GE PACSystems RX7i User Manual Download Page 162

Page: 162 / 276

Chapter 9. Modbus/TCP Client

GFK-2224Q

January 2017

149

zero value to identify the failure. See the section “Status Data” later in this chapter for detailed CRS failure

codes.

Command 3003, Example 1

Read four Input Registers from Input Registers in the remote Modbus/TCP device. Store the registers at location

%R20. Return the COMMREQ Status word to %R10.

Dec (Hex)

Word 1

00008 (0008)

Length of Channel command Data Block

Word 2

00000 (0000)

Always 0 (no-wait mode request)

Word 3

00008 (0008)

Memory type of CRS word (%R)

Word 4

00009 (0009)

CRS word address minus 1 (%R10)

Word 5

00000 (0000)

Reserved

Word 6

00000 (0000)

Reserved

Word 7

03003 (0BBB)

Read from a Modbus/TCP Device

Word 8

00006 (0006)

Channel number (6)

Word 9

00004 (0004)

Modbus Function Code (Read Input Registers)

Word 10

00008 (0008)

Local PLC Memory Type

Word 11

00020 (0014)

Local PLC Starting Address

Word 12

00200 (00C8)

Address in the Remote Server

Word 13

00004 (0004)

Number of Registers in the Remote Device

Word 14

00001 (0001)

Unit Identifier

(Word 7) Channel Command Number:

Word 7 identifies the COMMREQ as a Read Data from Modbus/TCP

Device command block.

(Word 8) Channel Number:

Word 8 identifies the channel number previously allocated for communication with

the remote Modbus/TCP server.

(Word 9) Modbus Function Code:

Word 9 specifies Modbus Function Code 4, Read Input Registers.

Summary of Contents for PACSystems RX7i

Page 1: ...GE Automation Controls Programmable Control Products PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q April 2017 ...

Page 2: ... to the accuracy of the information included herein Changes modifications and or improvements to equipment and specifications are made periodically and these changes may or may not be reflected herein It is understood that GE may make changes modifications or improvements to the equipment referenced herein or to the document itself at any time This document is intended for trained personnel famili...

Page 3: ... Americas Phone 1 800 433 2682 International Americas Direct Dial 1 780 420 2010 if toll free 800 option is unavailable Customer Care Email customercare ip ge com Primary language of support English Europe the Middle East and Africa Phone 800 1 433 2682 EMEA Direct Dial 420 239015850 if toll free 800 option is unavailable or if dialing from a mobile telephone Customer Care Email customercare emea ...

Page 4: ...Redundancy 11 Non HSB Redundancy 12 Effect of Redundancy Role Switching on Ethernet Communications 12 SRTP Server Operation in a Redundancy System 13 SRTP Client Operation in a Redundancy System 14 Modbus TCP Server Operation in a Redundancy System 14 Modbus TCP Client Operation in a Redundancy System 14 EGD Class 1 Production Consumption in a Redundancy System 14 EGD Class 2 Commands in a Redunda...

Page 5: ...Interface Module 25 3 3 Ethernet Port Connectors 26 Embedded Switch 26 Connection to a 10Base T 100Base Tx Network 27 3 4 Station Manager Port 29 Port Settings 29 3 5 Verifying Proper Power Up of the Ethernet Interface after Configuration 30 3 6 Pinging TCP IP Ethernet Interfaces on the Network 30 Pinging the Ethernet Interface from a UNIX Host or Computer Running TCP IP Software 30 Determining if...

Page 6: ...te Timeout Period 76 5 5 Time Stamping of Ethernet Global Data Exchanges 77 Obtaining Timestamps from the Ethernet Interface Clock 78 Obtaining Timestamps from the CPU TOD Clock 79 SNTP Operation 86 5 6 Effect of PLC Modes and Actions on EGD Operations 88 Run Mode Store of EGD 89 5 7 Monitoring Ethernet Global Data Exchange Status 92 Exchange Status Word Error Codes 93 Chapter 6 Programming EGD Co...

Page 7: ...cription 114 Establish Read Channel 2003 116 Establish Write Channel 2004 120 Send Information Report 2010 123 Abort Channel 2001 125 Retrieve Detailed Channel Status 2002 126 7 3 Programming for Channel Commands 127 COMMREQ Sample Logic 128 Sequencing Communications Requests 130 Managing Channels and TCP Connections 130 Use Channel Re Tasking To Avoid Using Up TCP Connections 131 Client Channels ...

Page 8: ... 158 Read Write Multiple Registers to from a Modbus Server Device 3005 159 9 4 Status Data 161 Types of Status Data 161 9 5 Controlling Communications in the Ladder Program 162 Essential Elements of the Ladder Program 162 COMMREQ Ladder Logic Example 163 Troubleshooting a Ladder Program 169 Monitoring the Communications Channel 170 9 6 Differences between Series 90 and PACSystems Modbus TCP Channe...

Page 9: ...ge File Transfer 205 11 6 Viewing the RX7i PLC Web Pages 206 Chapter 12 Diagnostics 207 12 1 What to do if You Cannot Solve the Problem 207 12 2 Diagnostic Tools Available for Troubleshooting 208 12 3 States of the Ethernet Interface Rack based and RX7i Embedded Interfaces 209 12 4 EOK LED Blink Codes for Hardware Failures Rack based and RX7i Embedded Interfaces 211 12 5 Controller Fault Table 212...

Page 10: ...Sluggish Programmer Response after Network Disruption 238 EGD Command Session Conflicts 238 SRTP Request Incompatibility with Existing Host Communications Toolkit Devices or Other SRTP Clients 238 COMMREQ Flooding Can Interrupt Normal Operation 238 Accelerated EGD Consumption Can Interfere with EGD Production 239 Channels Operation Depends Upon PLC Input Scanning 239 Chapter 13 Network Administrat...

Page 11: ... EGD Produced Data Exchange 43 Figure 21 Defining EGD Consumed Data Exchange 44 Figure 22 Configuring Multicast Broadcast EGD on LAN 1 45 Figure 23 Configuring Multicast Broadcast EGD on LAN 2 46 Figure 24 Setting Temporary IP Address 49 Figure 25 Expand RX7i CPU Node to Configure Ethernet Daughterboard 51 Figure 26 Install ETM001 Module in Rack Slot Expand to Configure 51 Figure 27 Expand Node to...

Page 12: ...tinued 167 Figure 63 COMMREQ Ladder Logic Segment continued 168 Figure 64 SERVER_STATUS Word bit definitions 179 Figure 65 CONFIG_STATUS Word bit definitions 181 Figure 66 OPC UA Example Subroutine 183 Figure 67 Project Inspector Ethernet Config Window 185 Figure 68 OPC UA Server Client Connection String 186 Figure 69 OPC UA Client Connection Dialog 186 Figure 70 Machine Edition Controller Hardwar...

Page 13: ...gement Tool Displaying List of Variables for an Exchange 234 Figure 96 IP Address Format for Network Classes A B C 241 Figure 97 CPE330 Overlapping Local IP Subnet Example 243 Figure 98 Expected Response Path 244 Figure 99 Actual Response Path 244 Figure 100 Gateway Connected to Two Networks 245 Figure 101 Class B Network netid and hostid Bit Formats 246 Figure 102 Use of Subnet Mask 246 Figure 10...

Page 14: ...tions over the Ethernet network using Service Request Transfer Protocol SRTP Channel commands Chapter 8 Modbus TCP Server describes the implementation of the Modbus TCP Server feature for the PACSystems family of products Chapter 9 Modbus TCP Client explains how to program communications over the Ethernet network using Modbus TCP Channel commands Chapter 10 OPC UA Server explains how to program co...

Page 15: ...tures TCP IP communication services using SRTP SRTP Client Channels Modbus TCP Server supporting Modbus Conformance classes 0 1 and 2 Modbus TCP Client supporting Modbus Conformance classes 0 1 and Function Codes 15 22 23 and 24 for Conformance class 2 Support for Unicast mode and Daylight Saving and Local Time corrections for SNTP operation Diagnostics information for the RX3i embedded Ethernet i...

Page 16: ...tem Diagram Rack based and RX7i Embedded Interfaces Features Note The RX3i CPE305 CPE310 CPE330 CPE400 embedded Ethernet interface supports a subset of these features For a list of RX3i CPE305 CPE310 embedded Ethernet interface features refer to Section 1 3 2 For a list of RX3i CPE330 CPE400 embedded Ethernet interface features refer to Section 1 3 3 Full RX3i Controller programming and configurat...

Page 17: ...e class 2 Communications with remote PLCs and other nodes reachable through routers The gateway IP address must be configured Comprehensive station management and diagnostic tools For supported commands refer to the Station Manager Manual GFK 2225J or later CPE305 310 Extended controller connectivity via IEEE 802 3 CSMA CD 10Mbps and 100Mbps Ethernet LAN port connectors Network switch that has Aut...

Page 18: ... addresses One Maximum number of connections 48 SRTP Server connections Includes A maximum of 16 Modbus TCP Server connections A maximum of 32 communication channels Each channel may be an SRTP Client or a Modbus TCP Client Any given channel can be assigned to only one protocol at a time Embedded Ethernet Switch Yes Allows daisy chaining of Ethernet nodes Serial Port Station Mgr Port RS 232 DCE 12...

Page 19: ...Chapter 1 Introduction 6 PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q RX3i Embedded Interface ...

Page 20: ...ed for Field Agent connectivity Number of IP addresses CPE305 CPE310 One CPE330 has two IP addresses CPE400 has four IP addresses one for EFA three for Ethernet LANs Maximum number of connections For CPE305 CPE310 32 SRTP Server connections includes o Up to 16 Modbus TCP Server connections o Up to 32 Client channels Each channel may be an SRTP Client or a Modbus TCP Client Any given channel can be...

Page 21: ...ory access to the Ethernet Interface through the Station Manager port or over the Ethernet cable Station Manager services include An interactive set of commands for interrogating and controlling the station Unrestricted access to observe internal statistics an exception log and configuration parameters Password security for commands that change station parameters or operation For remote Station Ma...

Page 22: ...ting channel Any given channel can be assigned to only one protocol at a time For the number and combinations of channels supported refer to Ethernet Interface Specifications on page 5 Ethernet Global Data EGD EGD Classes EGD Class 1 is configured exchanges with no logic control of EGD operation o Supported in CPE305 CPE310 CPE330 CPE400 EGD Class 2 is EGD Commands which are logic driven EGD excha...

Page 23: ... All network PME programmer connections initially use an SRTP inactivity timeout value of 30 seconds as set by the vconn_tout AUP parameter Revision 6 00 and higher PME programmers can override the initial timeout value on a particular server connection Typically the PME programmer sets the SRTP inactivity timeout to 20 seconds An inactivity timeout value of zero disables SRTP inactivity timeout c...

Page 24: ...ace determines that it has lost communications with the PLC CPU The other unit the backup unit does not initiate communications or respond on the network using the Redundant IP address It can only use the Redundant IP address if it is commanded by its CPU to become the active unit Both the active and backup unit may continue to use their individual direct IP addresses permitting programmer connect...

Page 25: ...ccurs Ethernet communications switch to the backup unit which has no knowledge of any communication state at the previously active unit The application must include logic to detect loss of communication during a redundancy role switch and to then reinitiate communication To remote hosts on the network the redundant system is viewed as a single PLC with high reliability the remote host neither know...

Page 26: ... sets the redundancy mode to active Stop IO Scan Enabled Mode In this mode I O scanning including EGD service continues when the non HSB CPU is stopped However Ethernet interfaces configured for redundant IP operation are automatically set to backup mode and normal EGD production for those interfaces is stopped Only the EGD exchanges with Produce in backup mode enabled are produced while the CPU i...

Page 27: ...erations are attempted a COMMREQ error status is returned to the local logic program When the Ethernet interface changes from active to backup state it takes down all Modbus TCP Client connections and their underlying TCP connections Because it can take some time to take down a TCP connection the redundant system should reserve a spare Modbus TCP Client connection for each connection using the Red...

Page 28: ...edundancy System FTP operations are used to transfer setup and configuration data to the Ethernet interface not for communication with the actual PLC application Therefore FTP operations should only be performed using the direct IP address SNTP Operation in a Redundancy System A PACSystems Ethernet Interface can operate as an SNTP client only so it only receives broadcast time messages from an SNT...

Page 29: ...EGD was only available in the RX3i via the RX3i Ethernet Interface module ETM001 Note For features installation and startup of the RX3i rack based Ethernet module ETM001 see Chapter 3 2 1 RX3i Embedded Ethernet Interface Indicators The Ethernet port has two LED indicators 100 and LINK The 100 LED indicates the network data speed 10 or 100 Mb sec This LED is lit if the network connection at that ne...

Page 30: ...esponding port Off No connection established at corresponding port Link Speed lower On Green Corresponding data speed is 1 Gbps or 100 Mbps Off Corresponding network data speed is 10 Mbps Module Installation For general information about CPU module and system installation refer to the PACSystems RX3i System Manual GFK 2314 Chapters 2 3 2 2 Ethernet Port Connector The RX3i CPE305 and CPE310 CPUs pr...

Page 31: ... configuration straight through or crossover attached to it with no intervention required 10Base T 100Base Tx Port Pinouts Pin Number4 Signal Description 1 TD Transmit Data 2 TD Transmit Data 3 RD Receive Data 4 NC No connection 5 NC No connection 6 RD Receive Data 7 NC No connection 8 NC No connection Note Pin assignments are provided for troubleshooting purposes only 10Base T 100Base Tx cables a...

Page 32: ...ning TCP IP Software A ping command can be executed from a UNIX host or computer running TCP IP most TCP IP communications software provides a ping command or from another Ethernet Interface When using a computer or UNIX host you can refer to the documentation for the ping command but in general all that is required is the IP address of the remote host as a parameter to the ping command For exampl...

Page 33: ...rnet Restart Pushbutton Module Installation RX7i CPU with Embedded Ethernet Interface Rack based Ethernet Interface Modules Ethernet Port Connectors Embedded Switch Connection to a 10Base T 100Base Tx Network Station Manager Port Verifying Proper Power Up of the Ethernet Interface After Configuration Pinging TCP IP Ethernet Interfaces on the Network Features of the embedded RX7i CPU Ethernet Inter...

Page 34: ...gure 6 RX7i Faceplate Ethernet LEDs The LEDs indicate the state and status of the Ethernet Interface The LEDs indicate the state and status of the Ethernet Interface 1 For the Switched Ports a For each connector the bottom LED is the LINK SPEED LED This will be on for 1000Mbps off for all other speeds Note The ETM CPE305 CPE310 only supports two speeds so for it it is ON when 100Mbps and off when ...

Page 35: ...aiting for an IP address the LAN LED blinks when data is being sent or received over the network directed to or from the Ethernet interface It remains on when the Ethernet interface is not actively accessing the network but the Ethernet physical interface is available and one or both of the Ethernet ports is operational It is off otherwise unless firmware update is occurring STAT LED Operation The...

Page 36: ...ional Ethernet plug in applications these applications are ordinarily started upon each power up or restart To restart the Ethernet interface without starting any Ethernet plug in applications press and hold the Ethernet Restart pushbutton between 5 and 10 seconds To restart the Ethernet interface into firmware update operation press and hold the Ethernet Restart pushbutton for more than 10 second...

Page 37: ...from the compartment For compatible batteries and battery installation procedures for specific CPUs refer to the PACSystems RX3i and RX7i Controllers Battery Manual GFK 2741 2 Install the CPU in the rack Refer to PACSystems RX7i Hardware Installation Manual GFK 2223 for installation instructions 3 Set the PLC to Stop mode via the Run Stop switch or the programming software Installing an RX7i Ether...

Page 38: ...hot insertion be sure that all cables are disconnected from the Ethernet module 3 Slide the module into the slot for which it was configured in the system Must go into main rack 4 Press the module firmly in place but do not force 5 Connect one or both of the network ports on the Ethernet Interface to the Ethernet network 6 Unless this is a hot insertion turn on power to the PACSystems rack Set the...

Page 39: ... interface to the network one Ethernet address and one IP address PACSystems Ethernet Interface Ethernet Processor Ethernet MAC 10 100 Network Switch Port 1A Port 1B Figure 9 Diagram of Embedded Ethernet Switch For simple installations the embedded switch allows devices to be connected without additional components Operator Interface PLC PLC Personal Computer Figure 10 System Diagram Ethernet Rout...

Page 40: ...s link partner is not similarly manually configured this can result in the link partner concluding an incorrect duplex mode In the words of the IEEE standard Connecting incompatible DTE MAU combinations such as full duplex mode DTE to a half duplex mode MAU or a full duplex station DTE or MAU to a repeater or other half duplex network can lead to severe network performance degradation increased co...

Page 41: ...d purchasing rather than making 10Base T 100Base Tx cables Connection Using a Hub Switch Repeater Connection of the Ethernet Interface to a 10Base T or 100Base Tx network is shown below 10BaseT 100Base Tx Twisted Pair Cable Hub Switch Repeater To Other Network Devices Ethernet Interface 10 100 10 100 Figure 11 Connection Using Hub Switch Repeater Note Care must be taken with the use of active netw...

Page 42: ...n Manager use This nine pin D connector accepts a standard straight through nine pin RS 232 serial cable to connect to a standard AT style RS 232 port The following cable is available IC200CBL001 Cable CPU Programming Port Settings The serial COM port of the terminal or computer that is connected to the Ethernet Interface must use the same communications parameters as the Ethernet Interface The de...

Page 43: ...If the Interface does not transition to operational refer to Diagnostics Chapter 12 for corrective action 3 6 Pinging TCP IP Ethernet Interfaces on the Network PING Packet InterNet Grouper is the name of a program used on TCP IP networks to test reachability of destinations by sending them an ICMP echo request message and waiting for a reply Most nodes on TCP IP networks including the PACSystems E...

Page 44: ... Ethernet plug in applications which may implement additional communication protocols Up to three Ethernet plug in applications can be loaded into the Ethernet interface along with the Ethernet firmware via the WinLoader utility Each plug in application is identified by a number 1 3 Once loaded each Ethernet plug in application is stored in non volatile memory where it is preserved until it is ove...

Page 45: ......

Page 46: ...o the PLC as part of the hardware configuration Store sequence and may be loaded from the PLC to the Programmer as port of the Configuration Load sequence The optional AUP file must be manually generated with a text editor and then imported into the Programmer See Appendix A for details Once stored to the PLC the CPU maintains the Ethernet configuration data in non volatile memory over power cycle...

Page 47: ...mporary IP Address tool in PME BOOTP or the Station Manager CHSOSW command CPE330 does support the Set Temporary IP Address tool in PME but not the Station Manager CHSOSW command Since the IP Addresses of the CPE400 may be displayed on its OLED display there is no need to support the Set Temporary IP Address tool 3 Go online with the target and download the configuration You can use one of the fol...

Page 48: ...rface by downloading a hardware configuration Connect to the CPE305 CPE310 with PME using an IC695ETM001 module with a known IP address and located in the same rack Download a new hardware configuration with the desired IP address for the embedded Ethernet interface Connecting to CPE330 Embedded Ethernet when IP Addresses are not known If the IP addresses of the CPE330 embedded LAN 1 and LAN 2 Eth...

Page 49: ...t the desired tab and then click in the appropriate Values field Figure 14 Expand RX3i CPU Node to Configure Embedded Ethernet Interface Ethernet Parameters Settings Tab Figure 15 Ethernet Settings Tab in Proficy Machine Edition Configuration Mode This is fixed as TCP IP Adapter Name This is automatically generated based upon the rack slot location of the Ethernet interface IP Addresses These valu...

Page 50: ... the IP addresses 10 0 0 1 through 10 0 0 255 must not be used and the subnet mask and gateway IP address must be assigned by the network administrator The IP addresses must be assigned so that they are compatible with the connected network Subnet Mask Key in the desired mask in the format indicated Learn more about subnet mask usage at Subnet Addressing and Subnet Masks on page 246 Gateway IP Add...

Page 51: ...ach channel For details of the status bits and their operation refer to Monitoring the Ethernet Interface Status Bits in Chapter 12 Diagnostics Note Do not use the 80 bits configured as Ethernet Status data for any other purpose or data will be overwritten Note If the Ethernet interface s Variable Mode property is set to true the Status Address parameter is removed from the Settings tab Instead Et...

Page 52: ...st_ttl AUP parameter CPE330 CPE400 Settings Tab Figure 16 CPE330 CPE400 settings tab CPE330 LAN1 TTL for Multicast Messages Corresponds to the gmcast_ttl AUP parameter IP Address for Multicast Group X Corresponds to the gXX_addr AUP parameters XX identifies group 1 32 CPE330 LAN2 TTL for Multicast Messages Corresponds to the gmcast_ttl2 AUP parameter IP Address for Multicast Group X Corresponds to...

Page 53: ...Chapter 4 Configuration 40 PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q CPE300 LAN 1 and LAN2 Settings Figure 17 CPE330 Advanced Ethernet Configuration LAN 1 2 ...

Page 54: ...Chapter 4 Configuration GFK 2224Q January 2017 41 Figure 18 CPE400 Advanced Ethernet Configuration LAN1 LAN 2 ...

Page 55: ... are referenced as I O variables The I O variables are mapped to the Ethernet status bits via this configuration tab Figure 19 Terminals Tab Settings in Proficy Machine Edition The use of I O variables allows you to configure the Ethernet interface without having to specify the reference addresses to use for the status information Instead you can directly associate variable names with the status b...

Page 56: ... CPU will be used to produce or consume Ethernet Global Data EGD right click on the device icon and using the Add Component drop down list select Ethernet Global Data as shown in Figure 19 Figure 20 Adding Ethernet Global Data EGD to the Configuration Once the EGD component has been added it is possible to define the EGD data to be produced Figure 20 and the EGD data to be consumed Figure 21 by th...

Page 57: ...ge for a Producer page 58 and Configuring an Ethernet Global Data Exchange for a Consumer page 60 See also Ethernet Global Data Operation in Chapter 5 for a fuller understanding Produced exchanges Multicast and Broadcast configured for the CPE330 s embedded Ethernet interface will have an additional parameter Network ID that allows the user to select LAN1 or LAN2 Refer to the following figures The...

Page 58: ...Chapter 4 Configuration GFK 2224Q January 2017 45 Figure 23 Configuring Multicast Broadcast EGD on LAN 1 LAN 1 will display a Network ID of 0 ...

Page 59: ...Chapter 4 Configuration 46 PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q Figure 24 Configuring Multicast Broadcast EGD on LAN 2 LAN 2 will display a Network ID of 1 ...

Page 60: ...r The PACSystems PLC does not support auto configuration Generating Storing Loading the Configuration The PACSystems Ethernet interfaces use several types of configuration data Ethernet Configuration optional Ethernet Global Data Configuration and optional Advanced User Parameter AUP Configuration These configuration parameters are generated at the programmer stored from the programmer to the PLC ...

Page 61: ...minal See PACSystems TCP IP Communications Station Manager Manual GFK 2225 for details A third way of setting the IP address is to configure the IP address in Hardware Configuration and store the configuration over a serial connection Assigning a Temporary IP Address Using the Programming Software To initiate Ethernet communications with the programmer you first need to set up a temporary IP addre...

Page 62: ...P Address Caution The temporary IP address set by the Set Temporary IP Address utility is not retained through a power cycle To set a permanent IP Address you must set configure the target s IP Address and download the hardware configuration to the PACSystems target The Set Temporary IP Address utility can assign a temporary IP address even if the target Ethernet Interface has previously been conf...

Page 63: ...thernet Interface already has in IP address even if the Ethernet interface has been previously configured to a non default IP address This includes overriding an IP address previously configured by the programming software Use this IP Address assignment mechanism with care To temporarily set the IP address over the network the PLC CPU must not be running IP address assignment over the network will...

Page 64: ...ck in the appropriate Values field Figure 26 Expand RX7i CPU Node to Configure Ethernet Daughterboard Configuring a Rack based Ethernet Interface Module 1 In the Project tab of the Navigator expand the PACSystems Target the hardware configuration and the main rack Rack 0 2 Right click an empty slot and choose Add Module The Module Catalog opens 3 Click the Communications tab select the IC698ETM001...

Page 65: ...0 0 255 must not be used and the subnet mask and gateway IP address must be assigned by the network administrator The IP addresses must be assigned so that they are compatible with the connected network Name Server IP Address This parameter must be set to 0 0 0 0 Max Web Server Connections Available only when the Ethernet Interface supports web server operation The maximum number of web server con...

Page 66: ...dition to the device s primary IP address I O Scan Set Specifies the I O scan set to be assigned to the Ethernet Interface Scan sets are defined in the CPU s Scan Sets tab The valid range is 1 through 32 the default value is 1 Note The Ethernet interface delivers its Ethernet Status including Channel Status bits during its input scan Each channels data transfer updates the Channels Status bits so ...

Page 67: ... click the PLC icon PLC1 in this example Select Add Component and then select Ethernet Global Data For each PLC 1 In the PLC programming software open the Project folder and expand the target node for the PLC Figure 28 Expand Node to View Ethernet Global Data 2 To configure the Local Producer ID right click the Ethernet Global Data node and choose Properties The Local Producer ID is shown in the p...

Page 68: ...er s responsibility to ensure that the same offset value is specified in both the primary and secondary target projects Figure 30 Configuring Redundancy for Ethernet Global Data Exchange ID Offset in an Ethernet Redundancy System PME Primary Project Produced Exchanges EGD node producer id a b c d redundancy role Primary secondary offset ofs name exchgX exchange ID X Produce in backup FALSE name ex...

Page 69: ...onsumer for the consumer to consume the data Packets that are received when produced and consumed exchange signatures are enabled and incompatible different major signature values will result in an error consumed exchange status The signature minor number is incremented when backward compatible changes are made in the format of the produced data Backward compatible changes are made by adding data ...

Page 70: ...chine Edition To use the EGD Configuration Server and its associated tools the server must be installed on the computer as described below Installing the EGD Configuration Server To install the EGD Configuration Server go to the directory where the machine Edition software is installed and open the folder named EGD Installs Select the file EgdCfgServerSetup msi Double click on the file to install ...

Page 71: ... local copy or cache of the EGD configuration information at a configurable path Setting this path to a location on the local machine and selecting Work Offline to True allows EGD configuration data to be updated using the cached information without accessing the server Setting the Work Offline parameter to False and performing a Validate will synchronize the server with the data from the cache Ne...

Page 72: ... EGD production is enabled and when disabled EGD production is disabled Run Mode Store Enabled When set to True allows you to modify or delete this exchange and store the changes while in Run mode You can add exchanges in Run mode regardless of the setting of this parameter It is recommended that you keep this parameter at its default setting False unless your application has a specific need to mo...

Page 73: ...hernet Global Data Exchange for a Consumer To create a new consumed exchange right click the Consumed Exchanges node and select New A dialog box lists all produced exchanges in the EGD network that have been published to the EGD Configuration Server Select the exchange to be consumed Once selected the exchange is populated with the variable length type and description information defined in the pr...

Page 74: ...change is changed it is necessary to reflect these changes in the consumers This can be done very quickly with the EGD configuration server Once the new definition of the produced exchange has been published to the server select the consumed exchange in each consumer right click and select synchronize to server The new definition of the produced exchange will be brought in from the server Any vari...

Page 75: ... file to install the EGD Generic Device Editor Running the EGD Generic Device Editor Installing the EGD Generic Device Editor adds it to the Start Programs menu of the computer s Windows system You will find it under Programs GE Industrial Systems EGD Generic Editor The Windows help for this tool describes its operation Configuring Ethernet Global Data without Using the EGD Configuration Server If...

Page 76: ... location within the data area for this exchange where the start of the data for this variable is located The offset is expressed as Byte Bit where Byte is a zero based byte offset and Bit is a zero based bit position within that byte Valid bit values are 0 7 Bit 0 is the least significant bit within the byte bit 7 the most significant Variable The name defined for this variable Ref Address The PL...

Page 77: ...th a Destination Type of Group ID This Group ID 1 32 must match that of the producer Exchange ID Identifies a specific data exchange to be received by the consuming device It must match the Exchange ID specified in the produced exchange Adapter Name The specific Ethernet Interface identified by its rack and slot location within the consuming PLC Consumed Period Not used in PACSystems Always displa...

Page 78: ... of any existing variables within that exchange To insert a new variable among the existing variables click on an existing variable When you click the Insert button a new variable will be created ahead of the selected existing variable This changes the data offsets of all subsequent variables in the exchange Once a new variable has been entered double click a data field within the row to edit that...

Page 79: ...nalog value and place it into AI003 the consumer might be configured as shown below Offset Variable Ref Address Ignore Length Type Description 0 0 Ignore True 6 Byte Ignore float and integer 6 0 Var01 AI0003 1 WORD Note that where EGD signatures are not used the total length of the exchange must be the same in producer and consumer even if the consumer is ignoring a portion of the exchange Failure...

Page 80: ...Chapter 4 Configuration GFK 2224Q January 2017 67 ...

Page 81: ......

Page 82: ...on EGD Exchanges The Content of an EGD Exchange The Data Ranges Variables in an EGD Exchange Valid Memory Types for Ethernet Global Data Planning Exchanges Using Ethernet Global Data in a Redundancy System Sending an Ethernet Global Data Exchange to Multiple Consumers Multicasting Ethernet Global Data Broadcasting Ethernet Global Data Note For Broadcast addressing a Subnet value of 0 0 0 0 is NOT ...

Page 83: ...is uniquely identified by its Producer ID The Producer ID can be expressed as a dotted decimal number for example 0 0 0 1 Even when expressed in IP address form it is not used as an IP address It is used to identify a particular PLC on the network Since the Producer ID identifies only the PLC producing the exchange it doesn t matter how many Ethernet Interfaces are installed in that PLC When using...

Page 84: ...ge is composed of one or more data ranges transmitted as a sequence of 1 to 1400 bytes of data The data ranges are commonly called variables they may be configured to correspond to PLC variables The content of the data is defined for both the producer and consumers of the data In this example a producer sends an 11 byte exchange consisting of the current contents of R00100 through R00104 followed ...

Page 85: ...es P C Discrete point references such as I or Q are configured as Byte Array Word Array or Dword Array variables That means a variable with discrete point references must be defined in blocks of 8 points if it is defined as a Byte Array 16 points if Word Array and 32 points if Dword Array Discrete memory must be byte aligned Boolean type and Boolean Array variables are not allowed To use a symboli...

Page 86: ...ation about redundancy systems refer to Ethernet Redundancy Operation in Chapter 1 5 3 Sending an Ethernet Global Data Exchange to Multiple Consumers There are two ways to send an EGD Exchange to multiple consumers at the same time by Multicasting it to a predefined group of consumers or by Broadcasting it to all of the consumers on a subnet Both methods allow many consumer devices to simultaneous...

Page 87: ...ange then changes to the value 255 255 255 255 The Ethernet Interface converts this value to the appropriate subnet broadcast mask for this network As with a Group ID each consumer on the subnet can be configured to use some or all of the exchange Changing Group ID in Run Mode With the ability to perform a run mode store of EGD it is possible to change the Group ID or Destination Type of a produce...

Page 88: ...ide the most up to date process data consistent with the configured schedule The Ethernet interface maintains a timer for each produced exchange When the timer for the exchange expires the Ethernet interface requests that the data for the exchange be transferred from reference memory during the output scan portion of the CPU sweep At the output portion of the sweep the CPU puts the data into the s...

Page 89: ...ate Timeout Period For each consumed exchange an Update Timeout period can be configured It determines how long the Ethernet Interface will wait for the starting or subsequent packet of data in the exchange before declaring a refresh error The update timeout period for the consumer should be set to at least twice the producer period At very small producer periods the update timeout should also all...

Page 90: ...nteger representing seconds and the next four bytes contain a signed integer representing nanoseconds This value can be examined to determine whether a packet received from the network has a new data sample or if it is the same data received previously In its default operating mode for SNTP synchronization the PLC CPU obtains the timestamp data from the time clock in the Ethernet interface which c...

Page 91: ...amp source for Ethernet Global Data is part of the basic configuration of the Ethernet Interface as explained in Chapter 4 PLC s Time Clock If this source is selected the Ethernet Interface s built in time clock is synchronized at power up or at restart to the clock in the PLC CPU The timestamp information produced by the PLC has a resolution of 100 microseconds Because the time clocks in the PLCs...

Page 92: ...A Note that CPU TOD clock synchronization is enabled automatically when SNTP is enabled within PME for a CPE305 CPE310 CPE330 and CPE400 Within a PLC only one Ethernet interface at a time can be selected as the time master for CPU time synchronization If multiple Ethernet modules are configured for CPU time synchronization the PLC application logic should issue a Read Ethernet Clock Status and Str...

Page 93: ...i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q CPU Ethernet interface SNTP Time SNTP Time Server on Network timestamp EGD with timestamp SNTP Time CPU time clock time clock Figure 43 Synchronizing CPU Time of Day Clock to an SNTP Server ...

Page 94: ...NTP network time Process SNTP time msg Lock onto time server User Logic Choose ENET to use for CPU time sync Enable CPU Time Update interrupt via COMMREQ 5002 CPU Time Update interrupt is not enabled do not send Process COMMREQ 5002 Update ENET TOD Update time in shared memory SNTP network time Process SNTP time message CPU Time Update interrupt is enabled Send CPU Time Update interrupt Process in...

Page 95: ...PE400 support SNTP via PME hardware configuration The CPU TOD clock synchronization is enabled automatically when SNTP is enabled 4 At every subsequent periodic network time message from the locked SNTP timeserver the CPU receives the network time and immediately updates its TOD clock Note In a PLC with only one Ethernet interface the logic program may skip step 2 There is no need to select betwee...

Page 96: ... module to determine which Ethernet module to select Command Block for Read Ethernet Clock Status and Stratum COMMREQ Word Offset Value Description Word 1 Length of command data block Always 3 Word 2 0 Always 0 Wait No Wait mode request Word 3 For a list of memory type codes see COMMREQ Status for the EGD Commands in Chapter 6 Memory type of the COMMREQ status word Word 4 0 based Offset of COMMREQ...

Page 97: ...e Ethernet clock is locked to a network timeserver Clock Status Word Values Value Description 0 Ethernet interface is not configured for SNTP operation 1 Ethernet clock is currently locked to network timer server 2 Ethernet clock is not locked to network timer server Note Bit 5 in the LAN Interface Status LIS block indicates whether the Ethernet module is currently locked to an SNTP timeserver on ...

Page 98: ...Memory type of the COMMREQ status word Word 4 0 based Offset of COMMREQ status word For CRS word values refer to page 86 Word 5 0 Always 0 Word 6 0 Always 0 Word 7 5002 Enable Disable Time Update command number Word 8 1 Enable PLC time update 0 Disable PLC time update This word contains the value to enable or disable this Ethernet interface to update the PLC clock This word must be set to 0 to dis...

Page 99: ...zation 07 0D COMMREQ data block length COMMREQ word 1 is too short 08 0D COMMREQ command code COMMREQ word 7 is not recognized 10 0D CPU and or ENET firmware version does not support SNTP Time Transfer feature 12 0D Attempted to enable CPU time sync on this Ethernet interface while already enabled on another Ethernet interface The logic application must first disable CPU time sync on the original ...

Page 100: ...rections Versions 6 20 and later of the Ethernet interface support the ability to specify an offset to the Coordinated Universal Time UTC to correct for local time zone and daylight saving time DST You can specify the DST start stop times and offset from local standard time as well as the local time offset from the UTC The specified correction is applied to all modes of SNTP communications Broadca...

Page 101: ...erred to the shared memory so that the latest data is available immediately when the PLC transitions out of STOP with I O disabled mode If configuration is lost the Ethernet Global Data configuration must be stored again PLC Mode or Action Producer ID remains configured Configuration Based Exchanges continue to be Configured Produced Consumed PLC Mode RUN Outputs Enabled YES YES YES YES RUN Output...

Page 102: ...hanges in the run mode store Depending on the application s configuration modifying exchanges in a producer with increased sweep times may cause consumption timeouts on exchanges that are modified in applications with very low tolerances If the modification creates an incompatibility between the producer and consumer the exchange will cease to be consumed Any modification to an exchange s paramete...

Page 103: ...ity Note that decreasing a consumed exchange s update timeout without updating the corresponding producer s production period may cause timeouts Effects of Modifying Produced Exchange Parameters Parameter Behavior Exchange ID Redefines the exchange Causes a major signature change in the producer Adapter Name Deletes an exchange from one Ethernet module and adds an exchange to another Assuming no o...

Page 104: ...ble to the end of the variable list Minor Adding a variable at the beginning or middle of the list Major Deleting or modifying a variable Major Changing a variable s name type or array dimensions Major Changing other variable properties such as reference address and publish state None Modifying Exchange Variable Lists without EGD Signatures Enabled In applications without EGD signatures a consumer...

Page 105: ...ctively disables signature checking 5 7 Monitoring Ethernet Global Data Exchange Status The Exchange Status word is used to store status information about an EGD exchange A unique Exchange Status word location must be is configured for each exchange The PLC writes status codes into the Exchange Status word whenever an exchange is transferred or a consumer timeout occurs The Exchange Status word is...

Page 106: ...and the data has not been refreshed within the timeout period 7 C Data after refresh timeout The data has been refreshed since the previous consumption but not within the timeout period 10 P C IP Layer not currently initialized This status can be set during exchange configuration12 if the Ethernet Interface detects that it cannot currently access a network This temporary status can change if succe...

Page 107: ...EQ error status is returned to its application program If the active Ethernet interface changes to backup status it takes down all reliable datagram services RDS sessions that use the Redundant IP address Any EGD command currently in process over the Redundant IP address when a role switch occurs is ended Although not recommend EGD commands may be issued to the direct IP address Both the active an...

Page 108: ...ecify a memory type and location to receive status information about the execution of the command Word 3 specifies the memory type for the COMMREQ status word The memory types are listed in the table below Type Value Decimal Value Hex Description R 8 08H Register memory word mode AI 10 0AH Analog input memory word mode AQ 12 0CH Analog output memory word mode I 16 70 10H 46H Discrete input memory ...

Page 109: ...in the local PLC Word 10 Local read buffer reference table starting address least significant word 1 based offset in the local PLC Word 11 Local read buffer reference table starting address most significant word Word 12 Remote read location memory type Memory type from which data will be read in the remote PLC Word 13 Remote reference table read location starting address least significant word 1 b...

Page 110: ...mory bit mode M 22 76 Discrete momentary internal memory byte mode Discrete momentary internal memory bit mode SA 24 78 Discrete system memory group A byte mode Discrete system memory group A bit mode SB 26 80 Discrete system memory group B byte mode Discrete system memory group B bit mode SC 28 82 Discrete system memory group C byte mode Discrete system memory group C bit mode S 15 30 84 Discrete...

Page 111: ...ount of data to be transferred The value entered is the number of memory units to be transferred where the size of the remote PLC memory type bit byte or word is specified in Word 12 For example if Word 12 16 and Word 15 4 then 4 bytes 32 bits of I memory will be transferred For Read PLC Memory the maximum length is 11200 bits 1400 bytes or 700 words of data or the amount of memory available in th...

Page 112: ...rds Word 16 Network address type Must be 1 Indicates an IP address will be used Word 17 Network address length Must be 4 for IP address Group ID multicast is not permitted Word 18 Word 21 IP Address of the remote PLC Four integers specified as one integer per word of the dotted decimal IP address of the remote PLC May not be a group IP address Word 22 Reserved Always 0 Word 7 EGD Command Number Wo...

Page 113: ... This offset will be either in bits bytes or words depending on the mode specified for example if Word 12 16 and Words 13 14 9 0 then the starting address will be I65 Valid ranges of values depend on the remote PLC s memory ranges Word 15 Remote PLC Number of Memory Units Word 15 specifies the amount of data to be transferred The value entered is the number of memory units to be transferred where ...

Page 114: ...ber Word 8 Retry time in milliseconds The time between retries of command transfers Default is 1000ms Word 9 Local read buffer memory type Memory type for the data in the local PLC Word 10 Local read buffer reference table starting address least significant word 1 based offset Word 11 Local read buffer reference table starting address most significant word Word 12 Remote signature EGD Exchange sig...

Page 115: ...ature Word 12 contains the 16 bit exchange signature value to be compared at the remote EGD device For remote PLCs the exchange signature should be set to zero if signatures are not being used However when signatures are enabled the signature field can be set to a non zero value so that commands will be executed only if signatures match In this case mismatched signatures will cause the command to ...

Page 116: ...ddress Length Word 20 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block Word 20 must contain 4 Words 21 24 Remote Server IP Address Words 21 24 specify the four integers one integer per word of the dotted decimal IP address of the remote PLC to be accessed ...

Page 117: ...rite EGD Exchange command number Word 8 Retry time in milliseconds The time between retries of command transfers Default is 1000ms Word 9 Local write buffer memory type Memory type for the data in the local PLC Word 10 Local write buffer reference table starting address least significant word 1 based offset Word 11 Local write buffer reference table starting address most significant word Word 12 R...

Page 118: ...ge signature should be set to zero if signatures are not being used However when signatures are enabled the signature field can be set to a non zero value so that commands will only be executed if signatures match In this case mismatched signatures will cause the command to return a failure status An EGD signature has the format maj min where maj is the major value and min is the minor value The l...

Page 119: ... 95 Memory type of COMMREQ Status Word Word 4 0 based 13 Offset of COMMREQ Status Word Word 5 0 Reserved Word 6 0 Reserved Word 7 4004 fa4H Masked Write to EGD Exchange command number Word 8 Retry time in milliseconds The time between retries of command transfers Default is 1000ms Word 9 Bit mask set bit to be written to 1 rest to 0 The bit mask selects the individual bit to be written The most si...

Page 120: ...d signatures will cause the command to return a failure status An EGD signature has the format maj min where maj is the major value and min is the minor value The least significant byte of this word indicates the minor value and the most significant byte indicates the major value For example a value of 0xAABB refers to a maj min value of 0xAA 0xBB EGD Signatures Enabled Signature Comparison Desire...

Page 121: ...icant byte any bits set to 1 will be written to the remote producer The equivalent bit of Word 10 of the Masked Write command contains the bit state to be written 1 or 0 The most significant byte of Word 10 is also ignored For example Most Significant Byte 0 0 1 0 0 0 0 0 Word 9 mask Most Significant Byte 0 0 0 0 0 0 0 0 Word 10 data Bit to be written at the selected Remote Exchange Offset State t...

Page 122: ...Chapter 6 Programming EGD Commands GFK 2224Q January 2017 109 ...

Page 123: ...Q Example Sequencing Communications Requests Managing Channels and TCP Connections Use Channel Re Tasking to Avoid using up TCP Connections Client Channels TCP Resource Management SRTP Application Timeouts Monitoring Channel Status Differences between Series 90 and PACSystems SRTP Channels 7 1 SRTP Channel Commands The SRTP Channel commands are a set of client PLC commands that can be used to comm...

Page 124: ... occurs Monitoring the Channel Status The Ethernet Interface status bits occupy a single block of memory which is specified during configuration of the Ethernet Interface The status bits include Channel Status bits which provide runtime status information for each communication channel Each channel has two status bits the meaning of the channel status bits depends upon the type of communication pe...

Page 125: ... channel Domain of a TCP connection pulse received Data Transfer pulse received Data Transfer pulse received Domain of a remote server Server CPU Backplane Read Request Data Read Request Data Read Request Data PLC PLC Figure 48 COMMREQ Sequence for Establish Read Channel 1 The command starts when there is power flow to a COMMREQ function in the client PLC At this time the Command Block data is sen...

Page 126: ...ion of the Command Block It can be any valid address within a word oriented area of R AI AQ P L or W SYSID A hexadecimal word value that gives the rack high byte and slot low byte location of the Ethernet Interface For the PACSystems CPU embedded Ethernet interface enter the rack slot location of the CPU module Rack Slot Hex Word Value 0 0 0000H RXi and CPE400 0 4 0004H 3 4 0304H 2 9 0209H 4 2 040...

Page 127: ...face updates the COMMREQ status word to show success or failure of the command Command words 3 and 4 specify the PLC memory location of the COMMREQ status word COMMREQ Status Word values are described in Chapter 12 Word 3 COMMREQ Status Word Memory Type This word specifies the memory type for the COMMREQ status word The memory types are listed in the table below Type Value Decimal Value Hex Descri...

Page 128: ...o a given channel Wait for the COMMREQ Status Word to go to a non zero value which signals the COMMREQ is complete before issuing another Channel command to that channel The COMMREQ Status Word is updated once per COMMREQ execution a non zero value in the status word completes the COMMREQ Always use a one shot to initiate a Channel command COMMREQ That prevents the channel COMMREQ from being execu...

Page 129: ...0007 Number of time units for read period every 7 seconds Word 12 00050 0032 Timeout for each read 500ms Word 13 00008 0008 Local PLC Memory type at which to store data R Word 14 00100 0064 Local PLC Starting address at which to store data R100 The term remote PLC is used here to identify the server PLC the PLC that responds to the communications request Word 15 00008 0008 Remote PLC Memory type f...

Page 130: ...e Using COMMREQs for Channel Commands The pending transfer can still complete after the period error occurs You can determine when the pending transfer completes by monitoring the Channel Error and Data Transfer bits For Channel commands set up to issue multiple reads the next read transfer will be issued only after the pending read transfer completes If the Number of Time Units is zero a subseque...

Page 131: ... byte mode Discrete global data table bit mode Word 14 Local PLC Memory Starting Address Word 14 determines the starting address in the local PLC in which the data from the remote PLC is to be stored The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 13 This offset will be either in bits bytes or words depending on the mode speci...

Page 132: ...one integer per word of the dotted decimal IP address of the remote PLC to be accessed Words 24 27 Remote PLC Program Name Words 24 27 specify the case sensitive zero terminated and padded program name also called task name which can be found through the PROG Station Manager command on the server Ethernet Interface to be used with access to remote P or L memory These words are required only for ac...

Page 133: ...00007 0007 Number of time units for write period every 7 seconds Word 12 00050 0032 Timeout for each write 500ms Word 13 00008 0008 Local PLC Memory type from which to write data R Word 14 00050 0032 Local PLC Starting address from which to write data R50 The term remote PLC is used here to identify the server PLC the PLC that responds to the communications request Word 15 00008 0008 Remote PLC Me...

Page 134: ...plete after the period error occurs You can determine when the pending transfer completes by monitoring the Channel Error and Data Transfer bits For Channel commands set up to issue multiple writes the next write transfer will be issued only after the pending write transfer completes If the Number of Time Units is zero a subsequent transfer will be issued as soon as the previous transfer completes...

Page 135: ...f Memory Units Word 17 specifies the amount of data to be transferred The value entered is the number of memory units to be transferred where the size of a memory unit is a bit byte or word as specified in Word 15 For example if Word 15 16 and Word 17 4 then 4 bytes 32 bits of I memory will be transferred The user is responsible for assuring that this area is large enough to contain the requested ...

Page 136: ...een host accesses every 7 seconds Word 12 00050 0032 Timeout on each individual transfer response 500ms Word 13 00008 0008 Local PLC Memory type from which to send data R Word 14 00050 0032 Local PLC Starting address from which to send data R50 Word 15 00008 0008 Local PLC Number of memory units 8 registers Word 16 00000 0000 Reserved Word 17 00000 0000 Reserved The term Remote Host is used here t...

Page 137: ...en after a timeout occurs As a result an application can choose what to do if one occurs If the timeout value is specified as zero no timeout errors will be reported For most applications a timeout is not needed because the send period acts as a timeout Word 12 should be zero for no timeout However there are two circumstances where a timeout is recommended If number of time units Word 11 is zero s...

Page 138: ...2 00000 0000 Always 0 no wait mode request Word 3 00008 0008 Memory type of COMMREQ status word R Word 4 00009 0009 COMMREQ status word address minus 1 R10 0 based Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 02001 07D1 Abort Channel command number Word 8 00005 0005 Channel number 5 Word 7 Channel Command Number This command parameter requests that a channel be aborted If the comma...

Page 139: ... Requests that Detailed Channel Status words be returned The Detailed Channel Status words are written to the location specified in Words 9 and 10 The COMMREQ status word indicates successful completion of the command If the specified channel is not currently in use the latest status is returned Word 8 Channel Number Specifies the channel 1 32 whose status is to be read Word 9 Local PLC Memory Typ...

Page 140: ...ord in Hex Format Word 1 Word 2 Figure 50 Interpreting Detailed Channel Status Words 7 3 Programming for Channel Commands The COMMREQ function for a Channel command must be initiated by a one shot That will prevent the COMMREQ from being executed each CPU scan which would overrun the capability of the Ethernet Interface and possibly require a manual restart Checking certain status bits before init...

Page 141: ...n the sample logic that follows the input values for the Block Move Functions are taken from the Establish Read Channel 2003 command Example Command Block in this chapter Nicknames are used in this example to make the ladder program easier to follow LANIFOK is bit 16 of the LAN Interface Status bits All other nicknames can be assigned as needed ...

Page 142: ...Chapter 7 Programming SRTP Channel Commands GFK 2224Q January 2017 129 Figure 51 Sample Ladder Logic for COMMREQ ...

Page 143: ... function block indicates which mailbox task ID to use for the specified rack and slot For a PACSystems rack based Ethernet module Task must be set to 0 For a PACSystems CPU embedded Ethernet interface Task must be set to 65536 10000H The FT output energizes the FAULT coil in this example is turned ON set to 1 if there were problems preventing the delivery of the Command Block to the Ethernet Inte...

Page 144: ...s For example if you expect to transfer data about once per minute set the read write period to about two minutes This will cause a TCP connection to be created and held open for two minutes 2 Set up the ladder program to a Issue the first COMMREQ and wait for the first transfer to complete which will be indicated when the COMMREQ Status CRS word is changed to 1 b Then before the read write period...

Page 145: ...nel application timeouts are temporary errors the channel continues to run when the expected response is received If the application is seeing timeouts during channel startup there are a few different options 1 Increase timeout value to account for Channel connection overhead 2 Ignore the timeout error on the first transfer 3 Use a two step setup approach where the first COMMREQ has a timeout larg...

Page 146: ...will become available again after the 60 second TCP linger period has expired The Series 90 had no linger period 3 The Series 90 SRTP Channel implementation performed a normal stopping of the channel on a Run to Stop transition On PACSystems a Run to Stop transition causes an Abrupt Shutdown avoiding the TCP Linger period and reducing the chance of exhausting TCP resources when quickly transitioni...

Page 147: ......

Page 148: ...rts Modbus Conformance classes 0 1 and 2 The RX3i Ethernet module has been certified by the Modbus TCP Conformance Test Laboratory to be in conformance with Conformance Test Policy Version 2 1 Server Protocol Services The Modbus TCP Server responds to incoming Request Connection Terminate Connection and Request Service messages The client with which the server is interacting should wait for the se...

Page 149: ... 5 242 880 16 bit words Modbus File Access Table The Modbus File Access table is mapped exclusively to PACSystems W memory Applicable Functions Read File Record Write File Record Translating W Reference Addresses To find the PACSystems W memory address equivalent of a Modbus File and Record W 10 000 F 1 R To find the Modbus File and Record equivalent of a PACSystems W memory address File W 1 10 00...

Page 150: ...Coil Address Configuration Address mapping is done in the Machine Edition Hardware Configuration of the CPU All Ethernet modules and daughter boards in the PLC use Modbus to PLC address mapping based on this one map The Modbus TCP Server does not use COMMREQs to configure address mapping Each PLC memory area is mapped to an appropriate Modbus address space On the Settings tab Modbus Address Space ...

Page 151: ...the Modbus function codes supported by the Modbus TCP Server The mapping shown in this table assumes that the PLC is configured to use its default reference table sizes Modbus Function Code Modbus PLC Table Start Address Length Start Address Length 1 5 15 Read Coils Write Single Coil Write Multiple Coils 0xxxx 1 32768 Q00001 32768 2 Read Discrete Inputs 1xxxx 1 32768 I00001 32768 3 6 16 22 23 Read...

Page 152: ...ommunications Request The COMMREQ Function Block and Command Block Modbus TCP Channel Commands Status Data Controlling Communications in the Ladder Program Differences between Series 90 and PACSystems Modbus TCP Channels 9 1 The Communications Request Communications Request is a term used to describe all the user elements required for correctly initiating Channel commands in the client No programm...

Page 153: ...command In the COMMREQ Function Block you specify the rack and slot location of the Ethernet interface a task value and the address of a location in memory that contains the Command Block There is also a fault output on the COMMREQ Function Block that indicates certain programming errors COMMREQ Command Block The COMMREQ Command Block is a structure that contains information about the Channel comm...

Page 154: ...e communication request The location of the CRS word is assigned for each COMMREQ function in the COMMREQ Command Block FT Output of the COMMREQ Function Block This output indicates that the PLC CPU detected errors in the COMMREQ Function Block and or Command Block and did not pass the Command Block to the Ethernet interface The Logic Program Controlling Execution of the COMMREQ Function Block The...

Page 155: ...EQ in ladder program Command Block sent to Interface Verify Command Block and set up channel to server COMMREQ Status Word Return COMMREQ Status CRS Word to CPU Set Channel Open Bit Channel Open Bit is set to 1 Power flows to Close Connection COMMREQ in ladder program Command Block sent to Interface Verify Command Block and close channel to server COMMREQ Status Word Return COMMREQ Status CRS Word...

Page 156: ...ontrol logic for activating the COMMREQ Function Block See Section 5 for tips on developing your program IN The location of the Command Block It can be any valid address within a word oriented area of memory R AI AQ P L or W for the Ethernet interface SYSID A hexadecimal word value that gives the rack high byte and slot low byte location of the Ethernet interface For the PACSystems embedded Ethern...

Page 157: ...Block The length is measured from the beginning of the Data Block at Word 7 not from the beginning of the Command Block The correct value for each command and the associated length of each command is specified in the next section Word 2 WAIT NOWAIT Flag This flag must be set to zero for TCP IP Ethernet Communications COMMREQ Status Word The Ethernet interface updates the CRS word to show success o...

Page 158: ...another Modbus TCP device using a channel Up to 32 channels are available for Modbus TCP client communications However these 32 channels are shared with SRTP Channels so that the combination of SRTP Channels and Modbus TCP Channels cannot exceed 32 The Open Modbus TCP COMMREQ requests the communication subsystem to associate a channel with a remote Modbus TCP device Using the COMMREQs defined late...

Page 159: ...3rd Octet Word 14 00001 0001 Numeric value of 4th Octet Word 7 Channel Command Number Word 7 is the command id for an Open Modbus TCP Client Connection COMMREQ If successful a TCP connection with the specified device is allocated Word 8 Channel Number Word 8 specifies the channel number to allocate for the Modbus TCP Client connection Channels 1 32 can be used for Client communications Word 9 Addr...

Page 160: ...ablished on Channel 5 Return the COMMREQ Status word to R10 Dec Hex Word 1 00002 0002 Length of Channel command Data Block Word 2 00000 0000 Always 0 no wait mode request Word 3 00008 0008 Memory type of CRS word R Word 413 00009 0009 CRS word address minus 1 R10 Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03001 0BB9 Close Modbus TCP Client Connection Word 8 00005 0005 Channel num...

Page 161: ...r coil memory to PLC bit memory only the number of bits specified is transferred For example if the COMMREQ requests to read 9 coils from the Remote Device and requests to put the data at M00001 in the Local PLC using a bit type memory type M00001 through M00009 will be updated with the data from the Remote Device and M00010 through M00016 will be unaffected However if server bit or coil memory is...

Page 162: ...d 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03003 0BBB Read from a Modbus TCP Device Word 8 00006 0006 Channel number 6 Word 9 00004 0004 Modbus Function Code Read Input Registers Word 10 00008 0008 Local PLC Memory Type Word 11 00020 0014 Local PLC Starting Address Word 12 00200 00C8 Address in the Remote Server Word 13 00004 0004 Number of Registers in the Remote Device Word 14 000...

Page 163: ...C bit mode S 15 30 84 Discrete system memory byte mode Discrete system memory bit mode G 56 86 Discrete global data table byte mode Discrete global data table bit mode Word 11 Local PLC Memory Address Word 11 determines the starting address in the local PLC in which the data from the remote device is to be stored The value entered is the offset 1 based from the beginning of PLC memory for the memo...

Page 164: ...r communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 2 Read Input Discretes Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interface will store data received from the remote device Valid values for Word 10 are listed on page 150 Word 11 Local PLC Memory Address Word 11 determines the ...

Page 165: ...ber previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 7 Read Exception Status Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interface will store data received from the remote device Valid values for Word 10 are listed on page 150 Word 11 Local PLC Memory Add...

Page 166: ...dbus Function Code 24 Read FIFO Queue Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interface will store data received from the remote device Valid values for Word 10 are listed on page 150 Word 11 Local PLC Memory Address Word 11 determines the starting address in the local PLC in which the data from the remote device is to be stored The value ...

Page 167: ...ritten to the Modbus TCP device The source of data can be any of the PLC data areas see Local PLC Memory Type on page 150 Function Code 5 Write Single Coil forces a Coil On or Off To force a coil off the value zero 0 is used as the COMMREQ data value If the PLC memory type is a bit type the remote device coil is set to the same state as the specified PLC memory location If the PLC memory type is a...

Page 168: ...fies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Function Code 6 Write Single Register Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC from where the Ethernet interface will get the data to be written to the remote PLC Valid values for Word 10 are listed on page 150 Word 11 ...

Page 169: ...tifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 5 Write Single Coil Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC from where the Ethernet interface will get the data to be written to the remote PLC Valid values for Word 10 are listed on page 150 Wor...

Page 170: ... the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 16 Write Multiple Registers Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interface will get the data to be written to the remote PLC Values for Word 10 are listed on page 150 The value 16...

Page 171: ... 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03009 0BC1 Mask Write Register to a Modbus TCP Server Device Word 8 00006 0006 Channel number 6 Word 9 00022 0016 Modbus Function Code Write Mask Register Word 10 00200 00C8 Address in the Remote Device Word 11 00001 0001 AND Mask Word 12 00000 0000 OR Mask Word 13 00001 0001 Unit Identifier Word 7 Channel Command Number Word 7 identifies th...

Page 172: ...isters to from a Modbus TCP Device Word 8 00006 0006 Channel number 6 Word 9 00023 0017 Modbus Function Code Read Write Multiple Registers Word 10 00008 0008 Local PLC Memory Type of memory to write with data read from Remote Device Word 11 00300 012C Local PLC Starting Address LSW of memory to write with data read from Remote Device Word 12 00000 0000 Local PLC Starting Address MSW of memory to w...

Page 173: ...e Device Words 14 specifies the quantity of registers to read from the remote device Word 15 Local PLC Memory Type Read Data to Write to Server Words 15 17 specify the location in the local PLC where the Ethernet interface will read data to use for writing to the remote server Values for Word 15 are listed on page 150 The value 8 specifies Register Memory R Word 16 Local PLC Starting Address LSW R...

Page 174: ...monitor the health of a channel Each Modbus channel has a dedicated status bit For details of the status bits and their operation refer to Monitoring the Ethernet Interface Status Bits in Chapter 12 Diagnostics FT Output of the COMMREQ Function Block This output is set if there is a programming error in the COMMREQ Function Block itself if the rack and slot specified in the COMMREQ SYSID parameter...

Page 175: ...am This section provides tips on how to control communications in your ladder program Only segments of actual ladder logic are included Topics discussed are Essential Elements of the Ladder Program Troubleshooting Your Ladder Program Monitoring the Communications Channel Essential Elements of the Ladder Program Every ladder program whether in the developmental phase or the operational phase should...

Page 176: ...EQ and the ETH_READY coil is ON ETH_READY is used as an interlock for Rungs 2 16 Rung 2 When ETH_READY is set Input DO_OPEN triggers OPEN_REQ which enables execution of the MOVE and COMMREQ functions for the Open Modbus TCP Connection COMMREQ OPEN_REQ is a one shot Positive Transition coil activating once when both ETH_READY and DO_OPEN have transitioned from OFF to ON Rung 3 The MOVE WORD functio...

Page 177: ...es and are not displayed only the last number 4 appears This indicates rack 0 slot 4 The TASK field of the COMMREQ Function Block indicates which mailbox task ID to use for the specified rack and slot For the RX3i and Rx7i ETM001 Ethernet interfaces TASK must always be set to zero For PACSystems CPU embedded Ethernet interface TASK must be set to 65536 0x10000 to address the CPU s Ethernet daughte...

Page 178: ... transitions from OFF to ON Rung 8 The MOVE WORD function moves a zero to the CRS word referenced in the Command Block see rung 9 This clears the CRS word This rung also resets the READ_FLT output coil of the COMMREQ Function Block in rung 10 Rung 9 The BLKMV INT functions set up the COMMREQ Command Block contents When this rung is activated the constant operands are moved into the memory beginnin...

Page 179: ...rface module The TASK field of the COMMREQ Function Block indicates which mailbox task ID to use for the specified rack and slot For the RX3i and Rx7i ETM001 Ethernet interfaces TASK must always be set to zero For PACSystems CPU embedded Ethernet interface TASK must be set to 65536 0x10000 to address the CPU s Ethernet daughterboard The FT output energizes the READ_FLT coil in this example is turn...

Page 180: ...N Rung 13 The MOVE WORD function moves a zero to the CRS word referenced in the Command Block see rung 9 This clears the CRS word This rung also resets the CLOSE_FLT output coil of the COMMREQ Function Block in rung 15 14 Figure 63 COMMREQ Ladder Logic Segment continued Rung 14 The BLKMV INT functions set up the COMMREQ Command Block contents When this rung is activated the constant operands are m...

Page 181: ... The TASK field of the COMMREQ Function Block indicates which mailbox task ID to use for the specified rack and slot For the RX3i and Rx7i ETM001 Ethernet interfaces TASK must always be set to zero For PACSystems CPU embedded Ethernet interface TASK must be set to 65536 0x10000 to address the CPU s Ethernet daughterboard The FT output energizes the CLOSE_FLT coil in this example is turned ON set t...

Page 182: ...X3i and Rx7i ETM001 Ethernet interfaces TASK must always be set to zero For PACSystems CPU embedded Ethernet interface TASK must be set to 65536 0x10000 to address the CPU s Ethernet daughterboard Invalid Data Block length 0 or greater than 128 COMMREQ Status Word is Zero 0 and FT Output is OFF If after executing a COMMREQ function the CRS word is zero 0 and the FT Output is OFF then the Command B...

Page 183: ...n updated The exception to this rule is when you want to terminate a command by using the Close Modbus TCP Connection command Monitoring the Channel Open Bit This bit is 1 when a Channel has successfully established a connection with a remote server and is 0 when a Channel has been closed The Channel Open Bit is meaningful when the CPU is in Run mode and the particular channel is being used by Mod...

Page 184: ...n the CRSW for the Open Modbus TCP Connection COMMREQ when this timeout occurs 4 The station manager command stat m on the Series 90 results in displaying Closed for specific Closed channels while PACSystems Modbus TCP Channels results in displaying nothing for a specific Closed channel 5 When sending a Close Modbus TCP Connection COMMREQ the PACSystems Modbus TCP Client will return a success CRSW...

Page 185: ...tems Modbus Client Memory Location Type Memory value example Transfer Direction Memory Location Type Resulting Value After Transfer Notes Client Bit M16 M1 0x4321 Server Word R1 0x4321 End to end bytes un swapped Server Bit M16 M1 0x4321 Client Word R1 0x4321 End to end bytes un swapped Client Word R1 0x4321 Server Bit M16 M1 0x4321 End to end bytes un swapped Server Word R1 0x4321 Client Bit M16 ...

Page 186: ...e communications mechanism uses standard TCP IP on the CPE s Embedded Ethernet port Before getting started with the OPC UA server you will want to have an OPC UA client Proficy CIMPLICITY HMI for example to connect to the OPC UA server The following is a high level list of activities and functionality that is important to understand to startup and use the OPC UA server Application Logic to Control...

Page 187: ...d to the PACSystems OPC UA Server This is service request 130 protocol 0x0001 The OPC UA Server service request contains a number of sub functions to accomplish different tasks SERVICE_REQUEST 130 protocols Sub function Code OPC UA SERVER 16 0001 Note All other protocol codes are reserved and if used the SVC_REQ function will not pass power SERVICE_REQUEST 130 protocol 1 sub functions Sub function...

Page 188: ...is request can only be successfully performed when the OPC UA server is stopped Parameters for the START function service request function block are Parameter Summary Data Direction LD perspective 16 0001 OPC UA protocol IN 16 0000 START request IN 1440 to 1440 Time Zone Offset IN If the SVC_REQ does not pass power the operation did not complete The time zone offset adjusts the OPC UA server time ...

Page 189: ...onfiguration files Note This request can only be successfully performed when the OPC UA server is started Parameters for the STOP function service request are Parameter Summary Data Direction LD perspective 16 0001 OPC UA protocol IN 16 0001 STOP request IN The use of the STOP sub function code in a ladder diagram is illustrated in the following example If the SVC_REQ does not pass power the opera...

Page 190: ...used by the OPC UA Server on the controller Note This request can only be successfully performed when the server is stopped Parameters for the CLEAR function service request are Parameter Summary Data Direction LD perspective 16 0001 OPC UA protocol IN 16 0002 CLEAR request IN If the SVC_REQ does not pass power the operation did not complete Example ...

Page 191: ...rvice request are Parameter Summary Data Direction LD perspective 16 0001 OPC UA protocol IN 16 0005 RESTART request IN 1440 to 1440 Time Zone Offset IN If the SVC_REQ does not pass power the operation did not complete The time zone offset adjusts the OPC UA server time zone The Controller s Time of Day clock must be synchronized to local time and the time zone offset is your location s offset rel...

Page 192: ...mary Data Direction LD perspective 16 0001 OPC UA protocol IN 16 0003 SERVER_STATUS request IN 0000 0000 0000 0000 Server Status Response bitmask see below OUT If the SVC_REQ does not pass power the operation did not complete The SERVER_STATUS word bit definitions are displayed below Figure 65 SERVER_STATUS Word bit definitions Note that the CPE400 s OPC UA server takes up to two minutes to start ...

Page 193: ...Chapter 10 OPC UA Server 180 PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q Example ...

Page 194: ...FIG_CLEAR 0x0001 OPC_UA_SERVER_CONFIG_STAT_CONFIG_EXISTS 0x0002 Parameters for the SERVER_STATUS function service request are Parameter Summary Data Direction LD perspective 16 0001 OPC UA protocol IN 16 0004 CONFIG_STATUS request IN 0000 0000 0000 0000 Config Status Response bitmask OUT If the SVC_REQ does not pass power the operation did not complete The CONFIG_STATUS word bit definitions are di...

Page 195: ...xchange between the PACSystems Runtime and the Field Agent is independent of the state of this bit OPC UA Server Subroutine It is recommended that you create a subroutine to encapsulate the service request The subroutine is then available to the main program to use as necessary An application note entitled OPC UA Server Application Logic Quick Start Guide that includes an example subroutine is ava...

Page 196: ...ing edge clears the OPC UA configuration files and certificates Only allowed when server is stopped see section 10 1 14 for additional information concerning certificates Bool RestartSvr Rising edge stops and restarts the OPC UA Server Only allowed if the server is running Bool UTC_Offset Time offset in minutes difference between the controller time and universal time UTC Must be set before starti...

Page 197: ...word defined in OPC UA Server Service Request CONFIG_STATUS above Connect OPC UA Client to OPC UA Server Once the OPC UA server is running a client can connect to the server and browse the address space The OPC UA server uses the OPC UA Binary protocol to communicate with the client The OPC UA Binary connection strings take the base form displayed below As an example a connection string for the OP...

Page 198: ...er 10 OPC UA Server GFK 2224Q January 2017 185 Figure 68 Project Inspector Ethernet Config Window Note In the figure above Force Compact PVT is set to true This is the required setting for the OPC UA Server ...

Page 199: ...ver Client Connection String We can then connect to the OPC UA server Note The Client can see the Controller Target Name when connecting to the server The Controller Target Name is set within Machine Edition and is displayed in the screenshot above A sample client connection can be seen below Figure 70 OPC UA Client Connection Dialog Note The RXi s OPC UA server supports 5 clients If 5 clients are...

Page 200: ...tication You enable OPC UA server Anonymous Authentication by disabling Controller passwords Machine Edition is used to disabled controller passwords To access this setting using Machine Edition open the Controller hardware configuration with the Project tab within the Navigator expand the hardware configuration and select the controller Double click the controller tree node to access the controll...

Page 201: ...asswords are set using the Machine Edition commands Select Target Online Commands Show Status which opens the controller status dialog box Select the Protection tab click the Passwords button to set the passwords for the different access levels see the screenshot below The OPC Server assigns usernames to the different access levels The usernames that correspond to the different levels are as follo...

Page 202: ...Chapter 10 OPC UA Server GFK 2224Q January 2017 189 Figure 73 Machine Edition Online Command to Set Passwords ...

Page 203: ... Security Mode Both of these settings should be set to None for the OPC UA Server Connection see screenshot below Figure 74 OPC UA Connection Security Settings OPC UA Address Space The OPC UA address space contains information about the server and its application An OPC UA client browses the address space to determine server functionality and the controller application variables available from the...

Page 204: ...ace and allow the OPC UA client Read and Write Access External ReadOnly Publish variable to OPC UA address space and allow the OPC UA client Read Access only Note The Controller s OPC UA address space supports 12 500 addressable elements If more than 12 500 addressable elements are published only the first 12 500 listed alphabetically will be made available in the OPC UA address space Each index o...

Page 205: ...pace OPC UA Server Information in Address Space OPC UA servers allow clients to self discover the OPC UA servers and the server capabilities Thus there is significant information on both the application variables themselves and the server contained within the address space The following highlights some of these attributes Additional information regarding the address space can be found at the OPC F...

Page 206: ...Status Buildinfo see below contains information specific to the OPC UA server Figure 79 Server Specific Address Space The address space entries under BuildInfo can be accessed to learn more information for a specific controller Placing the variables in a subscription allows easy access to variable values see screenshot below Figure 80 BuildInfo Subscription ...

Page 207: ...bles Number of variables published by the OPC UA Server Both published variables and arrays count as one Published Variable each regardless of the array dimension An example is displayed below The example above indicates the following about the PACSystems Controller Address Space Status All Elements Published to Address Space The number of published elements did not exceed the maximum allowed by t...

Page 208: ...ller specific information under the GE Device Information node Figure 82 OPC UA Address Space GE Device Information The tree structure allows you to drill down into both the Controller and Energy Pack nodes to get information on these devices The variables under these nodes are defined as follows Variable Name Description Catalog Number Device Catalog Number Date Code Device Date Code Firmware Ver...

Page 209: ... specific information includes the Target Name and the controller s TCP IP address Thus if you change this information the server certificate will not contain this new information This may cause certain clients to either not connect and or generate warning messages concerning the conflicts between the running OPC UA server and the information contained within the server certificate If this informa...

Page 210: ...nications Window OPC UA traffic is processed in the controller communications window If the window s duration is inadequate for the amount of processing required to service multiple client requests increasing the comm window will improve response times by the PLC OPC UA Subscriptions OPC UA defines a subscription model for the server to transmit data only when an element s value updates rather tha...

Page 211: ......

Page 212: ...TP Post command to transfer form information from the browser to the server 11 2 Disabling Pop up Blocking Most internet browsers provided a feature that blocks pop up windows This prevents the viewing reference tables Change your browser settings to permit pop ups 11 3 Web Server Operation in a Redundant System In a redundant system only the active unit processes Web Server requests at the Redund...

Page 213: ... refresh the display All RX7i reference tables are available Selecting Reference Table Data Initially the previously viewed reference table is displayed To change the display you can Select Reference Table Data Row by Row The right column of each row contains the configuration options for that row For each row select the reference table starting address and data format You can select the R AI AQ I...

Page 214: ...ec unsigned decimal for one word of data Valid range is 0 to 65535 Hex a four digit hexadecimal value for one word of data The value has 16 as a prefix for example 16 4241 Valid range is 16 0000 to 16 FFFF ASCII ASCII representation of two 8 bit values For example a hex value of 16 4142 appears as A B ASCII display requires Internet Explorer 4 0 or Netscape 4 7 or later DblDecimal signed decimal f...

Page 215: ...s the most recent faults in the first 8 rows and the oldest faults in the last 8 rows To change the format of the fault extra data select the appropriate checkbox at the top of the page To refresh the fault data click the Refresh PLC Fault Table button When using Internet Explorer the fault extra data can be viewed by using the mouse to highlight a particular fault and then clicking on the fault T...

Page 216: ... below Figure 86 Fault Extra Data Display For Netscape first check the Show All checkbox and press the Refresh PLC Fault Table button This will show the fault extra data for all faults Netscape cannot show fault extra data for selected faults To hide the fault extra data uncheck the Show All checkbox and again press the Refresh PLC Fault Table button ...

Page 217: ... files via Windows FTP is described below You may also use a commercial FTP program Note You may not be able to open an FTP connection when the CPU is in Run mode and the level of Ethernet traffic is medium to heavy If the network traffic is high it is recommended that you reduce the network traffic before trying to create an FTP connection FTP Connect and Login You can either use a commercial FTP...

Page 218: ...he double quotes are not required Note The CHPARM command is not available if the PLC has received a valid configuration from the Programmer Web Page File Transfer After logging into the PLC s FTP server web page files can be copied from the PC to the PLC through the following steps 1 Set the FTP file transfer type to binary by typing in binary 2 For each file change to the desired directory if ap...

Page 219: ...ns once the number of browser FTP connections reaches the configurable limit any new browser or FTP connection requests will fail The number of Web Server and FTP connections is configurable via the Programmer The Programmer configuration details are described in the Programmer Help utility When the PLC is unconfigured the user can change the number of web server HTTP connections and FTP connectio...

Page 220: ...een Ethernet Interface CPU Embedded or standalone Description of symptoms of problem Depending on the problem you may also be asked for the following information The ladder logic application program and the PLC sweep time at the time the problem occurred A listing of the configuration parameters for the Ethernet Interface that failed A description of the network configuration This should include t...

Page 221: ...operation the EGD Management Tool can be used to check online operation of the EGD network and Exchange Status words can be used to troubleshoot exchange operations Use the Station Manager to troubleshoot a problem with the Ethernet Interface the network PLC backplane communication or with your application The LOG TALLY EXS CHANNEL STAT and XCHANGE Station Manager commands are especially useful Th...

Page 222: ...st Blink Traffic blinks when there is traffic on the line The process symbols use in this chart are Temporary condition requires no intervention Decision point during powerup Interface State normally the Interface remains in a state unless there is user intervention Symbols E E Hardware Failure A B D No No Yes 3 Yes IP Address Received 4 Operational Full support for client and server capability Us...

Page 223: ...mer CPU not communicating with Ethernet Interface Condition can last a maximum of 5 minutes Use the PLC Programmer configuration software to configure the Interface then store the configuration to the PLC CPU Power cycle the PLC Clear faults and Restart Interface EOK Blinking error code LAN Off STAT Off Unrecoverable hardware or runtime failure See the list of blink codes on the next page EOK Slow...

Page 224: ...n 0x21 RAM failure during power up diagnostics 0x61 Boot Critical interrupt exception 0x22 Stack error during power up diagnostics 0x62 Boot Machine check exception 0x23 Shared Memory Interface error during power up diagnostics 0x63 Boot Data store exception 0x24 Firmware CRC cyclic redundancy check error during power up or Factory Test22 0x64 Boot Instruction store exception 0x25 Run time excepti...

Page 225: ...t tables in GFK 2225 TCP IP Ethernet Communications for PACSystems Station Manager Manual In that document refer to Appendix B Exception Log Events Controller Fault Table Descriptions Controller Fault User Action Backplane communications with controller fault lost request Check to make sure that the logic application is not sending COMMREQs faster than the Ethernet Interface can process them Reduc...

Page 226: ...ers running soft Sw utl Internal system error If problem persists contact Technical Support LAN I F capacity exceeded discarded request Verify that connection limits are not being exceeded LAN interface hardware failure switched off network Replace the Ethernet Interface LAN network problem exists performance degraded Excessive backlog of transmission requests due to excessive traffic on the netwo...

Page 227: ...ould be revised to reduce the rate at which it sends COMMREQs to the Ethernet Interface Non critical CPU software event The CPU is attempting to send mail messages faster than they can be retrieved by the Ethernet Interface the messages are discarded This can result in subsequent Backplane communications with controller fault lost request faults 12 6 Monitoring the Ethernet Interface Status Bits T...

Page 228: ...rror error on any channel 10 Reserved Reserved LAN 2 Port 1 Link Indicates that the port has link 11 Reserved Reserved LAN 2 Port 2 Link Indicates that the port has link 12 Reserved Reserved LAN 2 OK Indicates that the application can get out in the network on at least 1 port 13 LAN OK LAN OK LAN OK LAN 1 has only 1 port 14 Resource problem Resource problem Resource problem 15 Module Overtemp RX3i...

Page 229: ...r Modbus TCP Client Channel Open Reserved Channel 32 Status SRTP Data Transfer Modbus TCP Client Channel Open 80 Channel 32 Modbus TCP Client Reserved SRTP Client Channel Error Reserved Channel 32 Modbus TCP Client Reserved SRTP Client Channel Error 23 The original information is located in GFK 2224L TCP IP Ethernet Communications for PACSystems RX3i and RX7i from June 2013 24 For CPE330 LAN1 is t...

Page 230: ...he logic application has enabled CPU Time Update interrupts For more information see Timestamping of Ethernet Global Data Exchanges in Chapter 5 Bit 6 Redundant IP Address Active Rack based and RX7i Embedded This bit is set to 1 when the configured Redundant IP address is active Otherwise this status bit is set to 0 Bit 9 Any Channel Error All models This bit normally 0 indicates one or more of th...

Page 231: ...t the next transfer has not begun or completed After an Establish Channel command the COMM_REQ status word CSW is always updated before the Data Transfer bit is set to 1 The Data Transfer bit for a channel is not meaningful until the Ethernet Interface updates the CSW Do not use data received from a server until the CSW confirming the Read command for that channel is 1 and the Data Transfer bit go...

Page 232: ...lock to the Ethernet Interface In this case the other status indicators are not updated for this COMMREQ The Ethernet Interface is unable to return a COMMREQ Status Word to the PLC logic application 12 8 Monitoring the COMMREQ Status Word Every COMMREQ Command Block instruction specifies a 1 word memory address to receive status information about the execution of the command Before executing a COM...

Page 233: ... to display the hexadecimal value within the ladder program Hex Format High Low 00 00 Minor Error Codes high byte Success and Major Error Codes low byte Status Word in Figure 91 Decoding the COMMREQ Status Word The following tables list the error codes that are reported in the COMMREQ Status word after the execution of a COMMREQ function Note The COMMREQ Status words for SNTP Time Transfer command...

Page 234: ...orted at the server PLC This value is returned in lieu of the actual service request error 01H to avoid confusion with the normal successful COMMREQ completion Contact Technical Support for assistance 11H SRTP Error Code at server An error was detected at the SRTP server See the following table of Minor Error codes 82H Insufficient Privilege at client PLC The minor error code contains the privileg...

Page 235: ...Chapter 12 Diagnostics 222 PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q Minor Error Codes for Major Error Codes 05H at Remote Server PLC and 85H at Client PLC ...

Page 236: ...105H D185H Packet size or total program size does not match input D205H D285H Invalid write mode parameter D505H D585H Invalid block name specified D605H D685H Total datagram connection memory exceeded D705H D785H Invalid datagram type specified D805H D885H Point length not allowed D905H D985H Transfer type invalid for this Memory Type selector DA05H DA85H Null pointer to data in Memory Type selec...

Page 237: ...id source detected in a mailbox message 1A11H Invalid slot number detected in a mailbox message 1B11H Invalid rack number detected in a mailbox message 1D11H Bad text buffer address in dual port memory 2111H Unable to find control data required to send a mailbox message to the PLC 2211H Timed out waiting for availability of mail communications with the PLC 2311H Invalid task ID detected while atte...

Page 238: ...valid field was identified in the request mailbox qualifier E811H Unable to send request to the PLC because an internal message queue is full E911H Unable to send request to the PLC because the text buffer type is invalid EA11H Unable to send request to the PLC because the mailbox utility function is invalid EB11H Unable to send request to the PLC because the mailbox message is not specified EC11H...

Page 239: ...0 255 8F90H Invalid IP address class Must be valid Class A B or C IP address May also occur if the destination IP address in the COMMREQ is same as the sender s IP address 9090H Insufficient TCP connection resources to do request 9190H Zero local starting address is not allowed 9290H Address length value invalid Must be 4 for address type 1 9390H COMMREQ data block too short for Program Block name...

Page 240: ... COMMREQ before the COMMREQ Status Word for the previous COMMREQ was set AC90H A protocol error occurred while communicating with the local PLC AD90H A TCP Timeout occurred while communicating with the Remote PLC AE90H A protocol error occurred while communicating with the local PLC B490H The channel that the application is trying to open is already open B590H The channel the application is trying...

Page 241: ...ver has an incorrect value Modbus exception code 03 ILLEGAL DATA VALUE 0491H Slave Device Failure An unrecoverable error occurred while the server was attempting to perform the requested action Modbus exception code 04 SLAVE DEVICE FAILURE 0591H Acknowledge Used for Programmer operations only Our Modbus TCP server does not support Modbus programmer operations Modbus exception code 05 ACKNOWLEDGE 0...

Page 242: ...ssing this command 11A0H Remote device did not understand the request 12A0H Remote device has no variable defined at the specified address 13A0H An attempt was made to write a Read Only variable at remote device 14A0H Data length or contents are invalid for transfer according to the data type of that variable at remote device 15A0H Response message would exceed max response size 1400 bytes 50A0H T...

Page 243: ...tor and right click Select Launch EGD Management Tool The EMT will begin execution in a separate frame on your desktop Figure 92 EGD Management Tool Screenshot The right side of the screen shows a graphical representation of the EGD network based on the configuration data stored in the EGD Configuration Server EGD collections are displayed as a folder icon The navigator on the left side allows spe...

Page 244: ...d of error or warning condition that may require attention Use the browser pane to select the device to get further information about the failures being reported The EGD Management Tool reports a configuration mismatch for PLCs that have multiple Ethernet Interfaces Only one of the interfaces in a PLC is queried by the EGD Management Tool so only a subset of the exchanges in the PLC is visible onl...

Page 245: ...change has the following information Exchange the name of the exchange as it is stored in the EGD configuration server Producer ID the producer ID of the exchange as it is stored in the EGD configuration server Destination the destination IP address for the exchange Mode Unicast Multicast or Broadcast based on the mode of the exchange Type Producer or Consumer depending on the type of the exchange...

Page 246: ...his is the time at which the exchange will time out if data is not received Status information about the status of the exchange For a produced exchange status will be Producing if the exchange is actively being sent to the network and Pending if the exchange is defined but not producing A Pending status in a PACSystems exchange may indicate that the controller has its I O disabled thus stopping th...

Page 247: ...m the COMMREQ delivery will fail The fault output of the COMMREQ function block will be set and the COMMREQ will not be delivered to the Ethernet Interface In this case the PLC logic program should attempt to initiate the COMMREQ on another sweep after a very short delay This condition may arise when the logic Program attempts to initiate greater than 16 COMMREQs in the same logic sweep Sustained ...

Page 248: ...ernet Interface LAN system software fault resuming with exception Event 8 Entry 2 16 location Ethernet Interface Non critical CPU software event status code bytes 5 8 80 3a 00 12 location CPU module The PLC Timeout condition occurs when the CPU cannot process requests within a specified timeout period The remedy is to reduce the rate of requests or increase the processing capacity in the PLC Cause...

Page 249: ... handle the traffic volume Consult you network administrator for assistance The SRTP channel timeout and period include the time required to establish the TCP connection It is important to consider the connection time when configuring these values If more than one SRTP channel is being established and the PACSystems server has just been restarted or updated with a new hardware configuration the ch...

Page 250: ...t Interface remains open for 7 minutes while TCP attempts to reconnect During this interval the SRTP or Modbus TCP connection is unavailable If all the SRTP or Modbus TCP connections in the Ethernet Interface are in use or otherwise unavailable a new SRTP or Modbus TCP server connection must wait until an existing SRTP or Modbus TCP connection times out If the SRTP server connection was used by th...

Page 251: ... only one pending EGD command from a client device to each server device Attempts to issue a second EGD command from a client to the same server before completion of the first command will result in an error Some examples are 1 The logic application issues a second EGD Command COMMREQ to the same remote server perhaps from a different location in the logic program 2 The EGDCMD Station Manager comm...

Page 252: ...consume so much processing time that the watchdog timer for the network interface expires and the network interface is reset Channels Operation Depends Upon PLC Input Scanning Communication channels operation always includes updating the Channel Status Bits located within the Ethernet Status data into PLC memory which occurs when the PLC scans inputs from the Ethernet module At least one PLC input...

Page 253: ...Chapter 12 Diagnostics 240 PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q ...

Page 254: ...is formatted and is based on the number of bits in the netid part of the IP address 0 1 Class A 0 netid hostid 8 16 24 31 0 1 Class B 1 netid hostid 0 8 16 24 31 0 1 2 Class C 1 netid hostid 1 0 8 16 24 31 Figure 97 IP Address Format for Network Classes A B C In general the netid part is assigned by the Internet authorities and the hostid part is assigned by your local network administrator The cl...

Page 255: ...icast group Multicast Class D IP addresses 224 0 0 0 through 239 255 255 255 are reserved by the Internet authorities for multicasting Multicasting is a feature of Ethernet Global Data For more information on the use of multicasting in Ethernet Global Data see Chapter 5 Loopback IP Addresses Class A IP Addresses in the 127 xxx xxx xxx range are reserved for loopback addressing A network packet usi...

Page 256: ... on the CPE330 are initially configured with following problematic IP parameters LAN1 LAN2 IP 10 10 0 1 192 168 0 1 Subnet Mask 255 255 255 0 255 255 255 0 Gateway 10 10 0 249 0 0 0 0 The user intends to communicate between the remote device and CPE330 LAN1 Figure 98 IP Address routing allows the CPE330 to receive the remote IP requests through the respective gateways 192 168 0 250 for the remote ...

Page 257: ...Chapter 13 Network Administration 244 PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q Figure 99 Expected Response Path Figure 100 Actual Response Path ...

Page 258: ...ta to A B must have the IP address of the gateway connecting the two networks In this example the gateway s IP address on Network 2 is 172 17 0 3 This address would be configured in the Ethernet Interface s module configuration for PLC B as its default gateway address Note that the gateway has two IP addresses 172 16 0 2 and 172 17 0 3 The first must be used by hosts on Network 1 and the second mu...

Page 259: ...lass B network in the previous example The result is shown in the figure below Selecting the subnet mask shown below would add two additional netid bits allowing for four physical networks addressed as 0 64 128 and 192 The added subnet bits are normally taken from the hostid bits adjacent to the netid and the subnet mask identifies these bits 11111111 11111111 11000000 00000000 255 255 192 0 netid...

Page 260: ...16 0 2 Gateway Gateway 172 17 64 4 Figure 104 Network 2 Divided into Subnets 2 1 and 2 2 Here a second network with Hosts D and E has been added Gateway G2 connects Subnet 2 1 with Subnet 2 2 Hosts D and E will use Gateway G2 to communicate with hosts not on Network 2 2 Hosts B and C will use Gateways G1 and G2 to communicate with hosts not on Network 2 1 When B is communicating with D G2 the conf...

Page 261: ...id value such as networks 1 and 2 in this example As with subnets the subnet mask is used to divide the IP address into a custom netid portion and hostid portion For example the two networks 10 0 117 0 and 10 0 116 0 can be combined into a larger 10 0 116 0 network if the subnet mask 255 255 254 0 is applied to both addresses 11111111 11111111 11111110 00000000 255 255 254 0 netid bits hostid bits...

Page 262: ...Chapter 13 Network Administration GFK 2224Q January 2017 249 ...

Page 263: ......

Page 264: ...ontain the names and values of only those parameters that are being changed This user generated AUP file is then imported into the programmer and assigned to a particular Ethernet Interface To modify Advanced User Parameters in more than one Ethernet Interface in the same control system import an AUP file for each Ethernet Interface If the changes are identical you can use the same AUP file for mo...

Page 265: ...ot location of the Ethernet Interface For an embedded Ethernet interface r and s indicate the Rack and Slot location of the CPU module parameter name parameter value parameter name parameter value parameter name parameter value Important Note 1 This format is not used for the CPE330 or CPE400 AUP parameters are located in the PME Ethernet configuration 2 Entering an invalid AUP parameter within th...

Page 266: ...be entered in standard dotted decimal format Comments in the file must start with a semicolon character All characters in the same line following a semicolon are ignored Blank lines are ignored The maximum line length in the AUP file is 80 characters Any line including comments that exceeds this length will cause errors in processing Example The following example sets the station manager password ...

Page 267: ... to respond to a request sent through the PLC Driver 60 seconds 10 3600 E10H chct_comp26 HCT compatibility option Rel 2 57 and later Allows Ethernet interface to ignore SRTP header errors typically generated by remote HCT devices that were not detected in previous Series 90 products 0 HCT compatibility disabled report all errors 1 HCT compatibility enabled ignore some errors 0 0H 0 1 cstorm26 COMM...

Page 268: ...dp parameters may share the same UDP port number All other UDP port number parameters in the AUP file must use unique port numbers gbcast_ttl IP time to live for global broadcast messages hop count 1 1H 0 255 00ffH gucast_ttl IP time to live for point to point unicast messages hop count 16 10H 0 255 00ffH gp_phase Startup delay time in ms for successive produced exchanges 0 0H 0 65535 ffffH gcmd_p...

Page 269: ... port number parameters in the AUP file must use unique port numbers gXX_addr Multicast host group IP Address must be Class D address 224 0 7 XX 224 0 0 2 239 255 255 255 gXX_ttl IP time to live for host group multicast messages hop count 1 1H 0 255 00ffH Note If you configure different values for EGD exchanges with Unicast and Broadcast destination types the largest value will be used for all Uni...

Page 270: ...lex1b Ethernet duplex for Port 1B 0 auto detect 1 half 2 full 0 0 1 2 lspeed0 Ethernet speed for Controller 0 auto detect 1 10Mbit 2 100Mbit 0 0 1 2 lspeed1a26 Ethernet speed for Port 1A 0 auto detect 1 10Mbit 2 100Mbit 0 0 1 2 lspeed1b Ethernet speed for Port 1B 0 auto detect 1 10Mbit 2 100Mbit 0 0 1 2 Modbus TCP IP Server Parameters task m None None Note SNTP is supported on the embedded Etherne...

Page 271: ...P address of the primary time server in dotted decimal format xxx xxx xxx xxx This parameter is required when unicast mode is used None Any valid unicast IPv4 address nsecondary IP address of the secondary time server in dotted decimal format xxx xxx xxx xxx This parameter is optional None Any valid unicast IPv4 address npoll_interval Poll interval of Unicast Period in seconds at which new time re...

Page 272: ...e day of the week when DST begins 1 Sunday 7 Saturday None 1 7 ndst_start_ week The number of the occurrence of ndst_start_day in the month 1 is the first occurrence None 1 4 ndst_start_ time The time in hours and minutes when DST begins None 0 00 23 59 ndst_ref_ zone Indicates the time zone of reference for ndst_start_time and ndst_end_time L Local Time U UTC None L or U ndst_end_ month The month...

Page 273: ...pnumarp Number of gratuitous ARP requests to send out during Redundant IP activation process 1 0001H 1 25 rdiparplog Number of gratuitous ARP requests to send by backup unit before a Redundant IP not available exception is logged The backup unit continues to send ARP requests as long as it receives network packets addressed to the Redundant IP Address 5 0005H 1 25 FTP Parameters task t Default Ran...

Page 274: ...RX3i CPE305 CPE310 Embedded Ethernet Interface The default values and ranges of valid values are the same as those in other PACSystems Ethernet interfaces Note When explicitly configuring speed or duplex mode for an RX3i embedded Ethernet port using Advanced User Parameters AUP do not request a store to flash as a part of the download when communicating over the CPE305 CPE310 embedded Ethernet por...

Page 275: ...62 PACSystems RX7i RX3i TCP IP Ethernet Communications User Manual GFK 2224Q Network Interface Parameters task l lduplex1a lspeed1a SRTP Server Parameters task v vconn_tout TCP Parameters task w wnodelay wkal_idle wkal_cnt wkal_intvl wsnd_buf wrcv_buf ...

Page 276: ... are available on our web site www geautomation com Additional Resources For more information please visit the our web site www geautomation com Copyright 2002 2017 General Electric Company All Rights Reserved Trademark of General Electric Company All other brands or names are property of their respective holders GFK 2224Q ...

Search results

Summary of Contents for PACSystems RX7i

Reviews:

Related manuals for PACSystems RX7i

Brands by name

Popular brands

GE PACSystems RX7i, User Manual

Search results

Summary of Contents for PACSystems RX7i

Reviews:

Related manuals for PACSystems RX7i

Brands by name

Popular brands