffer contains an unknown configuration parameter (incorrect coding) 2. Error numbers in ascending order The following pages list the error numbers in ascending order. The error numbers are followed by a cross reference to the service group in which the error can occur. The abbreviations are as follows: NONS Non-service dependent errors GEN Errors in general services APPL Errors in application association management VAR Errors in the variables services DOM Errors in the domain services PI Errors in the program invocation services SER Errors in serial transfer CONF Errors in configurationB8976049/01 Cross reference list 0000 NONS 0881 NONS 09C2 NONS 1041 NONS 2041 NONS 2843 NONS 29C2 NONS 2903 NONS 29C4 NONS 29C5 GEN, VAR, PI, SER 2A01 SER 2A02 SER 2A04 SER 3001 NONS 3002 NONS 3003 GEN, VAR, DOM, PI, SER, CONF 3004 CONF 3005 VAR, SER 3006 VAR 3007 VAR AppendixAppendix B8976049/01 3008 VAR 3009 DOM, PI 300A DOM 300B DOM 300C Pl 300D DOM 3010 VAR 3011 VAR 3012 VAR 3013 VAR 3014 VAR 3015 Pl 3017 CONF 3018 GEN 301F Pl 3021 VAR 3022 VAR 3023 VAR 3024 VAR 3025 VAR, SER 3026 GEN, VAR, DOM, PI, SERB8976049/01 Appendix 3027 GEN, DOM, PI, SER 3030 VAR 3032 VAR 3037 VAR 3038 VAR 3039 VAR 303F VAR 5101 NONS 61C1 NONS 6102 NONS 6103 NONS 69C1 NONS 69C2 NONS 69C3 NONS 69C4 NONS 69C5 NONS 69C6 NONS 69C7 NONS 8000 APPL, DOM 8001 APPL 8100 APPLAppendix 8102 8201 8205 8210 8241 8242 8243 8244 8245 8247 8248 8249 8300 8301 8304 8305 8310 8311 8400 8402 8405 DOM GEN, VAR DOM, Pi DOM VAR VAR VAR VAR VAR VAR VAR VAR Pl DOM DOM, PI GEN, DOM DOM, PI DOM DOM Pl DOM, PI B8976049/01B8976049/01 8701 8702 8703 8710 8800 8801 8810 8811 9041 9044 9045 9046 91C1 A041 A042 QO GEN GEN, DOM, PI DOM, PI DOM APPL APPL APPL DOM NONS, VAR NONS NONS APPL NONS NONS, DOM NONS AppendixNotesB8976049/01 Appendix B B Protocol Implementation Conformance Statements (PICS) The protocol implementation conformance statements (PICS) provide you with further information about implementing TF (scope and complexity) with the CP 143. This information is necessary if you want to implement a link to a non-SIMATIC system. Using the protocol implementation conformance statement, you can determine the following: > which services the CP 143 supports and > at which degree of complexity the supported services are available. The CP 143 implements the following TF functions: Explanation of the notation: X means service implemented as client and server S means service implemented as server C means service implemented as client.Appendix B B8976049/01 PICS 1: scope of services CP 143 TF Serial transfer read byte string write byte string transparent data exchange Time functions request time set time transfer time Variables services read write indicate request variables attributes Domain services initiate up/download up/download segment terminate up/download request upload sequence upload segment request upload sequence response request download sequence request upload sequence load domain content store domain content delete domain content get domain attributes x KK x * xxK OW ANNNNNN DK KKB8976049/01 Appendix B PICS 1: scope of services CP 143 Program invocation services create program invocation delete program invocation start stop resume reset kill get program invocation attributes General services for virtual devices status of virtual device information report get name list identify virtual device get capability list Application association management initiate application association conclude application association abort application association KKK KK KK XK Ox OK XK Kx OD XKAppendix B B8976049/01 PICS 3a: complexity Basic datatypes |a) Boolean b) bit string c) integer d) unsigned e) floating point X f) octet string g) visible string h) time of day i) time and date Arrays Arrays of basic data types xX Structures Structures of basic data types Xx Named variable All areas defined by TF Unnamed variable Transitions 2 between hierarchical levels (= nesting) Number of|Number of alternate access alternate accesses |definitions in a job only as server >=1 List of variables Number of variables in a job >=1 Relation: object description to access description in job The object descriptions in the server have as maximum the complexity of the access definitions in the protocolB89 76049/04 Abbreviations Cc Abbreviations ALI Application Layer Interface ANR Job number (for handling blocks) ANZW Status word AP Automation protocol layers 5 to 7 of the ISO/OSI reference model AS Active star coupler AS 511 511 interface, protocol for the communication between PLC and PG ASCII American Standard Code of Information Interchange B B Block BCD Binary coded decimal BE Block end Cc CC Central controller Cl Cyclic interface CIM Computer Integrated Manufacturing COM Abbreviation for programming software for SIMATIC S5 CPs COR Coordination module CP Communications Processor CPU Central Processing Unit C-1Abbreviations CSF CSMA/CD D DA DB DCE DIN DIR DMA DOS DP DPR DTE DW DX EG/EU EIA EPROM ET 200 B8976049/01 Control System Flowchart, graphical representation of automation tasks with symbols Carrier sense multiple access with collision detect Destination Address Data block Data Communication Equipment Deutsches Institut fiir Normung (German Standards Institute) Directory of data medium and files Direct Memory Access Operating system Distributed peripherals Dual Port RAM Data Terminal Equipment Data word (16 bits) Extended data block Expansion unit Electronic Industries Association Erasable Programmable Read Only Memory Electronic Terminal 200B8976049/0 1 FB FD FD FDDI FDL FDL2 FlexOs FMA FMS G GO GP GPW GRAPH 5 HDB Abbreviations Flag bit Function block Floppy Disk (data medium) Flag double word Fiber Distributed Data Interface Fieldbus Data Link (subfunction of layer 2) Free layer 2 communications Multitasking operating system Fieldbus Management Layer Fieldbus Message Specification (complying PROFIBUS) Fibre Optic Flag word Flag byte Global Object Global Peripherals Global Peripheral Word with Software package for planning and programming sequence controllers Handling blocksAbbreviations HSA LAN LB LED LEN LLC LLI LSB MAC MAP B8976049/01 Highest Station Address Input byte international Electronics Commission Institution of Electrical and Electronic Engineers Intelligent peripheral module International Standardization Organization Input word Command interpreter Ladder Diagram, graphical representation of the automation task with symbols of a circuit diagram Local Area Network Link block Light Emitting Diode Length of a block Logical Link Control Lower Layer Interface Least Significant Bit Medium Access Control Manufacturing Automation ProtocolB8976049/01 MMS N NCM 0 OB Osl OW OY PAFE PB PC PCl PCP/M-86 PDU PG Pl Pl Pll PIQ PLC PNO Abbreviations Manufacturing Message Specification Network and Communication Management Organization block Open System Interconnection Word from the extended peripherals Byte from the extended peripherals Parameter assignment error Program block Personal Computer Protocol Control Information (for coordinating a protocol) Operating system Personal CP/M-86 Protocol Data Unit (frames consisting of PCI| and SDU) Programmer Program invocation Process image Process image of the inputs Process image of the outputs Programmable controller PROFIBUS user organizationAbbreviations PRIO PROFIBUS PW PY Q QB QW R RAM RLO RS RS 485 S585 SA SAP SB SDA SDN SDU B8976049/01 Priority PROcess Field BUS Peripheral word Peripheral byte Output byte Output word Random Access Memory Result of logic operation (code bits) Recommended Standard EIA standard (multipoint capability) standard for electrical data transmission Special type of communication PLC with PLC Source Address Service Access Point. Logical interface points on the interface between the layers via which the PDUs are exchanged between service users. Sequence block Send Data with Acknowledge Send Data with No Acknowledge Service Data Unit. Information about the service used and the user data contained within it.B8976049/01 SINEC SINEC AP SINEC H1 SINEC HiFO SINEC H3 SINEC L2 SINEC L2-FO Abbreviations Siemens network architecture for coordination and engineering SINEC automation protocol SINEC bus system for industrial applications based on CSMA/CD SINEC bus system for industrial applications based on CSMA/CD with fiber optics SINEC bus system for industrial applications based on FDDI SINEC bus system for industrial applications based on PROFIBUS SINEC bus system for industrial applications based on PROFIBUS with fiber optics SINEC L2-FMS SINEC bus system for industrial applications based on SINEC L2-DP SINEC L2TF SINEC TF SRD SSNR STEP 5 STL PROFIBUS with the FMS protocol SINEC bus system for industrial applications based on PROFIBUS with the DP protocol SINEC bus system for industrial applications based on PROFIBUS with the TF protocol SINEC technological functions Send and Request Data Interface number Programming language for programming programmable controllers of the SIMATIC S5 range Statement List, STEP 5 method of representation as a series of mnemonics of PLC commands (complying with DIN 19239)Abbreviations Sub-D SYM SYSID $5-KOMI $5-DOS/MT T TF TSAP TSAP-ID TSET TSDR TSL TTR TPDU TSDU TSEL VFD VMD B8976049/01 Subminiature D (connector) Symbolic addressing Block for system identification $5 command interpreter $5 operating system based on FlexOS Technological functions Transport Service Access Point Transport Service Access Point Identifier Set-up time Station delay Slot-time Target rotation time Transport Protocol Data Unit (size of the block of data transferred by the transport system) Transport Service Data Unit (size of the block of data transferred to the transport system with a job for transportation via a transport relation) Transport selector, term used as an alternative for TSAP-ID Virtual Field Device Virtual Manufacturing Device Cyclic peripheralsOB 8976049/01 D Index A Access to variables Access rights Addressing free format variables ANR configuring ANZW configuring extended for TF specifying /selecting Application See application program Application association configuring configuring name configuring the type of establishment definition establishment/termination handling with S5 PLC management management (overview) object object description with S5 PLC Application association list Application association management overview Application associations number of jobs type of connection establishment Application program TF architecture 2-12 4-36 4-8 8-27 8-4 8-12 8-4 3-3 3-12 6-3 8-3 8-6 6-2 2-15 2-18 2-34 2-3 2-7 2-15 2-15 8-23 2-3 6-3 2-5 Index Volume 2Index Basic configuration Box ID See group name Cc Capability Capability list CIM support by TF Client See also client/server association Client interface calling TF services messages sequence Client-/Server association functions in S5 Client/server association example principle Clock accuracy configuration how it functions reading/seeting time restrictions setting/reading Status transitions tips for application Clock frame Clock master Clock services accuracy delay time overview synchronization undefined time update time 8-3 5-10, 5-59 5-28 3-6 3-10 3-10 2-20 2-19 2-19 6-49 6-38 6-36 6-40 6-48 6-45 6-36 6-48 6-28 6-31 6-28 6-35 6-33 2-4 6-31 6-33 6-33 B 8976049/01 Volume 2 D-2B 8976049/01 Clock slave Communication message-oriented open Compress See also job buffer See also PLC Compress memory Configuration documenting Configuration job Configuring local variables Connection special Connection establishment dynamic layer 4 layer 7 static passive static,active Connection termination D Data link blocks configuring Data type bit string Boolean floating point integer octet string time and date unsigned visible string Database transfer Documentation Domain assignment to CPU attributes 6-31 2-2 5-8 8-23 3-14 6-9 6-5 6-5 6-5 6-3 6-8 6-2 8-4 4-43 4-41 4-41 4-41 4-43 4-41 4-41 4-44 8-25 5-14 5-22 Index Volume 2Index block allocation definition in S5 dynamic generating in S5 PLC managing on the CP object object description services static Domain list Domain services check list for application delete domain services See also domain example get domain aitributes load domain content modes store domain content third party association Dual-port RAM E Ethernet address remote (configuring) Example programs F Fileserver appl. ass. configuring and establishing type of establishment Free format address G Group name Groups defining B 8976049/01 5-14 5-2 5-30 5-2 2-10 5-14 2-7 2-10 2-3, 2-23, 2-27, 5-1 - 5-64 5-30 5-64 5-4 5-20 11-42 5-22 5-8 5-5 5-15 5-5 3-6 8-7 41-1 5-14, 8-20 8-20 4-33 4-27, 8-17, 8-19 8-19 Volume 2B 8976049/01 H Handling block See HDB HDB address information application call parameter description example of application overview parameter assignment tool to support parameter assignment Installation Insufficient memory loading domain Interface number See SSNR J Job buffer compressing creating with supporting tools creating with the editor general section structure Job number See ANR Job status L Language standardization aims Link establishment Link flag Load sequence Index 3-2 3-4 3-14 3-4 3-10 3-10 5-45 5-14 3-3, 3-6 10-11 3-6 10-3 3-8 3-6, 10-3 8-35 1-3 6-3 8-27 5-6 Volume 2Index M MAC MAC address See Ethernet address MAP SINEC integration MMS basis of definition for TF Model See TF model Multiplex address See MUX address Multiprocessor mode PI view VMD configuration MUX address configuring meaning N NCM Nesting level Non-open services 0 Open communication See communication P PGLOAD function host computer functions system configuration TF architecture transfer functions Pl in an S5 PLC B 8976049/01 2-6 2-2 5-44 5-31 8-21 8-7 2-15 10-2 8-17 7-1 3-7, 9-1 9-2 9-6, 9-11 9-7 9-6, 9-9 2-11 Volume 2B 8976049/01 Index object 2-7 object description 2-11 service description 2-29 services 2-3, 2-28, 5-1 - 5-64 status coding 5-43 status indication 5-31 status management 5-31 system Pl 2-11 user Pl 2-11 Pl services 5-29 check list for application 5-32 create PI (server) 5-50 example 11-42 Get PI attributes 5-60 kill Pl (client) 5-55 local program stop (client) 5-55 See also PI reset (client) 5-55 resume PI (client) 5-55 server interface 5-39 server function 5-29 standard function block 5-42 start P1 (client) 5-55 stop PI (client) 5-55 PLC start program 9-12 delete 9-11 in client/server association 2-19 load 9-114 save 9-11 start/stop 9-11 stop program 9-12 virtual 2-9 PLC-CP link principle 3-2 Predefined connection 6-9 Printout controlling 8-24 documentation 8-23 Program invocation See Pl D-7 Volume 2Index Programmable logic controller Protocol R RECEIVE-ALL REQUEST EDITOR functions and mode of operation S Scope configuring remote variables domain-specific example link-specific See also variable variable access VMD specific with free format read/write SEND-ALL SEND-direct Serial transfer example job header overview read byte string (client) read/write byte string (server) service descriptions transparent data exchange (Client) transparent data exchange (server) write byte string (client) Server See also client/server association Server function activating Server interface Server list Services See also TF services SINEC H1/H1FO B 8976049/01 2-19 2-2 3-2, 3-4, 3-14 10-1 10-2 2-12 8-16 4-4 46 4-5 4-8 4-4 4-36 3-2, 3-4, 3-14 3-4 2-37, 7-1 11-68 7-21 2-4 7-4 7-13 2-38 7-17 7-21 7-7 3-14 3-14 3-14 8-23 Volume 2 D-8B 8976049/01 overview SINEC TF advantages architecture communications model Single status See test SSNR configuring Standard function block for PI services PI services Start-up START/STOP Status all See test Status diagram Pl Status of a link Status transitions Structures Supplementary services System PI Tt Test JOB TEST single status status all TF interface configuring and testing testing TF job TF link establishment/termination handling with $5 PLC with S5 PLC TF model introduction TF object Index 1-3 1-3 2-5 2-5 8-13, 8-22, 8-27 8-4 5-31 5-42 5-45 5-34 5-33 8-27, 8-35 5-30 4-3 6-1 2-11, 5-34, 5-44 Volume 2Index B 8976049/01 dynamic objects 2-8 static object 2-8 types of object 2-8 TF objects and TF services 2-7 TF services call on the client interface 3-6 example programs 11-1 overview 2-3 selecting 2-21 under PGLOAD 9-4 Third party association 2-25 - 2-26, 5-5 Timeout 3-9 Tools PGLOAD 9-1 REQUEST EDITOR 10-1 Trace buffer 8-34 Trace functions 8-34 Transfer functions 8-25 Transparent data exchange evaluating status bits 7-24 TSAP local (configuring) 8-5 remote (configuring) 8-7 Type description 4-40 complexity 43 free format read/write 4-36 PLC as client 4-2 PLC as server 4-2 read variable 4-12 See variable write variable 4-19 Type selection screen 10-12 U Upload sequence 5-7 User groups 1-10 User memory module See also EPROM User PI 2-11, 5-35 statuses 5-35 Volume 2 D-10B 8976049/01 Index Vv Variable access protection 2-14 access right 2-12 basics of the services 4-2 characteristics 2-12 condition code word address 2-13 configuring with scope 4-4 - 4-5 example of defining 11-5 example of loca! configuration 8-14 in an S5 PLC 2-13 interface number 2-13 Local 2-13, 4-2, 8-3 local (configuring) 8-10, 8-17 name 2-12 object 2-7 object description 2-12 remote 2-13, 4-2, 8-3 remote (configuring) 8-16 $5 address 2-13 scope 2-12, 4-4 service description 2-31 services 2-3, 2-30, 4-1 - 4-44 See also type description Variable description 2-12 Variable name 2-12 Variable services check list for application 4-9 example 11-3 free format read/write 4-33 information report 4-8, 4-26 See variable write (client) 4-17 Variable type array 2-14 record 2-14 standard data type 2-14 VMD configuring 8-21 in an S5 PLC 2-9 D-11 Volume 2Index object object description services variables editor VMD list VMD services identify VMD unsolicited VMD status See also VMD VMD status B 8976049/01 2-9 2-3, 2-21 8-17 8-23 6-10 6-19 6-17 6-11 Volume 2B8976048/01 Further Reading E Further Reading /1/ Wege zur offenen Kommunikation Das ISO-Referenzmodell im Umfeld der Kommunikation Siemens AG DOA PM Order no.: U 1474-J-Z72-11984 (only available in German) /2/ [ISO/IEC 9506-1] Information Processing Systems Open Systems In- terconnection- Manufacturing Message specification, Part 1: Service De- finition /3/ Kerner H. Rechnernetze nach OS! ADDISON-WESLEY 1992 ISBN 3-89319-408-8 (only available in German) /4/ Instructions Installation of SINEC H1 Local Area Network SIEMENS AG, Order no.: AR 463-220 /5/ Instructions Installation of SINEC H1FO Local Area Network SIEMENS AG, Order no.: AR 464-220 /6/ SINEC TF User Interface User Interface for the SINEC Technological Functions SIEMENS AG, Order no.: 6GK1971-1AB00-0AA1 Release 02 /71 Handling blocks are described in the following: for S5-115 as part of the device manual Order no.: 6 ES 5998-3-UFX 1 for CPU 945 Order no.: 6 ES 5998-0-UFX3 for CPU 941 - CPU 944 for S5-135 can be ordered as HDB software + description Order no.: 6 ES 5842-7-CB 01 for CPU 928A/B - CPU 948 for S5-155 can be ordered as HDB software + description Order no.: 6 ES 5846-7-CA 01 for CPU 946 / 947 E-1 Volume 2NOTIZENSIEMENS AG AUT 933 Siemensallee 84 76187 Karlsruhe Federal Republic of Germany Korrekturen Corrections Vorschlage Suggetions Fur Druckschrift bzw. Handbuch For instruction or manual TiteVtitie SINEC CP 143 TF mit NCM COM 143 TF Absender/From - Name/Name Bestell-Nr./Order No. Firma/Dienststelle - Company/Department 6GK1970-1AC43-0AA1 Anschrift/Address Telefon/Telephone Vorschlage und/oder Korrekturen Sollten Sie Suggestions/Corrections beim Lesen dieser Unterlage auf Druckfehler gestoBen sein, so bitten wir Sie, uns diese mitzuteilen. Ebenso sind wir fur Anregungen, Hinweise und Verbesserungsvorschlage dankbar. Bitte die Bestell-Nr. der betreffenden Druckschrift oder des Handbuches oben eintragen! Should you come across any printing errors when reading this publication, we would ask you to inform us using this form. We would also welcome any suggestions you may have for improvement. Please fill in the order no. of the affected document!SIEMENS AG AUT 933 Siemensallee 84 76187 Karlsruhe Federal Republic of Germany Corrections Correcciones Pour limprim ou le manuel Para folleto o manual Titre/titulo SINEC CP 143 TF mit NCM COM 143 TF Expditeur/Expeditor - Nom/Nombre y apelido N de rf./N de ped. 6GK1970-1AC43-DAA1 Socit/Service - Empresa/Seccion Adresse/Direction Tlphone/Tlphono Propositions ou corrections Si, lors de la lecture de ce Si encuentra Usted erratas de Propuestas y/o correcciones document, vous trouvez des fautes imprenta,, por favor, infrmenos d'imprimerie, nous vous prions de utilizando este formulario. Le nous en part dans ce rogamos que nos communique formulaire. Nous recevrons aussi tambin las teclamaciones, avec reconnaissance vos indicaciones, y propuestas de suggestions, remarques et mejoramiento. propositions damlioration. Indiquez s.v.p. ie n de rfrence Indique por favor el N de pedido de Ylimprim concerne ! ou de manuel del folleto o del manual respectivo!