using the 2572 / 2572-a ethernet modules and the cpu ethernet port
TRANSCRIPT
Using the 2572 / 2572-A Ethernet Modules
and the CPU Ethernet Port
.
2572 features
10 Mbit support RJ-45 and AUI interface IP addressing from serial port or PLC Serial port for configuration and PLC
programming Supports external power for transceiver 100% compatibility with 505-CP2572 Server mode for supporting HMI’s 2 Client modes for peer-peer Email capability S7 send/receive support
.
2572-A features
2572 compatibility Better performance (2x) 100Mb support New startup option to use DHCP for addressing Enhanced diagnostics stored in non-volatile
RAM Web server for configuration and diagnostics Better security for configuration changes
• Password control• Hardware lockout
.
2572 Front Panel - Status LEDs
ACTIVE• Solid = module status good• Slow blink = fault• Fast blink = no IP address
XMIT-1, XMIT-2, XMIT-E• Lights when data is transmitted on the port
RCV-1, RCV-2, RCV-3• Lights when data is received on the port
LB (link beat)• Lights when there is a good connection to a hub or switch
AUI• Lights when the AUI port is selected (automatically selected if
no link beat on RJ45 port POL (polarity)
• Lights when polarity is reversed on the RJ45 port (automatically corrected)
COL (collision)• Lights when a collision is detected
.
2572 Front Panel - Serial ports
Port 1: DB9 male – RS232 Port 2: DB9 female – RS422 Port parameters set by switches or PLC logic Used for module configuration and PLC
programming “Redirect” feature sends serial port data to
another 2572 on the network (useful for APT and TISOFT programming)
.
2572 Front Panel - Ethernet
10bT• Connects to Ethernet UTP (unshielded twisted pair)
using RJ45 connector
AUI• Connects to an Ethernet transceiver, allowing
attachment to coaxial for fiber networks
AUI power• Allows user to optionally supply external power for
the AUI (default is PLC powered)
10bT port is primary; if no Link Beat then AUI port is used
A status bit is sent to the PLC indicating which port is selected
.
2572-A Front Panel - Status LEDs
MS (Module Status)• Steady Green = module hardware and software is
operational• Flashing green = module is starting up• Steady red or flashing red = error conditions.
NS (Network Status)• Steady Green = network server is operational (IP
address has been set)• Steady red or flashing red = error conditions• Off = network server has not been started.
LS (Link Status)• Steady Green = a link exists between the module and
the Ethernet hub or switch• Off = no cable connected, or cable fault
COL (Collision)• Lights when a collision is detected
.
2572-A Front Panel - Status LEDs
FDX (Full-Duplex)• Steady green = full duplex mode. 100 (100 Mb)• Steady Green = 100Mb• Off = 10Mb
XMT-S, XMIT-E (Transmit)• Lights when data is transmitted on serial or
Ethernet ports
RCV-S, RCV-E (Receive)• Lights when data is received on serial or Ethernet
ports
.
2572-A Front Panel
Reset button• Recessed to avoid accidental press• Causes a hardware reset (like
removing the module and reinstalling)
Module ID switches• Set the module ID for use with DHCP
auto-addressing
.
2572-A Front Panel Serial port
• RS232• Works with PLC programming
cables• For module configuration only
Ethernet port• Supports 10Mb or 100Mb• Shielded or unshielded cable
.
Ethernet Module Functions PLC server – allows external clients to read and write PLC
memory (HMI)• Client sends request to the module using NITP or CAMP
command embedded in TCP/IP packet• Module sends the command to the PLC over the
backplane• PLC responds over the backplane• Module returns data or acknowledgement to the client• Up to 8 requests (2572) or 16 requests (2572-A) allowed
per PLC scan PLC client (peer-peer)
• Under control of PLC logic:• Sends messages to other nodes• Processes messages from other nodes• Can support multiple concurrent connections
.
PLC command interface A command interface is used to trigger the module to send
and receive data Not required for simple HMI operation Module logs in as 2WX, 6WY Command process
• Place a command block in V-memory• Put the starting address of the command block in WY5-
8• Trigger a bit in WY4• Monitor command status in WX2
Up to 4 commands can be processed simultaneously
.
PLC command interface
Logs in as 2WX and 6WY words
.
Put V-memory addresses for command blocks here
Trigger the commands here
Monitor status here
WX / WY Map
.
Command Status Word
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Module Status Word
CMD 1Status Bits
WX1
WX2
WY3
WY4
WY5
WY6
WY7
WY8
Command Slot 1: V Memory Address of Command Block for CMD1
Command Slot 2: V Memory Address of Command Block for CMD2
Command Slot 3: V Memory Address of Command Block for CMD3
Command Slot 4: V Memory Address of Command Block for CMD4
CMD 2Status Bits
CMD 3Status Bits
CMD 4Status Bits
Command Control WordCMD 1
Control BitsCMD 2
Control BitsCMD 3
Control BitsCMD 4
Control Bits
Module Control Word
Module Status Word (WX1)
2572
2572-A
.
1 2 3 4 5 6 7 8 9 - 16
MODFAIL
SERCFG
NETCFG
DIAGERR
CFGERR
AUIACT
DSACT
RSVD TimerE Code
1 2 3 4 5 6 7 8 - 15 16
MODSTATUS
RSVD NETCFG
RSVD RSVD LINK STATUS
RSVD RSVD HEART BEAT
Module Control Word (WY3)
To perform a module reset, set MOD RESET AND set all 4 abort triggers in the Command Control word (WY4).
.
1 2 3 4 5 6 7 8 9 - 16
MODRESET
RSVD RSVD RSVD RSVD RSVD RSVD RSVD RSVD
Command Control Word (WY4)
CMD Mode• 0 = uncoupled mode (command runs continuously as long as CMD Trig is high)• 1 = coupled mode (command runs once, then CMD Trig must go low and high
to run command again)
.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
ERR Ack
CMDMode
CMDTrig
AbortTrig
ERRAck
CMDMode
CMDTrig
AbortTrig
ERRAck
CMDMode
CMDTrig
AbortTrig
ERRAck
CMDMode
CMDTrig
AbortTrig
Command 1 Command 2 Command 3 Command 4
Command Status Word (WX2)
CMD Err = error in executing command• Error code is written into first word of command block in V-memory
PLC Err = no valid command block at specified V-memory address• No error code is written
.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
CMDERR
PLC Err
CMDBusy
AbortBusy
Command 1 Command 2 Command 3 Command 4
CMDERR
PLC Err
CMDBusy
AbortBusy
CMDERR
PLC Err
CMDBusy
AbortBusy
CMDERR
PLC Err
CMDBusy
AbortBusy
Command Block in V-Memory
Command block is 16 contiguous words in V-Memory If error in processing, Error Word contains the code of the error Command code = type of command Connection Number = which protocol manager executes the command High byte of Connection Number must = 4B
.
Offset Contents
Error Word
Command Code
Connection Number
Command Parameter 1
Additional parameters
0
1
2
3
4-15
Common Commands• 4 = start network server• 3 = create connection• 2 = close connection• 513 = write remote• 514 = read remote• 515 = memory exchange
Sample Command BlockStart Network Server
.
Offset Description
Command Error Word
Command (Start Network Server)
Connection Number (19291 - 19299)
Protocol Manager Number
Startup Option Bits
0
1
2
3
4
HexValue
DecimalValue
0
4
19298
35
0
0
4
4B62
23
0
TCP Keep Alive Interval in Seconds (0=default = 60) (Set to 65000 or greater to disable Keep Alive)
IP Address of this Module (High 16 bits)
IP Address of this Module (Low 16 bits)
TCP / UDP Port Number
IP Address of Default Router (High 16 bits)
5
6
7
8
9
0
51128
45378
1505
0
0
C7B8
B142
05E1
0
IP Address of Default Router (Low 16 bits)
Max Number of TCP Connections (0=default)Mask (High 16 bits)Subnet Mask (High 16 bits)
Subnet Mask (Low 16 bits)
Unused - reserved for future use (Set to 0)
10
11
12
13
14
0
0
65535
65280
0
0
0
FFFF
FF00
0
Unused - reserved for future use (Set to 0)15 00
35 = PLC Network server
Upper byte = 4B
199.184.177.66
255.255.255.0
Getting Started Using the 2572Determine IP addressChoose network startup modeSet up switchesInstall 2572 and connect network cableEnter startup ladder logic if “PLC-start” selected
or enter IP address into module if “auto-start” selected
Verify PC address is on the same network as the 2572
Test connection using “ping”
.
Getting started using the 2572 Choose network startup mode
Automatically starting the network server• Starts the network server from onboard EEPROM• Requires IP address to be pre-assigned using serial port with CTIDiag
program• Requires no PLC logic
Starting the network server from PLC logic• Requires PLC logic to trigger “start network server” command block• Ensures that any 2572 plugged into that slot will get the same IP address• Easy replacement of modules
Automatic start with DHCP server (2572-A only)• Ensures a replacement module will get the same address as the old module• Does not require any PLC logic• Requires a DHCP server on the network which must be configured to
support Module ID
.
Getting Started Using the 2572 Set switches
2572• Serial port protocol and baud rate• Serial port handshaking• Network startup mode• EEPROM write protect• AUI power
2572-A• Serial port baud rate• Diagnostic start• Interface mode• Password bypass• Download lock• Configuration lock• Network startup mode
.
Setting Switches
2572
.
SW1
SW1SW2
Setting Switches (2572)
SW1 controls serial port 1
.
Position3
Disabled OFFEnabled ON
Hardware Handshaking
6 7 8CAMP/NITP Slave ON ON ONNITP Only Slave ON OFF OFF
Task Code Master OFF OFF OFFLoopback OFF ON ON
PLC Select OFF ON ON
Port ProtocolPosition
1 21200 ON ON2400 ON OFF9600 OFF OFF
19200 OFF ON
Baud RatePosition
OPE
N
1
2
3
4
5
6
7
8
SW1
Setting Switches (2572)
SW2 controls serial port 2 and network startup
.
Position3
Disabled OFFEnabled ON
Hardware Handshaking
6 7 8CAMP/NITP Slave ON ON ONNITP Only Slave ON OFF OFF
Task Code Master OFF OFF OFFLoopback OFF ON ON
PLC Select OFF ON ON
Port ProtocolPosition
1 21200 ON ON2400 ON OFF9600 OFF OFF
19200 OFF ON
Baud RatePosition
OPE
N
1
2
3
4
5
6
7
8
SW2
Protect Off OFFProtect On ON
EPROM Write Protect
Position 5
PLC Start OFFAuto Start ON
Startup ModePosition
4
Setting Switches (2572-A)
.
1 21200 closed closed2400 closed open9600 open open
19200 open closed
Baud RatePosition
OPE
N
1
2
3
4
5
6
7
8
9
10
11
12
SW1
Locked closedUnlocked open
Configuration Lock
Position 5
Auto Start closedPLC start open
Startup ModePosition
4
Protect Off closedProtect On open
Password Bypass
Position 7
Compatibility closedPerformance open
Interface ModePosition
11
Enable closedDisabled open
Diagnostic StartPosition
12
Disabled closedEnabled open
Download LockPosition
6
Automatically Starting the Network Server
Select Auto-Start on switches• SW2 position 4 on 2572• SW1 position 4 on 2572-A
Assign the IP address using the serial port• Attach serial cable• Run CTIDiag• Open I/O data port• Choose “Module”, “Set network parameters”• Reset the module
Verify communication with the module using “ping”
.
Start CTIDiag
Starting the Network Server from PLC Logic
Select PLC-Start on switches• SW2 position 4 on 2572• SW1 position 4 on 2572-A
Setup the “Start Network Server” command block in V-memory
Enter the example logic for triggering the command block
Start the program Verify communication with the module using “ping”
.
Start Network Server Command Block
.
Offset Description
Command Error Word
Command (Start Network Server)
Connection Number (19291 - 19299)
Protocol Manager Number
Startup Option Bits
0
1
2
3
4
HexValue
DecimalValue
0
4
19298
35
0
0
4
4B62
23
0
TCP Keep Alive Interval in Seconds (0=default = 60) (Set to 65000 or greater to disable Keep Alive)
IP Address of this Module (High 16 bits)
IP Address of this Module (Low 16 bits)
TCP / UDP Port Number
IP Address of Default Router (High 16 bits)
5
6
7
8
9
0
51128
45378
1505
0
0
C7B8
B142
05E1
0
IP Address of Default Router (Low 16 bits)
Max Number of TCP Connections (0=default)Mask (High 16 bits)Subnet Mask (High 16 bits)
Subnet Mask (Low 16 bits)
Unused - reserved for future use (Set to 0)
10
11
12
13
14
0
0
65535
65280
0
0
0
FFFF
FF00
0
Unused - reserved for future use (Set to 0)15 00
Upper byte = 4B
199.184.177.66
255.255.255.0
35 = PLC Network server
Starting the Network Server from PLC Logic
Example ladder logic
.
Load starting address of command block into WY5 (command slot 1). Note the rung runs only once.
If network server is not started and command 1 is not busy, trigger the start server command.
Net Cfg
CMD1 Trig
CMD1 Busy
Open Socket Command Block(opens a connection to another 2572)
.
Write Remote Command Block\ (writes a block of v-memory to another 2572)
.
Read Remote Memory Block(reads a block of v-memory from another 2572)
.
CTI 2572-DDS2 DDE I/O Server
Software package that runs on a PC
Can read / write data from the PLC and make it available to any application that supports DDE (Wonderware, MS-Excel, etc)
.
Making a Simple Display Using Excel
Install 2572 and start network server Start DDE server Create topic in DDE server
• Select Configure / Topic• Enter a topic name• Enter the IP address of the 2572
Start Excel Enter formulas using the syntax
• ‘Application_name’|’topic_name’!’item_name’• Application_name is the name of the CTI I/O server• Topic_name is the topic you created• Item_name is a valid 505 memory reference• Example: ‘cti2572’|’testplc’!’wx1’
.
CTI 2572-OPC Server
OPC (OLE for Process and Control) servers provide a standardized method of allowing multiple industrial applications to share data in a quick and robust manner.
Includes a main server program which provides all of the OPC and DDE connectivity and user interface functions, and a plug-in communications drivers for the CTI 2572 Ethernet Module.
OPC technology reflects the move from closed proprietary solutions to open architectures that provide more cost-effective solutions based on established standards.
2572 Application notes
IP Addressing and the 2572 Getting Started with Networking and the 2572 Using CTIDiag with the 2572 Starting the 2572 Network Server from PLC Logic Reading Values into Excel Spreadsheets Using the 2572 Using the 2572 with Wonderware 7.0 Creating a Client/Server Memory Transfer between Two 2572
Modules Using the 2572 UDP "Send To" Feature to Exchange Memory with
Multiple PLCs
.
Ethernet ModulesSpecific Topics
2572• Operation of the email feature• Operation of the send/receive feature• Operation of the DataShare feature
2572-A• IP address assignment using DHCP• Built-in web server• Security features• Re-flashing firmware• Modbus TCP Server• IP Mulitcast
.
2572 Email Feature
Allows PLC logic to transmit an email message Sample command block
.
2572 Send / Receive Feature
Allows data exchange between TI505 and Siemens S5/S7 PLCs Send commands and receive commands must match-up on
both sides Data block read from / written to V-Memory Four command blocks are used
• Open active connection• Open passive connection• Send• Receive• Close connection
Complete details in chapter 5 of the 2572 user manual
.
2572 Send / Receive Sample Command Block
.
2572 DataShare Feature
Allows very high speed peer-peer connection between 2572s Useful where
• Speed is critical• One PLC periodically need to update several others with the same set of
data• Multiple PLCs need to exchange data on a cyclic basis
Activated using SW2-2• When active, limits performance of module as a server
Uses reserved bits in the Module Status Word and Module Command Word
Command Blocks• Start producer instance• Trigger producer• Start consumer instance• Close datashare
.
2572 DataShare Sample Command Block
.
2572-A IP Address Assignment using DHCP
Allows use of auto-start while still guaranteeing correct IP address in case of a module replacement
How it works If auto-start is selected and settings of module ID switches are non-zero,
the module ID value is sent to the DHCP server as a “client identifier” DHCP server is set up to assign IP addresses based on client identifier
At CTI, we set up our server to assign the last part of the IP address based on the switch assignment
Example Switch setting of “70” receives IP address of 199.184.177.70
Complete information on setting up DHCP server in Appendix E of 2572-A user manual
.
2572-A Built-In Web Server
Web server features• Module diagnostics• Module configuration• Firmware download• Security services• Product support
Just point your browser at the IP address of the module
.
2572-A Security Features
Password protection for• Module configuration changes• Module firmware download• Bypass password protection using SW1-7
Hardware lockout for• Module configuration changes• Module firmware download• Set on SW1-5 and SW1-6
.
2572-A Firmware Upgrade
Firmware updates can be re-flashed in-place using the web server interface
Install a free TFTP server on your network Download and copy the upgrade file to the TFTP server Go to the “firmware download” section of the 2572-A
web server interface Enter the IP address of the TFTP server Complete information in Appendix F of the user manual
.
2572-A Modbus TCP Server
Configuration• The Modbus TCP server starts automatically. There is no
configuration or startup logic required. Variable Mapping
• Modbus TCP uses a different nomenclature than the SIMATIC® 505 to describe data elements. The following table provides a cross reference.
Modbus Variable 505 PLC Equivalent Variable
Coil Control Relay (C )
(Discrete) Input Discrete Input (X)
Holding Register User Variable Memory (V)
Input Register Word Input (WX)
2572-A Modbus TCP ServerSupported Modbus Function Codes (FC)FC
(dec)FC
(hex)Function Codes 505
VariableComments
01 01 Read Coil Status C Max number of coils = 2000
02 02 Read Input Status X Max number of inputs = 2000
03 03 Read Holding Register V Max = 125
04 04 Read Input Register WX Max = 125
05 05 Write Single Coil C
06 06 Write Single Register V
07 07 Read Exception Status C TBD. This returns Y1-8 or C1-8 in 2573-MOD.
15 0F Write Multiple Coils C Max = 800
16 10 Write Multiple Registers V Max = 100
Code Name Description
01 Illegal Function Unsupported Function code
02 Illegal Data Address Requested data address not included in the PLC configuration
03 Illegal Data Value Typically indicates a problem in the query structure
04 Slave Device Failure Unrecoverable error occurred while processing the request
2572-A IP Multicast There is no physical limit to the number of modules that can
participate in a Multicast session. The number of words that may be transferred is 1 - 256 words per
module. The source, number of words ,and destination are defined in the
Producers. This gives greater flexibility in determining the source data, the number of words that get written, and the destination that the data gets written to in the consumers in the Multicast session.
Each station broadcasts its message asynchronously at the configured production intervals. This eliminates the need for each station to be polled to broadcast its data.
The TCP/IP protocol reserves a block of IP addresses (224.0.0.3 through 239.255.255.255) for multicast use.
2572-A IP Multicast
You can configure a 2572-A to receive on a multicast address using the same methods used to establish the other TCP/IP network parameters. • 1. If you are using the PLC Start method, the multicast
address can be specified in the Start Network Server command block.
• 2. If you are starting the module using IP parameters stored in EEPROM, you can use the Web Server interface to enter the multicast address.
• 3. If you are using DHCP, you can add the multicast address to the parameters that are provided by the DHCP server.
2572-A IP MulticastStart Network Server Example
• Only the values in offsets 6 and 7 would change to load that modules specific IP address.
2572-A IP Multicast
Configuring IP Multicast • After the network server has been started you
need to do the following to send a multicast message: 1. Execute a Create Socket command using a
multicast address. 2. Use the Unacknowledged Write command to
send a multicast message containing the data you wish to write.
2572-A IP Multicast Create Socket Command
• The Create Socket command provides a means for your PLC logic to refer to another network node when sending messages. You must complete the Create Socket command before you send messages to another node on the network.
• For IP Multicast, UDP must be specified as the Type of Service. The 2572-A saves the Multicast address and port number as the default remote socket. The IP Multicast address is specified in offsets 6 and 7 of the Create Socket command block. Once the Create Socket command completes successfully, your logic can use the Connection Number to refer to the remote socket.
2572-A IP Multicast
Create Socket Command Example
2572-A IP Multicast
Unacknowledged Write Command • This command is designed to be used with multicast
addresses, where one message can be used to update multiple modules. Like the standard write command, this command reads the contents of a designated area of V memory in the local PLC and writes the values to a specified area of memory in another PLC. However, because multiple modules could receive this message, CAMP servers that receive this command do not reply and the client does not verify that the message was received by any server.
2572-A IP Multicast Unacknowledged Write Command Example
• Note that offset 3 (V143) determines the starting V location of the write block in the local PLC. Offset 4 (V144) determines the number of words to be written. Offset 5 (V145) determines where this block of data gets written to in the remote PLC.
2500-CXXX CPU Ethernet Port
Ethernet Communications• The CTI 2500 controller provides a means to attach the
controller to a plant network via an integrated 10/100Mb Ethernet port. The port offers auto-crossover capability, which allows you to connect a standard cable directly from your PC to the Ethernet port for local programming.
• The port uses the TCP/IP protocol, which is widely supported by programming software and HMI software. Before you can use the port, you must set the IP address and related parameters. To do this, you can use Workshop Version 4.11 or greater or the CTI standalone utility program IPSET (Demonstration).
2500-CXXX CPU Ethernet Port
To prevent a possible bump in the process, the IP address can be set only while the PLC is in PROGRAM mode.
IP addresses must be unique, even between the local Ethernet port and an Ethernet module in the same base. Duplicating IP addresses can cause unpredictable problems, including loss of communications with the Ethernet port.
2500-CXXX CPU Ethernet Port TCP/IP provides for multiple logical ports. Each “port” represents a
particular service offered at the IP address. The CTI 2500 Controller supports the following logical ports:• Programming Port (TCP Port 4452)
The programming port is intended for use with network-capable programming software, such as PLC WorkShop. To use the programming port, connect to TCP port 4452. This port supports all programming, data access, and control requests. Only one client may be connected to the programming port at a time. The CTI 2500 gives priority to all requests to the programming port. UDP connections are not supported.
When programming via local Ethernet port using TCP port 4452, you can prevent anyone else from concurrently modifying the program via another port or SF module by initiating port lockout using your programming software. Port lockout blocks requests to modify the User Program that originate from other physical ports, such as the serial port or a port on a special function module.
2500-CXXX CPU Ethernet PortData Access Port (TCP Port 4450/1505)
To use the Data Access port, it is preferable to connect to TCP port 4450. To provide compatibility with installations using the CTI 2572 and 2572-A, you may also connect to the Data Access port using TCP port 1505. A total of three concurrent TCP connections to port 4450 or 1505 are allowed. For example, you could have two connections to port 4450 and one connection to port 1505. UDP connections are not supported.
The Data Access port is intended for use with HMI and SCADA software. Since the Data Access Port uses the same CAMP protocol used by CTI 2572 and 2572-A modules, drivers are available for most popular SCADA software packages.
2500-CXXX CPU Ethernet Port
Data Access Port (TCP Port 4450/1505) Cont.• It can also be used with network-capable programming software
where you want to allow the User Program to be displayed but not modified. By default, the Data Access port will reject commands that attempt to alter the User Program, returning a “port lockout” error.
• Some legacy network programming interfaces, such as APTNET, support only Port 1505. If you need to use TCP Port 1505 as a full function programming port (allowing programs to be modified), you can set the Programming Port switch as described in Section 2.4.
Caution When you choose to use Port 1505 as a full function programming port, there is no means to prevent
two users from concurrently modifying the User Program, since more than one programming connection to the Ethernet port is allowed.
2500-CXXX CPU Ethernet Port Web Server Port
• The Web Server port allows a standard Web browser to connect to the CTI 2500 to access the Event Log.
• The event log maintains a time stamped record of significant software events. All fatal and non-fatal errors result in an entry into the event log. The event log is stored in battery backed memory. It can be accessed using a standard web browser, such as Internet Explorer. You can access the Event Log by typing the controller IP address in the URL box in the browser. If you are experiencing problems, the event log will usually provide details relating to the problem.