Accessing Siemens PLCs With LUCA

Langner Communications Documentation
Accessing Siemens
PLCs with LUCA
Version 7.1

Accessing Siemens PLCs with LUCA Page 2
Copyright 2005-2009 Langner Communications GmbH All rights reserved
Copyright 2005 Langner Communications GmbH, Foredder. 12, D-22359 Hamburg
All rights reserved.
Langner, LUCA, i-Plant, the i-Plant logo, P2B, FactoryXML and the FactoryXML logo are registered trademarks of Langner
Communications AG.

About Langner Communications
Langner Communications GmbH offers the broadest product range for interfacing Siemens PLCs. The software and
consulting company was founded in 1988 and serves more than 3000 customers in Europe, USA, and Asia. Many well-
known software vendors use Langner component software in their products. For more information please check
www.langner.com.

Content

Introduction ............................................................................................................... 4
LUCA product packages for accessing Siemens PLCs ......................................................................................................... 5
Reladed products ................................................................................................................................................................... 5
Getting further help ................................................................................................................................................................ 6
Integrating LUCA into your development environment .......................................................................................................... 6
Master/Slave protocols (S7-Functions, MPI, Fetch/Write, AS511, RK512, NetLink) 7
Characteristics and requirements .......................................................................................................................................... 8
The LUCA component VSxPLC ............................................................................................................................................. 8
Selecting and registering process variables .......................................................................................................................... 8
Selecting the connection type ................................................................................................................................................ 9
Implementing the processing logic ......................................................................................................................................... 9
Starting and Stopping the transmission ............................................................................................................................... 10
Sample programs ................................................................................................................................................................. 10
Special cases ....................................................................................................................................................................... 10
Send/Receive protocols (ISO-On-TCP, 3964R, UDP) ................................................ 12
Characteristics and requirements ........................................................................................................................................ 13
ISO-On-TCP (RFC1006) ...................................................................................................................................................... 13
3964R................................................................................................................................................................................... 14
UDP...................................................................................................................................................................................... 16
The PLC Simulator ................................................................................................... 17
User interface ....................................................................................................................................................................... 18
Protocol details..................................................................................................................................................................... 18
Variables .............................................................................................................................................................................. 18
Many software developers use the LUCA component software mainly to access Siemens PLCs from their application
programs. For this reason, this document is focused on how to exchange data with a S5 or S7. Therefore you don't have to
read through the complete LUCA documentation if PLC access is what you are interested in most.
LUCA product packages for accessing Siemens PLCs
Depending on the specific PLC configuration, you will need several or all of the following LUCA product packages:
LUCA S7 Tools Protocols for Siemens S7: S7-Functions, MPI, RFC1006 (ISO-on-TCP)
LUCA S5 Tools Protocols for Siemens S5: AS511 (PG Interface), Fetch/Write, RK512, 3964R
LUCA TCP/IP Tools TCP/IP base protocols as required by LUCA S7 Tools and LUCA S5 Tools when connecting via
Ethernet and TCP/IP.
LUCA Async Tools Base protocols for async serial transmission as required by LUCA S7 Tools and LUCA S5 Tools
when connecting via MPI, AS511, RK512, 3964R.
In addition, the following LUCA product packages may be interesting if you need access to peripherals from other vendors:
LUCA Fieldbus Tools Contains the Modbus protocol
LUCA A-B Tools Contains protocols for accessing Allen-Bradley PLCs (PLC-5 und SLC500)
Last but not least, the following product packages enable you to develop sophisticated alarm messaging applications:
LUCA Email Tools Automated email transmission, including file attachments
LUCA SMS Tools Automated SMS/Pager transmission
LUCA Voice Tools Transmission of audio messages via speech synthesis and telephony
LUCA Fax Tools Automated fax transmission
Reladed products
Langner Communications offers a broad product range for interfacing factory automation peripherals. The following products
complement LUCA's functionality:
PowerOPC Client
Developer
This product includes an ActiveX control for developing OPC client applications. Use it to access
any OPC server from your application. The difference to LUCA is that LUCA directly links the
required driver software to your application program, while in OPC, the driver software is
implemented in an OPC server process.
go*PLC go*PLC may be considered as LUCA's little brother. go*PLC is limited to ActiveX and supports
only Siemens PLCs, while LUCA also includes C++ classes and VCL components and does
much more in addition to Siemens connectivity.
JMatic JMatic is a 100% pure Java library for accessing Siemens PLCs. JMatic is platform independent
and runs on Linux and OS/400, among other operating systems.
Industrial Ethernet
Powerpack
This product may be considered as LUCA's counterpart for the Siemens S7. It consists of Step7
function blocks which supercharge the classic Siemens Send/Receive interface. The Industrial
Ethernet Powerpack may be used for triggered, message-based data exchange from the PLC
including buffering on the PLC. Therefore, in case of network breakdowns, crucial data such as
quality data may be automatically restored.
i-Plant If you "only" want process data to be archived in a database or displayed on screen, there is little
reason to start writing a custom application from scratch. In a situation like this, consider i-Plant
an alternative to LUCA. i-Plant is a web based HMI product, including many of the functions
needed in everyday plant management.
Getting further help
Langner Communications offers training seminars for interfacing Siemens PLCs from custom application software. Please
check www.langner.com or inquire for an inhouse seminar at your site.
Furthermore, our experienced engineers may assist you to get your application running in the shortest amount of time
possible.
Integrating LUCA into your development environment
This document assumes that you already have LUCA successfully installed and integrated into your development
environment. Other parts of the LUCA documentation explain how this is done.


Characteristics and requirements
The protocols described in this chapter are predominantly used for data exchange between the PLC and the PC. They share
a common master/slave architecture, which must be implemented in a loop:
1. The PC application issues a request. For example: Read data block.
2. The PLC answers the request. For example: Content of requested data block.
3. As the PLC's answer is only a snapshot for this given moment in time, an application which intends to monitor the
process continually must repeat issueing requests: GOTO 1.
All interaction is initiated by the PC (=master). The PLC always plays a passive role (=slave). Master/Slave protocols are
preferred by many programmers because the PLC doens't need to be reprogrammed.
Requirements
S7-Functions, NetLink, AS511 and MPI don't require a specific PLC configuration. All other protocols mentioned in this
chapter do require PLC reconfiguration.
You must know specifics in respect to the transport, such as addresses and communication parameters.
You must know the PLC's memory layout (location of specific process variables in the PLC's DBs). When using a S7,
the memory layout may be imported with the software tool "S7 project import", which is part of the LUCA distribution.
NetLink needs an ethernet gateway (IBH Link or Hilscher NetLink) connected to the MPI interface of the plc.
The LUCA component VSxPLC
The LUCA component VSxPLC integrates all master/slave protocols for Siemens PLCs. The advantage is one unified
interface for both S5 and S7 and all protocol variants. When migrating from one type of connection to another, there is little
code to rewrite in your LUCA application.
The process variables that you intend to monitor are registered once at VSxPLC after instantiation. Thereafter, VSxPLC
peridically polls the process values for the registered variables. If any process value changes, the application is notified via
the callback method OnValueChange.
The following section illustrates how to use VSxPLC. Details can be found in the document ObjectLUCA.pdf in chapter
"ObjectLUCA extended components", section "VSxPLC".
Selecting and registering process variables
VSxPLC maintains a variable list indicating which process variables are to be monitored. Variables are accessed only by
symbolic variable names (ie. ASCII strings). Therefore, the variable list must first be initialized by indicating the memory
location and data type of every specific process variable.
Importing the memory map from the Step7 project
The easiest way to determine which process variables are to be monitored is to use the Langner software tool "S7 project
import", which is included in the LUCA distribution. After launching the tool, all you have to do is indicate the path name of
the respective Step7 project. Thereafter, all process variables definied in this project are listed in a table. You may then cut
this table down to those variables which you actually need in your LUCA application.
The S7 import tool is launched via the Windows start menu in the folder "LUCA/Utilities", menu item "S7 project import".
The import tool creates a CSV file which may also be inspected with Excel (see below).

You may also use the import tool to interactively test your variable set. By pressing the "Test" button, you are asked to
supply the necessary connection details. If your PLC is online, the tool then connects to the PLC and displays live values for
the process variables included in your table.
After you have checked that everything is ok, save the CSV file to a desired folder. It may thereafter be loaded into your PC
application using the method RegisterFromFile.
Registering single process variables in source code
Rather than loading a CSV configuration file you may also register single process variables in source code. VSxPLC uses
two different methods to do this:
RegisterDBVariable registers variables which are stored in data blocks (DBs).
RegisterVariable registers variables which are stored in all other PLC operands (inputs, outputs, timer, counter,
memory).
In either case you must specify the memory location and data type of the variable in question, using the common Siemens
syntax which is documented in the document ObjectLUCA, section VSxPLC.
Selecting the connection type
VSxPLC supports many different connection type, so you must specify which protocol to use.
Connection Method
MPI (using the "PC Adapter") VSxPLC.CreateMPI
S7-Functions VSxPLC.CreateS7Functions
Fetch/Write (TCP connection) VSxPLC.CreateFetchWrite
Fetch/Write (ISO-on-TCP connection) VSxPLC.CreateFetchWrite
AS511 VSxPLC.CreateAS511
RK512 VSxPLC.CreateRK512
NetLink (MPI-Ethernet-Gateway) VSxPLC.NetLink
The create methods do not initiate actual connection establishment. This is done by the method Start, which is documented
below. If you call a create method during an established connection, the ongoing transmission is stopped and the connection
is reinitialized. However, data transmission resumes only after you call the Start method, which is documented below. A
create method does not affect the list of registered process variables.
Implementing the processing logic
All process variables registered with either RegisterFromFile, RegisterVariable, or RegisterDBVariable are continuously
monitored by VSxPLC. This is done by using a polling loop in the background. Any change in process values is reported by
the callback method OnValueChanged. Therefore, you have to implement your processing logic (such as database storage,
on-screen display etc.) within this function.
OnValueChanged is passed a list containing the symbolic variable names. To determine the corresponding process value,
call the GetValue method inside OnValueChanged. GetValue is passed the respective variable name. The sample
programs (see below) illustrate how this is done.
For manipulating process variables, call the SetValue method. If the update was successful, this function returns "true",
otherwise "false".
Starting and Stopping the transmission
After all mentioned steps are implemented, start transmission by calling the Start method. Afterwards, VSxPLC initiates
connection establishment according to the parameters used in the create method. The next step is that the
OnValueChanged callback method is fired and delivers initial values for all registered process variables. Thereafter,
OnValueChanged is called only for variables for which new process values are available.
For stopping transmission, call the Stop method.
Sample programs
C++ classes
\Luca\Samples\ObjectLUCA\CppClasses\VSxPLCSample
\Luca\Samples\PLCSamples\C++\SimpleSample
VCL components
\Luca\Samples\ObjectLUCA\VCLComponents\VsxPlcSample
\Luca\Samples\PLCSamples\Delphi\SimpleSample
ActiveX controls
\Luca\Samples\ObjectLUCA\ActiveX\VisualBasic\VSxPLC-Sample
\Luca\Samples\PLCSamples\VB\SimpleSample
\Luca\Samples\ObjectLUCA\ActiveX\VBA\Excel\S7-FetchWrite.xls
Special cases
Every now and then, clever PLC programmers come up with ideas how to optimize communication with PCs. One popular
technique is to use special "flags" to incidate that data has changed. The idea is that the PC will continuously poll only the
"flag", which is usually maintained in a memory byte, and poll the "real" data, which is maintained in a data block (DB) only
when the "flag" indicates changes.
To implement a logic like this, you cannot use VSxPLC, because VSxPLC always polls the "real" data. However LUCA does
come with several more low-level components which may be used to cope with this situation. These components are:
VMPIExt
VS7FuncExt
VS7FetchWriteExt
VAS511Ext
VRK512Ext
The major difference to VSxPLC is that all these components do not perform a polling loop in the background. Instead, they
perform "one-shot" polls. You may indicate for every transaction if you want to read DBs, memory bytes, inputs, outputs etc.
Therefore, transactions can be totally controlled by your application.
Another difference to VSxPLC is that these components deliver raw binary data which must be transformed into PC data
types. The VSxPLCTypeConverter may be used to ease this process.
Sample programs
C++-Klassen
Folder: \Luca\Samples\ObjectLUCA\CppClasses
S7FetchWriteSample Client application for Fetch/Write
S7MPISample Client application for MPI
S7RK512Sample Client application for RK512
Visual Basic
Folder: \Luca\Samples\ObjectLUCA\ActiveX\VisualBasic
S7MPI-Sample Client application for MPI
Vs7FetchWriteExt-TCP Client application for Fetch/Write on top of TCP
Vs7FetchWriteExt-
RFC1006
Client application for Fetch/Write on top of ISO-on-TCP
VS7FuncExt-Sample Client application for S7 functions
Vrk512Ext-Sample Client application for RK512
Vas511Ext-Sample Client application for AS511
Delphi
Folder: \Luca\Samples\ObjectLUCA\VCLComponents
VS7MPISample Client application for MPI
Vs7FetchWriteExt-TCP Client application for Fetch/Write on top of TCP
Vs7FetchWriteExt-
RFC1006
Client application for Fetch/Write on top of ISO-on-TCP
Vs7FuncExtSample Client application for S7 functions
Vas511ExtSample Client application for AS511


Characteristics and requirements
The term "Send/Receive" is used by Siemens for transport-level protocols. These protocols are more low-level than the
Master/Slave protocols. They must actively be serviced by the Step5/Step7 program running on the PLC. Siemens supplies
special function calls for this purpose, for example, AG_SEND and AG_RECV.
The problem is that standards end at this point. How those function calls are used is completely in the hands of the PLC
programmer. Therefore, you must have detailed information on how any Send/Receive logic is implemented in a specific
PLC project. Interpreting data contained in any telegram may not be automated using the Step7 project import as it is not
specified in the telegram which data block (DB) actually is transmitted. Therefore, you must explicitly call
VSxPLCTypeConverter to transform from PLC data types to PC data types.
A considerable advantage of Send/Receive protocols is that they support message-based transmission. Therefore, the
receiving process on the PC end may implement event driven architectures rather than polling redundant data in a loop.
Requirements
All connection types covered in this section must be configured on the PLC.
Transmission must explicitly be implemented in the Step5/Step7 program.
You must have detail knowledge about how telegrams are set up.
Protocol differences
When it comes to TCP/IP, you have the choice between ISO-on-TCP and UDP. In theory, TCP could also be configured,
however this is not recommended.
Even though you may configure TCP on the PLC, don't do it. TCP is stream-oriented and does not insure packet integrity.
Therefore, TCP data may arrive with a "beginning" and "end" different from what the transmitting process had intended. A lot
of complications can and will result from this. Siemens implemented ISO-on-TCP for a good reason; use it.
The difference between ISO-on-TCP and UDP is that UDP is not error-correcting. UDP is, however, error-detecting.
Telegrams that UDP discovers to be corrupted are not delivered to the receiving process. Therefore, in case of transmission
errors, the application will suffer loss of data. If you are unable to cope with this at the application level, use ISO-on-TCP.
3964R is a protocol for async serial (point-to-point) transmission. You won't find it in S7 environments often, however it is still
prevalent in S5 environments. Please note that 3964R will not run stable over simple RS232/Ethernet gateways. Langner
Communications offers a dedicated protocol converter from 3964R to TCP/IP that may be used in such situations.
ISO-On-TCP (RFC1006)
RFC1006 is a protocol layer on top of TCP which is used mainly for packetizing data. Without RFC1006, it would not be
possible to guarantee packet boundaries when transmitting telegrams via TCP.
Addresses
RFC1006 uses TCP port number 102 for the server process, ie. the PLC. The TCP port number of the client, ie. the PC,
does not matter and is assigned randomly.
A specific RFC1006 connection is identified by using a TSAP (Terminal Service Access Point). A TSAP is an ASCII string of
up to 32 characters. Please note:
TSAPs are case significant
a client TSAP (ie. a TSAP for the PC application) must be specified even if the PLC is configured to accept any
incoming PC connection, because otherwise protocol errors will occur.
The LUCA component Vrfc1006
LUCA implements the RFC1006 protocol in the component Vrfc1006. In order to use Vrfc1006, you must also instantiate
and configure the lower level protocol layers. This is achieved by the LUCA components Vtcp and Vsocket. The reason
behind this modular architecture is that you are using the exact same component when needing TCP alone in other
environments.
The protocol stack looks like this:
Vrfc1006->Vtcp->Vsocket
After instantiating all components, a protocol stack is created by using the Downlink property or the SetDownlink method.
Thereafter, parameters are set to provide connection details:
Vrfc1006:
Address = The PLC's TSAP
Localid = The TSAP of the LUCA application
Vtcp
Address = 102 (always)
Vsocket
Address = The PLC's IP address or symbolic hostname
You may now call Vrfc1006.Connect for actual connection establishment. If connection establishment was successful, the
OnConnect callback routine is called.
The method PutData may then be used to transmit telegrams to the PLC. Make sure to convert data types to PLC formats
before starting the transmission. This can be achieved by using the VSxPLCTypeConverter component.
When telegrams arrive from the PLC, the callback routine OnDataReceived is called. Receive data plus length indication is
passed as parameters. You must then convert PLC data types to PC data types by using the VSxPLCTypeConverter
component within OnDataReceived. Please refer to the ObjectLUCA documentation, chapter 5.2.
In case of errors the callback routine OnError is called.
To end a session, call the Disconnect method. After successful disconnect, the callback routine OnDisconnect is called.
Sample programs
C++ classes
\LUCA\Samples\ObjectLUCA\CppClasses\Vrfc1006Client
VCL components
\Luca\Samples\ObjectLUCA\VCLComponents\Vrfc1006Sample
ActiveX components
\Luca\Samples\ObjectLUCA\ActiveX\VisualBasic\Vrfc1006-Sample
3964R
3964 and 3964R are packetizing protocols for communicating with Siemens PLCs via async serial (point-to-point) links.
While 3964R is error-correcting, 3964 does not supply any kind of error checking and therefore is not recommended.
For using 3964R, the PLC must be configured properly, and the Step5/Step7 program must actively call functions (FB7, FB8)
for doing the transmission.
Parameters
The BLOCKSIZE parameter determines the length (size) in bytes of a telegram. Default block size is 128 byte. If larger
telegrams are passed to LUCA, such telegrams are automatically split into multiple consecutive telegrams. Note however
that not all PLC models do support consecutive telegrams. In this case, don't try to transmit blocks larger than indicated by
the BLOCKSIZE parameter.
The most frequent pitfall with 3964R is setting the transmission priority incorrectly. This parameter must be set differently on
PLC and PC. If the PLC is configured for "high" priority, the PC must be configured for "low" priority, and vice versa. If both
PC and PLC use the same setting, protocol errors will occur.
The LUCA components V3964 and V3964r
The protocols 3964 and 3964R are implemented in the components V3964 and V3964r. In order to use these components,
you must create a full protocol stack by instantiating the additional LUCA components Vasync and Vcom. This modular
architecture helps to write reusable code. The protocol stack looks like this:
V3964r->Vasync->Vcom
After having instantiated all components, use the Downlink property or the SetDownlink method to connect components to
a stack.
Set communication parameters as follows:
V3964r:
Blocksize = Max. telegram size
prio = transmission priority (PrioHigh/PrioLow).
This setting must be different from the PLC's setting.
Vasync:
no parameters necessary
Vcom:
Address = Number of the async serial interface where the PLC is connected
(e.g. 3 = COM3)
Speed = Transmission speed in bits per second
Frame = Character frame (e.g. 8N1, 8E1)
Flow = Flow control use NONE
Call V3964r.Connect for connection establishment. The callback routine OnConnect indicates success.
The method PutData may be used to transmit telegrams to the PLC. Make sure to convert from PC to PLC data types before
calling PutData by using the component VSxPLCTypeConverter.
Incoming telegrams from the PLC are passed to the application by the OnDataReceived callback routine. Please note that
this data is in PLC format, so it has to be converted to PC format by using the component VSxPLCTypeConverter. This
component is documented in the manual ObjectLUCA, chapter 5.2.
If fatal errors occur, the callback routine OnError is called.
For terminating a session, call the Disconnect method. Disconnect is signalled by the callback routine OnDisconnect.
Sample programs
C++ classes
\Luca\Samples\ObjectLUCA\CppClasses\V3964rSample
VCL components
\Luca\Samples\ObjectLUCA\VCLComponents\V3964rSample
ActiveX controls
\Luca\Samples\ObjectLUCA\ActiveX\VisualBasic\3964R-Sample
UDP
UDP (User Datagram Protocol) provides for packetized transmission on the same transport layer as TCP. Ie., UDP directly
interfaces to IP. There is no connection establishment with UDP, and also no error correction. This makes UDP a very basic
and fast protocol.
Addresses
Similar to TCP, UDP uses port numbers to identify specific target processes. In order to use UDP, you must configure a
"connection" on the PLC, supplying the PLC's port number and the PC's port number.
The LUCA component Vudp
UDP is implemented in the component Vudp. In order to use UDP, you must also instantiate a Vsocket component to
specify the target IP address.
The protocol stack looks like this:
Vudp->Vsocket
After all components are instantiated, link them to a protocol stack by using the property Downlink or the method
SetDownlink.
Thereafter, set parameters as follows:
Vudp:
Address = The PLC's UDP port number
Localid = The PC's port number
Vsocket
Address = The PLC's IP address
Although UDP is a connectionless protocol, you have to call Vudp.Connect to initialize buffers. The callback routine
OnConnect indicates that the link is ready for transmission.
The method PutData can be used to transmit telegrams to the PLC. Please note that you must call VSxPLCTypeConverter
first to transform from PC data types to PLC data types.
When incoming telegrams are available from the PLC, the callback routine OnDataReceived is called. You must call
VSxPLCTypeConverter to convert from PLC data types to PC data types. Please refer to the document ObjectLUCA,
chapter 5.2.
To end your session, call the method Disconnect. Deinitialization is indicated by the callback routine OnDisconnect.

LUCA comes with a PLC network simulator so that you can test-drive your application even when no PLC is available.
User interface
The LUCA PLC simulator is launched via the Windows Start menu in the folder "LUCA/Utilities", menu item "SPS-
Simulation". The simulator doesn't have a user interface in the nearer sense. If the simulator is running, a yellow symbol with
the letters "SPS" shows up in the Windows task bar.

When clicking the right mouse button on the "SPS" symbol, a menu pops up. This menu may be used to terminate the PLC
simulator. However by clicking the menu item "Console", a dialog window appears, listing active connections. The PLC
simulator can handle up to 25 connections.

Protocol details
The PLC simulator uses the Siemens Fetch/Write protocol. To initiate a connection with your LUCA application, use the
following parameters:
IP address: localhost
Protocol: Fetch/Write on TCP
Port number for Fetch: 8000
Port number for Write: 8000
Variables
The variables used by the PLC simulator are documented in a CSV file that can also be loaded into VSxPLC using the
RegisterFromFile method. You may also check the simulator with the precompiled VSxPLCSample program.

Accessing Siemens PLCs With LUCA

Caricato da

Informazioni sul documento

Descrizione originale:

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Accessing Siemens PLCs With LUCA

Caricato da

Copyright:

Formati disponibili

Langner Communications Documentation

Potrebbero piacerti anche