Manage PLC Channels

About PLC Channels

The OT PLC channel communicates with PLC’s via a TCP/IP connection without the need for an OPC Server. The channel currently supports:

S7-300, S7-400, S7-1200, S7-1500, Logo 8 and  S7-200 (equipped with a CP243, experimental support)

Allen Bradley Control Logix, PLC/5, SLC 500, Control Logix using the PLC5 protocol, Micro800 and MicroLogix via port 44818 (0xAF12)

Modbus TCP

Each PLC has several memory areas that identify physical inputs and outputs, counters, timers, data blocks or memory addresses. The PLC channel only supports reading from and writing to data blocks, memory addresses and tags. It does not support reading from and writing to physical I/O, timers or counters. This will not change in future versions of the PLC channel.

Create a PLC Channel

Select the OT Bus Stop tab.

Click PLC Client.

A tab is opened showing a list of configured PLC channels.

A number of buttons are displayed at the bottom of the tab:

Add: Add a new channel.

Edit: Edit the selected channel.

Delete: Delete the selected channel, this will only work if all references (bus and channel message actions are removed).

Copy: Copy the selected channel.

Refresh: Refresh the list of available OT PLC client channels.

Import: Import a channel stored in an XML file.

Export: Export the selected channel to an XML file.

Clicking Add or Edit to open a window that shows two tabs, General and Channel Messages. The General tab configures the connection to the PLC and the Channel Messages tab configures the data being exchanged with the PLC. 

The General tab configures the following connection parameters:

Name: A unique name for the channel.

Descriptions: Enter a description in the default language and any other required languages.

Driver: The communication driver to use either S7 Protocol or Allen Bradley / Modbus-TCP. Each option comes with different parameters.

Cache update interval(ms): The PLC channel polls the PLC every x milliseconds to update the cache.

The PLC channel polls the configured PLC addresses every x milliseconds and stores the values in the cache. This mechanism is used to reduce the communication between the PLC channel and the PLC when the channel message trigger type is set to Trigger or On change acquisition. Interval acquisition uses its own interval. It is important to understand that the update interval should not be set too short when reading multiple PLC addresses. Errors will be written to the event log should the time to read all PLC addresses exceed the configured interval.

As each PLC channel has only 1 connection to the PLC, it is recommended that multiple PLC channels be created to facilitate faster processing of multiple PLC addresses.

Siemens S7 Protocol connection parameters

The PLC channel has the following configuration parameters to connect to a Siemens S7:

Driver: Must be set to S7 Protocol.

Host: The IP address or FQDN of the PLC

Port: The port number at which the PLC protocol is listening. 102 is used by the S7 protocol.

Use TSAP: Place a tick in this check box to configure a connection with a Siemens Logo 8 or Siemens S7-200 equipped with a CP243.

Ticking this check box will replace the Rack and Slot fields with Local TSAP and Remote TSAP.

Rack: The PLC rack number that holds the S7 CPU. (Available if Use TSAP is not ticked).

Slot: The slot number in the rack that holds the S7 CPU. (Available if Use TSAP is not ticked).

Local TSAP: A hexadecimal value that can be found in the Siemens manual for the PLC. (Available if Use TSAP is ticked).

Remote TSAP: A hexadecimal value that can be found in the Siemens manual for the PLC. (Available if Use TSAP is ticked).

Rack and slot

The following table shows the rack and slot settings for the supported Siemens PLC’s:

	Rack	Slot
S7-300	0	2	Always
S7-400	0..7	1..31	Follow the hardware configuration
S7-1200	0	0..1
S7-1500	0	0..1

Allen Bradley / Modbus-TCP connection parameters for EthernetIP

The following must be configured to connect to an Allen Bradley PLC using EthernetIP:

Driver: Must be set to Allen Bradley / Modbus-TCP.

Protocol: Must be set to Allen Bradley EthernetIP.

Gateway: The IP address of the PLC, the port is set to 44818 (0xAF12).

Path: The Allen Bradley communication path / routing. Example: 1,6 (1 = port to the backplane, 6 = slot of the ethernet module), review chapter 4 of the 1756-RM003 manual for more details.

PLC Type: The type of Allen Bradley PLC to connect to (Control Logix, PLC/5, SLC 500, Control Logix using the PLC5 protocol, Micro800 and MicroLogix).

Allen Bradley / Modbus-TCP connection parameters for Modbus-TCP

The following must be configured to connect to an Modbus-TCP server:

Driver: Must be set to Allen Bradley / Modbus-TCP

Protocol: Must be set to Modbus-TCP.

Gateway: The IP address and optional port number of the Modbus server. The default port number for Modbus-TCP is 502.

Example:

Using the default port number: 10.0.0.1

Using an alternative port number: 10.0.0.1:1502

Path: The Modbus unit ID.

Add or Edit a Channel Message

While editing a channel select the Channel Messages tab.

All existing channel messages contained in the channel are listed. The table shows the name of the channel message, the direction in which the message is going and whether or not the message is currently active.

Click Add (or Edit to modify an existing message).

Enter a name for the channel message.

Select a Message Definition. Message definitions act as templates when adding messages to a Channel. They specify whether the message is being uploaded or downloaded and also lists the different data fields that will be available in the message. The Tags control opens.

Link the tags to data fields as described herehere.

Select the Acquisition type and configure the Acquisition settings, these will define how data is exchanged between the channel message and the peer. Please note that the Acquisition types and settings depend on the Direction of the channel message:

Upload

Interval acquisition: Acquisition defined in seconds. The interval must be provided.

Trigger Tag Acquisition: The values of the tags are read when the selected trigger tag changes value. The trigger tags can be specified using the ‘Acquisition settings’.

Simple handshake upload: Apply a simple handshake using a trigger tag.

Double handshake upload: Apply a double handshake using a trigger tag and acknowledge tag.

Rising edge: Start message exchange when the trigger tag goes from zero to non-zero.

Falling edge: Start message exchange when the trigger tag goes from non-zero to zero.

On Change Acquisition: The values of the tags are read when the value of a monitored tag is changed in the channel message.

All tags within the channel message are marked as monitored tags by default. Users can remove the flag for any tags that are do not require monitoring.  The monitored flag is only visible for On Change Acquisition.

Scheduled Acquisition: The values of the tags are read at a specific time on a daily, weekly or monthly schedule.

Download

Trigger Tag Acquisition: The values of the tags are downloaded to the PLC using a handshake. The handshake prevents the channel from downloading new values to the PLC if the trigger is not in an idle state. The trigger tags can be specified using the ‘Acquisition settings’.

Value download: This downloads the channel message directly to the PLC without using a handshake.

Simple handshake download: Apply a single handshake when downloading the data to the PLC.

Double handshake download: Apply a double handshake when downloading to the PLC using a trigger tag and acknowledge tag.

For more information on acquisition settings see here.

If required, enable Handshake Only. This should be selected if the message is to be used for a heartbeat interface.

Enable Active so that the channel message can be used.

Message filtering is available when the Direction of the channel message's message definition is set to Upload. This feature enables conditions to be configured that decides whether or not a channel message is processed. The PLC channel evaluates the condition as soon as a channel message arrives and processes it if the condition is met.

Clicking the ellipsis on the Filter edit box opens the following dialog where the condition can be configured.

A condition has a left and right operand, an operator and datatype. The Data type specifies the datatypes of both operands (Boolean, Integer), the must be the same.

The left and right operand can use the following data sources:

The actual value from the PLC.

Constant value

Data translation table, converting the actual value from the PLC to a value configured in the translation table.

Function evaluation, this takes the result of a function that may use the actual value coming from the PLC.

Bus stop variable

The operator can be:

Less than ‘<’

Less than or equal ‘<=’

Equals ‘==’

Not equal ‘<>’

Greater than or equal ‘>=’

Greater than ‘>’

Add and Modify Tags

ATS Bus tags provide the location of the data in the PLC. This can be an address (Siemens), a tag (Allen Bradley) or a register (Modbus-TCP)

Click Add below the Tags pane (or Edit to modify an existing tag).

A new window opens to configure the tag.

The tag configuration shown above is one for an Allen Bradley tag that is read from the PLC. The tag window shows an additional Data type dropdown in the Source or Destination panel depending on the direction. This dropdown is used to specify the data type used by the PLC internally e.g.: INT, REAL, LREAL, SINT, BOOL, etc.

Enter the name of the tag in the Description field.

Select a Data Type. This is how ATS Bus interprets the data.

Enable the Active checkbox to ensure the tag is active.

The source and destination can now be selected. The source and destination will depend on whether it is an Upload or Download message definition and on the message format that's been selected.

Select the Data source. This can be one of the following:

Name	Description	Required Information
PLC tag address	The value received from the tag address.	Address of the tag.
Constant value	The tag will always be the same value.	Enter the value to be used.
Data translation table	The value is read from a specific PLC address (upload) or message field (download) and then translated using a data translation table.	Select the translation table to use and the PLC address or message field for the source value.
Message Field (download only)	Value from specific message field.	Select the message field.
Function evaluation	The value is read from a specific PLC address (upload) or message field (download) and then modified using a function.	Enter the function to use and the PLC address or message field for the source value that will be modified by the function.
Reset counter evaluation (upload only)	Instead of sending the received value it sends the iteration. For example, if the last known value was 50 and it receives a value of 53 then the output will be 3.	No extra information required.
Rollover counter evaluation (upload only)	Instead of sending the received value it sends the iteration. As soon as a defined limit is reached the value is reset and the counter goes back to zero. For example, if the current value is 99, rollover is set to 100 and 5 is the incoming value then the result is 6. This is calculated as follows: (100 – 99 + 5 = 6)	Specify the rollover value set for the equipment the value is being received from.
Bus stop variable	A bus stop variable.	Select a bus stop variable.

Select the Destination. This will either be a message field or bus stop variable for upload or a PLC tag address or Bus stop variable for download:

Click OK.

The tag window might show an additional dropdown list with data types used by the PLC. The tag dialog will ensure that the ATS Bus Data type matches the data type used by the PLC. A validation error is shown in case of a mismatch.

The tag is added to the channel message.

Click OK.

The channel message is added to the channel.

Click OK.

The channel is saved.

PLC addresses

Siemens S7

The PLC channel does not support all Siemens memory areas. It is restricted to data blocks and the marker area (also called flag area).

Please check the following configuration settings in an S7-1200 and S7-1500.  Optimized block access for every DB used should be unchecked. Protection: Full access (no protection). Connection mechanism: Enable ‘Permit access with PUT/GET communication from remote partner’

Siemens PLC addresses are provided in the following format:

Data blocks: DB<n>.DB<memory_width><offset>[.<bit>|<S7_datatype[<length_or_size>]>]

Markers: M<memory_width><offset>[,<bit>|<S7_datatype[<length_or_size>]>]

Where:

<n> is the datablock number.

<memory_width> is ‘X’ (bit, for DB only), ‘B’ (byte), ‘W’ (word) and ‘D’ (double word).

<offset> is an offset starting from 1.

.<bit> the bit index (range 0 to 7).

<S7_datatype> is the Siemens S7 data type which is optional in the S7 address used by the PLC channel. The PLC channel only supports 1, 8, 16 and 32 bit data types. It supports the following values:

BOOL: 1 bit

BYTE: unsigned byte (8-bit)

CHAR: signed byte (8-bit)

WORD: unsigned word (16-bit)

DWORD: unsigned double word (32-bit)

SINT: signed short integer (8-bit)

INT: signed integer (16-bit)

DINT: signed double integer (32-bit)

REAL: IEEE float (32-bit)

TIME: Siemens S7 Date, stored as word in steps of one day since January 1, 1990

TOD: S7 Time of Day, milliseconds since midnight. Stored as DWORD.

DT: Siemens S7 Date and Time, stored as 64-bit value.

byte 0 = year

byte 1 = month

byte 2 = day

byte 3 = hours

byte 4 = minutes,

byte 5 = seconds

byte 6 = two most significant digits of millisecond

byte 7 (4MSB) two least significant digits of millisecond

byte 7 (4LSB) = day of week

STRING: S7 String. An S7 string requires 2 additional bytes to store the string in the PLC, the first byte indicates the maximum length and the second byte indicates the actual length.

<length_or_size>: is the length specifier for an S7String or the size specifier for a character array. Arrays are not supported for other S7 data types.

The PLC channel applies the following default/raw data types when a specific S7 data type in the address string is omitted:

Memory area: X --> S7 data type: BOOL.

Memory area: B --> S7 data type: BYTE.

Memory area: W --> S7 data type: WORD.

Memory area: D --> S7 data type: DWORD.

S7 addressing examples:

DB5.DBX10.1

M10.1

DB5.DBW10

MW10

DB5.DBB10|SINT

DB5.DBB10|CHAR[10]

MB10|CHAR[10]

DB5.DBB10|STRING[10]

MB10|STRING[10]

DB5.DBD10|REAL

MD10|REAL

Supported S7 Elementary data types

	Description	S7-300 / S7-400	S7-1200	S7-1500
Bit data type	BOOL BYTE WORD DWORD	Yes	Yes	Yes
Character type	CHAR (8-BIT)	Yes	Yes	Yes
Numerical data types	INT (16-bit) DINT (32-bit) REAL (32-bit)	Yes	Yes	Yes
	SINT (8-bit) USINT (8-bit) UINT (16-bit) UDINT (32-bit)	No	Yes	Yes
Time types	TIME DATE TIME_OF_DAY	Yes	Yes	Yes
	DT	Yes	Yes	Yes

Allen Bradley

Allen Bradley tags can be read from the controller (controller tags) or from a program (program tags). Program tags are prefixed with <PROGRAM_NAME>. and controller tags are not prefixed. Bear in mind that ATS Bus does not support reading arrays from the PLC.

Allen Bradley addressing examples:

N7 (non-array)

N7[0]

F8[9]

MyPogram1.MyTag1

MyStruct1.MyStructMember1

MyProgram1.MyStruct1.MyStructMember1

Each tag has a data type which should be configured using the Data type dropdown in the Source (read from the PLC) or Destination (write to the PLC) panel. Bear in mind that a validation error is shown when the Data type in the General panel does not match the one in the Source or Destination panel. The following list shows how Allen Bradley data types are mapped to ATS Bus data types:

BOOL: Boolean

DINT: nteger

INT: Integer

LINT: Integer

LREAL: Float

REAL: Float

SINT: Integer

STRING: String

Modbus-TCP

The Allen Bradley EthernetIP / Mosbus-TCP driver supports the following 5 or 6 digit Modbus zero-based addresses:

0xxxxx = Coil = 1-bit read/write = boolean

1xxxxx = Discrete input = 1-bit read only = boolean

3xxxxx = Input register = 16 bit read only = signed integer

4xxxxx = Holding register = 16-bit read/write = signed integer

5 digit addresses range from x0000 to x9999, 6 digit addresses range from x00000 to x65535.

Examples:
Coil 00023 translates to address 00022
Discrete input 10010 translates to address 10009
Input register 30012 translates to address 30011
Holding register 40400 translates to address 40399

 

Can we improve this topic?