OSI Software, Inc.
Siemens SIMATIC NET
Interface to the PI System
for S5, TI505 Series PLC's and PCS
version 1.4.0 (and greater)
How to Contact Us
Phone / (510) 297-5800 (main number)(510) 297-5828 (technical support)
Fax / (510) 357-8136
Internet /
World Wide Web /
Bulletin Board / (510) 895-9423
Telebit WorldBlazer modem (Hayes, MNP, or PEP compatible)
8 data bits, 1 stop bit, no parity, up to 14400 bps download
protocols: Xmodem, Ymodem, Zmodem, Kermit
Mail / OSI Software, Inc.
P.O. Box 727
San Leandro, CA 94577-0427
USA
OSI Software GmbH
Hauptstrae 30
D-63674 Altenstadt 1
Deutschland /
OSI Software, Ltd
P. O. Box 8256
Level One, 6-8 Nugent Street
Auckland 3, New Zealand
Unpublished -- rights reserved under the copyright laws of the United States.
RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c)(1)(ii)
of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013
Trademark statement—PI is a registered trademark of OSI Software, Inc. Microsoft Windows, Microsoft Windows for Workgroups, and Microsoft NT are registered trademarks of Microsoft Corporation. Solaris is a registered trademark of Sun Microsystems. HPUX is a registered trademark of Hewlett Packard Corp.. IBM AIX RS/6000 is a registered trademark of the IBM Corporation. DUX, DEC VAX and DEC Alpha are registered trademarks of the Digital Equipment Corporation.
ssimaticnet125.doc PI-IN-SI-SIMAT-NT
1997 OSI Software, Inc. All rights reserved
777 Davis Street, Suite 250, San Leandro, CA 94577
November 19981
OSI Software, Inc.
Table of Contents
Introduction
Overview
TI505 Series PLCs
Schematic
Required Hardware and Software
PI Point Configuration
Input Tag Configuraton
Output Tag Configuration
Tag Configuration for PCS Systems
Example install.tag file:
Install.CSV file
Configuration Files
SINET.CFG
SINET.INI
The Windows NT Control Panel
Softnet – S7
Hardnet - CP1413
The COML1413 Setup Program......
S5 vs TI505 Connections......
S5 Configuration
505 Configuration
Performance
Interface Performance
Multiple Copies of the Interface
Performance Point
IO Rate Tags
Installation
Pre-installation Notes
Additional Pre-installation for a PI 2 Home Node
Installation
Updating the Interface
The Startup Command File
Shutdown
Error and Information Messages
General
The PIPC.LOG file
The Interface-specific Log File
Digital States that are Written to Tags when Errors Occur
Siemens Simatic Net (TI-505, S5) Interface Operation
Data Acquisition
Hints for the System Manager
Native TCP/IP, RFC1006 TCP/IP, and H1
Troubleshooting
RB_RESPONSE=16 with CP1413 Card
Appendix A
Supported Data Types for Simatic TI505 PLCs
Appendix B
Output Tag Configuration Examples
Individual Writes
Block Write Example
Appendix C
Tracing Send Receive Messages
Appendix D The ISO/OSI Reference Model
Appendix E
Introduction
Overview
The SIEMENS SIMATIC NET Interface to the PI System runs under Windows NT Server or Workstation, Intel Platform.
The interface transfers data between
- TI 505 Series PLC
- S5 Series PLC
and the Plant Information (PI) System. Although the interface manual refers to Softnet-S7 software libraries, the interface does not support S7 PLCs. The “7” in the Softnet-S7 library name refers to the 7 layers in the ISO/OSI reference model (see Appendix D). However, the SIEMENS SIMATIC NET Interface to the PI System only utilizes the first 4 layers in the ISO/OSI reference model. That is, the interface is said to communicate via the so-called read/write protocol, which utilizes only the first 4 layers of the ISO/OSI reference model.
The read/write protocol allows the interface to read from and write to specific memory locations in S5 and TI505 PLCs. Since the read/write protocol only utilizes the first 4 layers of the ISO/OSI model, report by exception is not supported by the interface. In other words, the interface must poll the TI 505 or S5 PLCs to get data. One advantage of using only the first 4 layers of the ISO/OSI model is that a wide range of PLCs supports the 4-layer model. Even those PLCs that support the 7-layer model require programming before they support report by exception. The read/write protocol was chosen for its portability.
There are several references to the Siemens PCS in this manual. To clarify, this interface does not communicate to the Siemens PCS. The interface can merely read an install.tag file that can be downloaded from the Siemens PCS. The interface communicates directly to S5 PLCs or TI 505 PLCs.
Note:
The current version of the interface went through limited tests of data types for the S5 Series PLC. See section "PI Point Configuration" later in this manual for supported data types. A customer who requires additional data type support must be prepared for onsite tests.
SINEC AP and SINEC TF are not supported. The protocols are described in detail in:
SIEMENS Publications:
SINEC CP 143 mit COM 143
Bestell-Nr. 6GK1970-1AB43-0AA0
And
SIMATIC NET
SEND/RECEIVE-Programmierschnittstelle
TI505 Series PLCs
TI505 PLCs have either TI545 or TI555 communications processor units (CPUs) associated with them. Both 545 and 555 CPUs are supported by this interface. Any PLC or CPU with a name of the form TI5X5 is part of the TI505 series PLCs and should be supported by this interface. The TI505 series PLCs are distinctly different from the TI500 series PLCs, which are not supported by this interface. The TI500 series PLCs have names of the form TI5X0. For example, TI520 and TI530 PLCs are part of the TI500 series and are not supported. The communications processors associated with TI500 series PLCs have names of the form TI5X0c, such as TI520c and TI530c (also not supported).
Even though TI500 series PLCs are not supported by this interface, it is worthwhile to discuss them a bit further, owing to the large amount of confusion surrounding this product line. TI500 series PLCs communicate via NITP (non-intelligent terminal protocol) or TBP (transparent byte protocol). One method of communicating to these PLCs is with a Task Code Driver that can communicate via NITP or TBP. OSI does not have such a task code driver. However, TI500 series PLCs also can communicate to a TIWAY driver, and OSI does have a TIWAY interface. If a TIWAY NIM (network interface module) is set up, OSI’s TIWAY interface should be able to communicate to TI500 series PLCs.
TI305 and TI405 PLCs are also a source of confusion. The Siemens Simatic Net Interface does not communicate to TI305 or TI405 PLCs, but they are still worth discussing. Siemens no longer supports these PLCs. TI305 PLCs use either TI330 or TI335 communication processor units (CPUs). TI405 PLCs use TI435 CPUs (there are probably other 400 series CPUs). Both TI305 and TI405 PLCs communicate via the Hostlink protocol across a serial line. Hostlink is a publicly published protocol. OSI does not have an interface that communicates via Hostlink. More information can be obtained about the Hostlink protocol from Siemens manual number 305-8102.
Schematic
Required Hardware and Software
The Communication Processors (CP) and the library are not part of this PI interface. They can be purchased from SIEMENS.
Supported ScenariosSystem / Network / Remote CP / Host CP
(Hardware on interface node) / Library
(Software on interface node)
TI 505 Series / H1 / CP 1434 TF
PPX:505-CP1434TF / CP 1413 (ISA)
6GK1 141-3RB01 / TF-1413
6GK1701-1TBxx-3AA0
CP 1613 (PCI)
6GK1161-3AA00 / TF-1613
6GK1716-1TBxx-3AA0
Windows NT compatible Ethernet Card / SOFTNET-S7 Basic
6GK1704-1CWxx-3AA0
SOFTNET-S7 Extended
6GK1704-1CXxx-3AA0
S5 / H1 / CP 1430 TF
6GK1 143-0TA01 / CP 1413 (ISA)
6GK1 141-3RB01 / TF-1413
6GK1701-1TBxx-3AA0
CP 1613 (PCI)
6GK1161-3AA00 / TF-1613
6GK1716-1TBxx-3AA0
Windows NT compatible Ethernet Card / SOFTNET-S7 Basic
6GK1704-1CWxx-3AA0
SOFTNET-S7 Extended
6GK1704-1CXxx-3AA0
PCS / H1 / TI 505/H1 / TI 505/H1 / TI 505/H1
The currently recommended hardware on the interface node is a CP 1613 communications processor. The CP 1613 is the replacement of the CP 1413, which is being phased out by Siemens. The throughput of the new CP 1613 is about 10 times faster than the old CP 1413 because the CP 1613 uses a PCI bus instead of an ISA bus. The TF-1613 software libraries come pre-installed on the CP 1613. This means that the TF-1613 software libraries do not need to be separately installed on the interface node if the CP-1613 processor is used.
While the CP1413 was being phased out and before the CP 1613 was released, OSI was recommending that the SOFTNET-S7 (basic or extended) software be installed on the interface node in conjunction with a standard Windows NT compatible Ethernet card. Although the difference is speed is not as great as between the CP 1413 and CP 1613, the CP 1613 processor is faster than the SOFTNET-S7/Ethernet Card combination. This is because the CP 1613 card, unlike the Ethernet card, has a built-in processor that can be used to process incoming transactions. With SOFTNET-S7, the CPU of the personal computer must process the incoming transactions.
Using a CP 1413 or CP 1613 is referred to as using “Hardnet.” Using SOFTNET-S7 in conjunction with a standard Windows NT compatible Ethernet card is referred to as using “softnet.”
Supported FeaturesInterface Platforms supported / Windows NT (Intel)
Order Code / GmbH
Vendor Software Required / Yes
Sign up for Updates / Yes
Exception Reporting / yes
PI API Node Support / Yes
UNIINT / Yes
Input / Scan based[1]
Outputs / Event based[2]
Text Transfer / Yes[3]
Configuration Data / Half automatic for TI505 Systems
Multiple Links / Yes
Failover / No
Number of Points / Unlimited
PI Point Configuration
The following database details are necessary for configuring a PI point for use with the SIMATIC NET Interface.
Tag
This attribute is the name of the PI point. Any tag name can be used, according to the normal PI point naming conventions.
Extended Descriptor
Extended Descriptor keywords supported for both TI505 and S5 Series PLCs:
PERFORMANCE_POINT
If the keyword PERFORMANCE_POINT is specified in the extended descriptor, then the PI Point is a performance point. Performance points are described under the section entitled “Performance”.
EVENT=tagname
If a tagname is specified using the EVENT keyword for an input point, then values for the input point are read only when tagname changes value. If the EVENT keyword is not specified, then the input point will be scanned periodically as described under the Location4 PI Point attribute and under the /f command-line argument. tagname can be any valid tag name. For example:
EVENT=sinusoid
Z=InstZero
The Z keyword is used to specify the instrument zero (InstZero). The instrument zero is used in the conversions that are described under the SquareRoot PI Point attribute. If the Z keyword is not found, then InstZero is assumed to be zero.
Extended Descriptor keywords supported only for S5 Series PLC:
BCD=#
The BCD keyword is used to specify that the current memory word inside a DB is of BCD type. The number in a range of 1 to 8 defines the number of BCD digits stored in one word. It is only possible to use up to 8 BCD digits in one PI tag. The PI tag should be of type float to avoid overflows.
NOTE:
Floating point numbers do only have 6 significant numbers. If you need all BCD numbers significant you should limit BCD to 4!
PLCSIG=<BYTE,RBYTE,LBYTE,INT16,INT32,FLT>
By default the interface will read the memory from the PLC in the following standard C data types:
<none> / Unsigned short / Short / Integer
BYTE, LBYTE / Char / - / Char
RBYTE / Char / - / Char
INT16 / Unsigned short / - / Short
INT32 / Unsigned integer / - / Integer
FLT / Float / - / Float
STRG / - / - / -
This may be changed by using the parameter PLCSIG in the extended descriptor.
Example:
Exdesc: PLCSIG=FLT, Instrumenttag: DB50,DW83 / Read the DWORD 83 from DB 50 as a Siemens S5 floating point numberExdesc: PLCSIG=INT32, Instrumenttag: DB50,DW83 / Read the DWORD 83 from DB 50 as an integer
Exdesc: PLCSIG=STRG, Instrumenttag: DB50,W83,8 / Read the WORD 83 from DB 50 and the following 8 Byte (4 WORDS) as string.
NOTE:
if the string is defined of length <x> (DB20,W1,<x>) the maximum string length to be read is <x>, while the maximum string length to be written is <x-1>. That is due to the interface writing a trailing NULL to the S5 memory. As an addition, the length of the string will be extended to fit the S5 memory (DB20,W1,3 will be extended to a 4 character string, as S5 word memory is 2 byte oriented).
MASK=0xh
The MASK keyword is used to specify the Mask which is applied (via logical AND) to the PLC value. If the MASK keyword is not found, then the Bitmask is assumed to be 0xffffffff.
The result will be shifted to the first nonzero bit in the Bit mask, zero bits within the bit mask will not be compacted.
Extended Descriptor keywords supported only for TI505 Series PLC:
OUTPUT_MASTER
The interface can be configured to write data to individual memory locations or a block of memory locations. When a block of memory locations are written, the write is triggered with an output master tag. The output master tag must have the keyword “OUTPUT_MASTER” in the extended descriptor. See “Output Tag Configuration” for more information.
MASK=0xh
The MASK keyword is used to specify the Mask which is applied (via logical AND) to multibyte C memory locations. If the MASK keyword is not found, then the Bitmask is assumed to be 0xffffffff.
The result will be shifted to the first nonzero bit in the Bit mask, zero bits within the bit mask will not be compacted.
MAP=map
The MAP keyword is used to specify a bitmap. The bits from an integer word that is read from the PLC are rearranged according to the bitmap, and the result is sent to PI. Bit mapping is supported only input tags. Moreover, the input tags must be integer or digital PI Points or else the bit map will not be applied.
The format of the bit map is:
MAP=uuvvwwxxyyzz
where uu, vv, ww, yy, and zz each refer to a single bit. A leading zero is required if the referenced bit is less than 10. The lowest possible bit is 01 and the highest possible bit is 32. Up to 32 bits can be mapped.
A bitmap of 0307120802 will map the second bit of the original word to the first bit of the new word, the eighth bit to the second bit, the twelfth bit to the third bit, etc. The high-order bits of the new word are padded with zeros if the bits are not specified.
Say a single 16-bit PLC register holds the state of four different thermocouples. The first 4 bits correspond to the first thermocouple, the second 4 bits correspond to the second thermocouple, etc. Four different input tags with four different bitmaps could be used to read thermocouple states. The first input tag would use a bitmap of 04030201 to read the state of the first thermocouple, the second input tag would use a bitmap of 08070605 to read the state of the second thermocouple, and so on. If the sixteen bit word from the PLC was 0000 0000 0101 0111 or decimal 87, then the first thermocouple state would be interpreted as binary 0111 or decimal 7, the second thermocouple state would be interpreted as 0101 or decimal 5, etc.
OFFS=offset
The OFFS keyword is used to specify an offset to the memory location. If the OFFS keyword is not found, then offset is assumed to be zero.
Example:
if the memory address is V.1234 and offset is specified as 4, the interface will read from memory location V.1238
Point Source
The point source is a single character, for example S (SIMATIC NET). For PI 2, the point source must be defined in the point source library.
Point Type
For a PI 2 home node, the Interface supports the PI point types real (R), integer (I) and digital (D).
For a PI 3 home node, the interface supports float16, float32, int16, int32, and digital. To simplify the discussion below, float16 and float32 will be referred to as R, int16 and int32 will be referred to as I, and digital will be referred to as D.
For S5 PLC’s the interface supports reading memory block and treating the bytes as characters. This requires string tags on the PI 3 home node.
Note on Point Type for S5 Series PLC:
See the description of the PLCSIG keyword under the description of the Extended Descriptor attribute above.
Note on Point Type for TI505 Series PLC:
The following applies to input points (Location5=0). When an input point has a PI point type of R, the interface assumes that the PLC stores its values according to standard TF Encodings (see Appendix A). For example, the interface will assume that variables in V memory are stored in Integer16 format. Likewise, the interface assumes that variables in V. or VF memory are stored in floating-point format. Hence if all of the memory types that are being read from the PLC are stored according to the standard TF Encodings given in Appendix A, then one can safely use a point type of R for all PI Points and all values should be read correctly into PI.
However, not all variables are stored according to their standard TF Encoding. Namely, variables stored in V. or VF memory are sometimes stored in Integer32 format instead of in floating point format. For this reason, when an input point has a PI point type of I or D, the interface always assumes that the target variable is stored as an integer. Hence, one can define a PI point of type I or D and read an Integer32 from V. or VF memory.
Engineering Units
The Engineering Units have to be defined in accordance with the meaning of the measured values.
Scan flag
This is usually ON for all points of this interface. If you edit this Point Attribute to OFF, then the tag is OFFLINE (no values are exchanged for this tag).
Instrument Tag
For S5 Series PLC
The memory location in the S5 that is targeted for reads or writes is defined in the InstrumentTag field. The syntax is Range[index],(type)[index](.bitnumber).
The (type) is optional. If not used, the interface will use the default type from the table below. In the current version the interface only supports DW for DWORD and W for word.
S5 Range / Description / Data typeDB / Common Data / Dword, 32 bit
MB / Merker Bereich / Byte, 8 bit
EB / Process Input / Byte, 8 bit
AB / Process Output / Byte, 8 bit
PB / Peripheral Device / Byte, 8 bit
ZB / Counter / Word, 16 bit
TB / Timer / Word, 16 bit
BS / System Data / Word, 16 bit
AS / Absolute Memory / Word, 16 bit
DX / Extended DB / Dword, 32 bit
DE / External DB / Dword, 32 bit
QB / Extended Peripheral Device / Byte, 8 bit
NOTE:
The Interface is tested only with S5 Range DB, Data type Word, Dword
Examples of symbolic addresses that can be specified in the InstrumentTag field are given in the following table.
Symbolic Address / DescriptionDB16,1 / DB modul 16, Dword 1
DB16,W1 / DB modul 16, word 1
DB16,1.1 / DB modul 16, Dword 1, bit 1
DB16,DW1 / DB modul 16, Dword 1
For TI505 Series PLC