Home

TCP/IP Ethernet Communications for Series 90

1. Type Value Value Description Decimal Hex R 8 08H Register memory word mode AI 10 OAH Analog input memory word mode AQ 12 OCH Analog output memory word mode l 16 10H Discrete input memory byte mode 70 46H Discrete input memory bit mode AQ 18 12H Discrete output memory byte mode 72 48H Discrete output memory bit mode T 20 14H Discrete temporary memory byte mode 74 4AH Discrete temporary memory bit mode M 22 16H Discrete momentary internal memory byte mode 76 4CH Discrete momentary internal memory bit mode G 56 38H Discrete global data table byte mode 86 56H Discrete global data table bit mode Word 4 COMMREQ Status Word Address Offset This word contains the offset within the memory type selected The status word address offset is a zero based number For example if you want R1 as the location of the COMMREQ status word you must specify a zero for the offset The offset for R100 would be 99 decimal Note however that this is the only zero based field in the Channel commands Word 5 Reserved Set to zero Word 6 Reserved Set to zero Words 7 and up Data Block The Data Block defines the Channel command to be performed 6 8 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Establish Read Channel 2003 The Establish Read Channel command requests that a channel be associated with a remote PLC and th
2. Word Value Description Offset Word 1 Length of command data block Always 25 Word 2 0 Always 0 no wait mode request Word 3 See table on page 5 3 Memory type of COMMREQ Status Word Word 4 0 based Offset of COMMREQ Status Word Word 5 0 Reserved Word 6 0 Reserved Word 7 4002 fa2H Read EGD Exchange command number Word 8 Retry time in milliseconds The time between retries of command transfers in 10 millisecond increments Default is 1000ms Word 9 Local read buffer memory type Memory type for the data in the local PLC Word 10 11 Local read buffer reference table 1 based offset starting address Word 12 Remote signature EGD Exchange signature This should be 0 for PLCs Word 13 14 Remote Producer ID EGD Producer ID Word 15 16 Remote Exchange ID EGD Exchange ID Word 17 Remote Exchange Offset Byte offset 0 based in the exchange that should be read Word 18 Read length Number of bytes to be read in the range 0 to 1400 bytes Word 19 Network address type Must be 1 Indicates that an IP address will be used Word 20 Network address length Must be 4 for IP address Group ID multicast is not permitted Word 21 to IP Address of the remote PLC Four integers specified as one integer per word of the Word 24 dotted decimal IP address of the remote PLC May not be a group IP address Word 25 Reserved Always 0 Word 4 COMMREQ status word address is the only zero based address in the Command Block O
3. Status Brief Description Bits 1 Port 1 full duplex 2 Port 1 100Mbps 3 Port 2 full duplex 4 Port 2 100 Mbps 5 8 Reserved 9 Any Channel Error error on any channel 10 12 Reserved 13 LAN OK 14 Resource problem 15 Reserved 16 LAN Interface OK 17 Channel Open Channel 1 18 Reserved Channel 1 47 Channel Open Channel 16 48 Reserved Channel 16 49 80 Reserved Note Unless the LAN Interface OK bit is set Status Bit 16 the other status bits are invalid 8 26 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A The LAN Status bits bits 1 16 are described in Chapter 11 Diagnostics They monitor the health of the Ethernet Interface itself Bit 16 LAN Interface OK Bit This bit is set to 1 by the Ethernet Interface each PLC scan If the Ethernet Interface cannot access the PLC the CPU sets this bit to 0 When this bit is 0 all other Ethernet Interface Status bits are invalid Each Modbus channel has a dedicated status bit Status Bits 17 19 21 79 Connection Open Bit This bit is 1 when a TCP connection exists for the associated channel The bit is 0 when the connection does not exist either never created or has disconnected The bit is also set to zero when the PLC goes to STOP because all connections are automatically closed upon STOP transition Status Bits 18 20 22 80 Reserved When a Channel is in use as a Modbus TCP Channel these bits are n
4. Discrete point references such as l or Q are configured as Byte Array Word Array or Dword Array variables That means a variable with discrete point references must be defined in blocks of 8 points if it is defined as a Byte Array 16 points if Word Array and 32 points if Dword Array Discrete memory must be byte aligned Boolean type and Boolean Array variables are not allowed 4 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Planning Exchanges It is possible to configure more Ethernet Global Data than a PLC can transfer especially on 10Mbit networks If high levels of consumer timeouts occur in some or all of the consumed exchanges the EGD load can be reduced by Increasing the production period especially if the period is more frequent than double the minimum time in which the data is needed Defining fewer exchanges each with more data Using EGD groups or broadcasting to subnets Rather than producing a directed exchange to several destinations a single exchange can contain all the data and each consumer can transfer only the data it needs from the exchange GFK 2382A Chapter 4 Ethernet Global Data 4 5 Sending an Ethernet Global Data Exchange to Multiple Consumers There are two ways to send an EGD Exchange to multiple consumers at the same time by Multicasting it to a predefined group of consumers or by Broadcasting it to all of the consumers on a subnet Bo
5. Word 10 Local PLC Memory Starting Address Word 10 determines the starting address to store the Detailed Channel Status data The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 9 This offset is in bits bytes or words depending on the mode specified for example if Word 9 16 and Word 10 2 then the starting address will be 19 Valid ranges of values depend on the PLC s memory ranges Make sure this area can contain the 2 words of data without overwriting other application data Note For the Abort Channel and Retrieve Detailed Channel Status commands no actual data is transmitted on the network Communication occurs between the client PLC CPU and the local Ethernet interface only For these commands known as local commands the actual function is performed locally within the Ethernet interface and then the COMMREQ Status word is sent immediately to the CPU 6 22 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A iG Monitoring the Detailed Channel Status Words The Detailed Channel Status words DCS words are returned from the Ethernet interface to the CPU in response to a Retrieve Detailed Channel Status command from the application program The first two Detailed Channel Status bytes report status and errors in the same format as the COMMREQ Status word See the list of error codes in chapter 11 The second wo
6. Word 12 Remote PLC Memory Type Words 12 14 specify the memory type and starting address in the remote PLC from which the data is to be read Valid values for Word 12 are listed above Note The CPU372 PLUS and CPU374 PLUS cannot access W memory on any remote device Words 13 14 Remote PLC Memory Starting Address Words 13 14 determine the starting address in the remote PLC from which the data is to be read The value entered is the 32 bit offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 12 Word 13 contains the least significant 16 bits of the offset word 14 contains the most significant 16 bits of the offset This offset will be either in bits bytes or words depending on the mode specified for example if Word 12 16 and Words 13 14 9 0 then the starting address will be 165 Valid ranges of values depend on the remote PLC s memory ranges Word 15 Remote PLC Number of Memory Units Word 15 specifies the amount of data to be transferred The value entered is the number of memory units to be transferred where the size of the remote PLC memory type bit byte or word is specified in Word 12 For example if Word 12 16 and Word 15 4 then 4 bytes 32 bits of l memory will be transferred For Read PLC Memory the maximum length is 11200 bits 1400 bytes or 700 words of data or the amount of memory available in the PLC for the selected memory type whichever is less
7. Enable CommReg Delivered Command Block address IN Function Faulted logic Rack Slot Location of the Ethernet Interface Task value For the Channel Commands the parameters of the COMMREQ are Enable Control logic for activating the COMMREQ Function Block IN The location of the Command Block It can be any valid address within a word oriented area of R AI or AQ SYSID A hexadecimal word value that gives the rack high byte and slot low byte location of the CPU module For the CPU372 PLUS and CPU374 PLUS embedded Ethernet interfaces this must be Rack 0 Slot 1 0001H TASK For the CPU372 PLUS and CPU374 PLUS Ethernet interface Task must be set to 21 decimal 0015H Entering an incorrect TASK value may cause the Ethernet interface to fail FT Output The FT output is set if the CPU rather than the Ethernet interface detects that the COMMRE fails In this case the other status indicators are not updated for this COMMREQ 6 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A L The COMMREQ Command Block General Description When the COMMREQ function is initiated the Command Block is sent from the PLC CPU to the Ethernet interface The Command Block contains the details of a Channel command to be performed by the interface The address in CPU memory of the Command Block is specified by the IN input of the COMMREQ Functi
8. GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 9 Word 8 Channel Number Word 8 specifies the channel to be used for the read This value must be in the range of 1 16 If the channel number is out of range a command error indication will be placed in the COMMREQ Status word If the channel number is the same as a channel already in use the channel will be retasked to perform this new command Word 9 Number of Read Repetitions Word 9 specifies the number of reads to be performed before automatically completing the communications request and closing the channel If this value is set to 1 only a single read will be issued If this value is set to 0 reads will be issued continuously on the requested period until the channel is aborted Word 10 Time Unit for Read Period Words 10 11 together define how often the read is to be performed read period Word 10 specifies the time unit such as seconds or minutes for the read period Word 11 specifies the number of those units The choices for the time units are shown below Value Meaning 1 hundredths of seconds 10 ms 2 tenths of seconds 100 ms 3 seconds 4 minutes 5 hours Note If Time Unit Value is 5 hours then the maximum usable value of Number of Time Units is 5965 Word 11 Number of Time Units for Read Period Word 11 specifies the number of time units for the read period The read period is in effect even when the Channel command
9. gt 1 0 each time there is a successful read or write This can be an indicator to the ladder program to move the most recent data to another location The Data Transfer bit is not closely synchronized in time with the transfer The bit indicates only whether a transfer has occurred during the preceding read or write period A rising edge on the bit indicating that a transfer has completed successfully does not guarantee that the next transfer has not begun or completed After an Establish Channel command the COMMREQ status word is always updated before the Data Transfer bit is set to 1 The Data Transfer bit for a channel is not meaningful until the Ethernet interface updates the COMMREQ status word Do not use data received from a server until the COMMREQ status word confirming the Read command for that channel is 1 and the Data Transfer bit goes to 1 Bits 18 20 22 48 Channel Error Bit This bit normally 0 is the primary indicator for an error on a channel It indicates any channel error fatal or non fatal It does not necessarily indicate that the channel is idle A Channel Error bit is not meaningful until after the Ethernet interface updates the COMMREQ status word confirming the Read or Write command for that channel For an Establish Channel command the COMMREQ status word is updated before the Channel Error bit is set to 1 A Channel Error bit is set to 1 when an error is detected on the channel It is set to 0 when
10. 1024 R1 1024 16 bit words 16 bit words Modbus Holding Register Table The Modbus Holding Register table is mapped exclusively to the CPU Register R table Applicable Functions Read Multiple Registers Write Multiple Registers Write Single Register Mask Write Register Read Write Multiple Registers Modbus Input Register Table The Modbus Input Register table is mapped exclusively to the CPU Analog Input Al table Applicable Functions Read Input Registers GFK 2382A Chapter 7 Modbus TCP Server 7 3 Modbus Input Discrete Table The Modbus Input Discrete table is mapped exclusively to the CPU Discrete Input l table Applicable Functions Read Input Discretes Modbus Coil Table The Modbus Coil table is mapped exclusively to the CPU Discrete Output Q table Applicable Functions Read Coils Write Coils Write Single Coil Address Configuration Address mapping for the Series 90 30 PLUS Ethernet interface is done in the Machine Edition Hardware Configuration of the CPU The Modbus TCP Server does not use COMMREQs to configure address mapping Each PLC memory area is mapped to an appropriate Modbus address space The Modbus TCP Address Map tab displays the standard references assignments Start End PLC Memory Length Number Modbus Register Address Address Address 1 Oxxxx Coil Table 1 32768 Q00001 32768 2 1xxxx Discrete Table 1 32768
11. http j 10 10 0 11 ple_Fault_tables htm v E co Link AA IC693CPU37X PLC Fault Table Viewer PLC Name PLC Time 02 18 2000 23 56 51 View Reference Tables Refresh PLC Fault Table j View I O Fault Table Fault Extra Fault Extra Total Faults F Data Data Format Byte Total Faults Displayed 6 Entries Overflowed Table Last Cleared MM DD YY HH MM SS 00 00 2000 00 00 00 C show all O Word PLC Date Time During Last Update MM DD YY HH MM SS 02 18 2000 23 56 51 Oasci PLC Fault Table 0 15 Can t locate remote node discarded request 02 18 2000 23 19 26 000 Long Short Task Group Action Error Code 8 a i a Sa N Fault Extra Data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 0 Rack size mismatch 02 18 2000 23 19 05 000 00 Rack size mismatch 02 48 2000 23 09 37 000 O21 Failed battery signal 02 18 2000 23 07 48 000 Internet The fault extra data can be displayed in byte word or ASCII format depending on which button is selected at the top of the screen These selections affect the display of all fault extra data If an error code does not have a string associated with it the Fault Description field is blank To view the fault extra data for all faults select the Show All checkbox For Netscape first check the Show All checkbox and press the Refresh PLC Fault Table button This will show the fault extra data for all faults Nets
12. 00008 0008 00009 0009 00000 0000 00000 0000 03003 OBBB 00006 0006 00004 0004 00008 0008 00020 0014 00200 00C8 00004 0004 00001 0001 Length of Channel command Data Block Always 0 no wait mode request Memory type of CRS word R CRS word address minus 1 R10 Reserved Reserved Read from a Modbus TCP Device Channel number 6 Modbus Function Code Read Input Registers Local PLC Memory Type Local PLC Starting Address Address in the Remote Server Number of Registers in the Remote Device Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Read Data from Modbus TCP Device command block Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 4 Read Input Registers GFK 2382A Modbus TCP Client 8 13 Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interface will store data received from the remote device Valid values for Word 10 are listed below Value Type Decimal Description R 8 Register memory word mode AI 10 Analog input memory word mode VAQ
13. 6 17 Send Type 3 16 Serial port configuration Data rate 3 9 Flow control 3 9 Parity 3 9 Server Capability 1 3 Server PLC 6 13 Server Port 3 11 Server Protocol Services 7 2 Signatures 3 14 Simple isolated network configuration 3 8 SNTP Operation 4 12 SNTP Timing Signals 4 13 Software Loader 11 5 SRTP Channel Status 6 4 SRTP Client 1 6 SRTP Connection Timeout 11 34 STAT LED 2 5 Station Manager 1 6 Station Manager Lockout under Heavy Load 11 33 Station Manager Port 2 10 GFK 2382A Index Index Station Manager supported by Modbus Server 7 2 Status address location 3 8 Status bits 8 2 8 3 8 25 8 26 Status Bits 11 10 Status data Channel Commands 8 3 Subnet Addressing and Subnet Masks 9 5 Subnets 9 5 Supernets 9 5 Switch 2 9 T Telnet 3 6 Temporary IP Address 3 5 3 6 Time units for command period 6 10 6 14 6 18 Timeout SRTP Connection 11 34 Timeout Errors application 11 32 PLC 11 31 Timeout for Channel Commands 6 10 6 14 6 18 Timeout Period for EGD Exchange 4 9 Timestamping of EGD 4 11 Troubleshooting 11 3 Ladder programs 8 35 Using the Status bits and Communications Status words 8 26 U Update Timeout 3 18 V VersaPro 3 2 W Waiting for configuration from PLC 11 5 Waiting for IP address 11 5 Web Page File Transfer 10 10 Web server 1 6 Write EGD Exchange command 5 13 Write PLC Memory command 5 7 Index 3
14. GFK 2382A 4 1 Ethernet Global Data Operation Ethernet Global Data is data that is automatically sent from one Ethernet device to one or more others Once Ethernet Global Data has been configured the data is sent automatically during system operation No program interaction is necessary to produce or consume the global data The device that sends the Ethernet Global Data is called the producer Each device that receives Ethernet Global Data is called a consumer Each unique Ethernet Global Data message is called an exchange also sometimes referred to as a page An Ethernet interface can be configured to both produce and consume Ethernet Global Data at the same time using separate exchanges PLC1 Producer PLC2 Consumer Ethernet Network The EGD Producer The producer of an exchange periodically sends new samples of data from its local internal memory The producer of an exchange is uniquely identified by its Producer ID The Producer ID can be expressed as a dotted decimal number for example 0 0 0 1 Even when expressed in IP address form it is not used as an IP address It is used to identify a particular PLC on the network Since the Producer ID identifies only the PLC producing the exchange it doesn t matter how many Ethernet Interfaces are installed in that PLC When using the Ethernet Global Data configuration server each PLC that transfers EGD must be assigned a Producer ID even if that PLC produces no exchanges
15. lt Data lt 4 Data lt Data lt 4 Return COMMREQ Status CRS Word COMMREQ to CPU Status Word amp lt Pulse Data Transfer bit Data Transfer gg pulse received Read Request Se amp Read Request p Data A A Pa lt 4 Data lt pee lt Pulse Data Transfer bit Data Transfer pulse received Read R t ee ee P Read Request p Data 5 lt Data Data t sity lt Pulse Data Transfer bit Data Transfer 4 pulse received 1 The command starts when there is power flow to a COMMREQ function in the client PLC At this time the Command Block data is sent from the to the Ethernet interface 2 For the Establish Read Channel command the COMMREQ status word is returned immediately if the Command Block is invalid If the syntax is correct the COMMREQ status word is returned after the first significant event upon failure to establish a channel correctly and in a timely manner or upon the first successful transfer of data 3 After the channel is successfully set up to the server PLC the Ethernet interface performs the periodic reads as specified in the Command Block GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 5 s COMMREQ Format for Programming Channel Commands The Channel commands described in this chapter are sent using the Communications Request COMMREQ function The Communications Request is triggered when the logic program passes power to the COMMREQ Function Block
16. 0003 00007 0007 00050 0032 00008 0008 00050 0032 00008 0008 00100 0064 00008 0008 00001 0001 00004 0004 00010 000A 00000 0000 00000 0000 00001 0001 Length of Channel command Data Block 17 25 words Always 0 no wait mode request Memory type of COMMREQ status word R COMMREQ status word address minus 1 R10 Reserved Reserved Establish Write Channel command number Channel number 6 Number of write repetitions write indefinitely Time unit for write period 3 seconds Number of time units for write period every 7 seconds Timeout for each write 500 ms Local PLC Memory type from which to write data R Local PLC Starting address from which to write data R50 Remote PLC Memory type at which to store data R Remote PLC Starting address at which to store data R100 Remote PLC Number of memory units 8 registers Remote PLC Network Address type IP address Remote PLC Network Address length in words 4 Remote PLC Register 1 of IP address 10 Remote PLC Register 2 of IP address 0 Remote PLC Register 3 of IP address 0 Remote PLC Register 4 of IP address 1 Remote PLC Program Name needed for access to remote P or L zero terminated and padded Remote PLC Program Block needed for access to remote L zero terminated and padded Word 4 COMMREQ status word address is the only zero based address in the Command Block Only this value require
17. 1 based from the beginning of PLC memory for the memory type and mode specified in Word 13 This offset can be in bits bytes or words depending on the mode specified for example if Word 13 16 and Word 14 2 the starting address will be l9 Valid ranges of values depend on the PLC s memory ranges Word 15 Local PLC Number of Memory Units Word 15 specifies the amount of data to be transferred The value entered is the number of memory units to be transferred where the size of a memory unit is a bit byte or word as specified in Word 13 For example if Word 13 16 and Word 15 4 then 4 bytes 32 bits of l memory will be transferred A maximum of 16384 bits 2048 bytes or 1024 words of data can be specified Word 16 Reserved Word 16 is reserved and should contain the value zero Word 17 Reserved Word 17 is reserved and should contain the value zero Word 18 Remote Host Network Address Type Word 18 specifies the format of the remote host s address Word 18 must contain the value 1 which indicates a dotted decimal IP address expressed using a separate register for each decimal digit Word 19 Remote Host Network Address Length Word 19 specifies the length in words of the remote host s IP address Word 19 must contain 4 Words 20 23 Remote Host IP Address Words 20 23 specify the four integers one integer per word of the dotted decimal IP address of the remote host to be accessed GFK 2382A Chapter 6 Progr
18. After configuring the Ethernet interface as described in the chapter 3 turn power OFF to the CPU for 3 5 seconds then turn the power back ON This starts a series of diagnostic tests The EOK LED will blink indicating the progress of power up The Ethernet LEDs will have the following pattern upon successful power up At this time the Ethernet interface is fully operational and on line LED Ethernet Interface Online EOK oO On LAN RO On Off or blinking depending on network activity STAT On If a problem is detected during power up the Ethernet interface may not transition directly to the operational state If the Interface does not transition to operational refer to Diagnostics chapter 11 for corrective action GFK 2382A Chapter 2 Installation and Startup 2 11 Pinging TCP IP Ethernet Interfaces on the Network PING Packet InterNet Grouper is the name of a program used on TCP IP networks to test the ability to reach a destination by sending it an ICMP echo request message and waiting for a reply Most nodes on TCP IP networks implement a PING command You should ping each installed Ethernet interface When the Ethernet interface responds to the ping it means acceptable TCP IP configuration information has been downloaded to the Interface The interface is operational and configured properly Pinging the Ethernet Interface from a UNIX Host or Computer Running TCP IP Software A ping command
19. Always 0 no wait mode request Word 3 00008 0008 Memory type of CRS word R Word 4 00009 0009 CRS word address minus 1 R10 Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03004 OBBC Write to a Modbus TCP Device Word 8 00006 0006 Channel number 6 Word 9 00006 0006 Modbus Function Code Write Single Register Word 10 00010 000A Local PLC Memory Type Word 11 00010 000A Local PLC Starting Address Word 12 00200 00C8 Address in the Remote Device Word 13 00001 0001 Number of Registers in the Remote Device Word 14 00001 0001 Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Write Data to remote Modbus TCP device Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Function Code 6 Write Single Register Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC from where the Ethernet interface will get the data to be written to the remote PLC Valid values for Word 10 are listed on page 8 14 Word 11 Local PLC Starting Address Word 11 determines the starting address in the local PLC from which the data is to be written The value entered is the offset 1 based fr
20. Local PLC Starting Address LSW Read Data to Write to Server Word 16 determines the least significant word LSW of the starting address in the local PLC from which the data is to be read The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 15 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Word 17 Local PLC Starting Address MSW Read Data to Write to Server Word 17 determines the most significant word MSW of the starting address in the local PLC from which the data is to be read This value is always 0 for CPU372 PLUS and CPU374 PLUS Word 18 Remote Device Write Address Word 18 specifies the register s to be written on the remote Modbus TCP device Word 19 Number Registers to Write To Remote Device Word 19 specifies the quantity of registers to write to the remote device Word 20 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block 8 24 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Status Data This section describes all the status data that is available to the ladder program to determine the state of the Ethernet interface and its Modbus TCP c
21. Register 3 of IP address 0 Word 23 00001 0001 Remote Host Register 4 of IP address 1 Word 4 COMMREQ status word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 requests that a Send Information Report channel be set up If the command is processed successfully it will result in attempting the specified number of transfers from the client to the server iG GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 17 Word 8 Channel Number Word 8 specifies the channel to be used for the send This value must be in the range of 1 32 If the channel number is out of range a command error indication is placed in the COMMREQ status word If the channel number is the same as a channel already in use the channel is re tasked to perform this new command Word 9 Number of Send Repetitions Word 9 specifies the number of transfers to be performed before automatically completing the communications request and closing the channel If this value is set to 1 only a single transfer will be issued If this value is set to 0 transfers will be issued on the requested period until the channel is aborted Word 10 Time Unit for Send Period Words 10 11 together define how often the transfer is to be performed transfer period Word 10 specifies the time unit such as seconds or minutes for the send period Word 11 specif
22. STATUS WORD pe STATUS CODES STATUS BITS LAN INTERFACE STATUS AND CHANNEL STATUS BITS COMMREQ Function Block The COMMREQ Function Block is the ladder instruction that triggers the execution of the Channel command In the COMMREQ Function Block you specify the rack and slot location of the Ethernet interface a task value and the address of a location in memory that contains the Command Block There is also a fault output on the COMMREQ Function Block that indicates certain programming errors 8 2 4 Location in PLC memory specified when configuring the Interface using Configuration Software TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A COMMREQ Command Block The COMMREQ Command Block is a structure that contains information about the Channel command to be executed The Command Block consists of two parts Common Area includes the address of the COMMREQ Status word CRS word Data Block Area describes the Channel command to be executed When the COMMREQ function is initiated the Command Block is transferred to the Ethernet interface for action Modbus TCP Channel Commands The Channel commands are a set of client commands used to communicate with a server Up to 16 simultaneous channels numbered 1 16 can be established The channel number is specified in the Command Block for the Channel command The channel can be moni
23. The AUP Files folder opens showing any AUP file for this target You can now edit the AUP file with any ASCII text editor such as Notepad GFK 2382A Appendix A Configuring Advanced User Parameters A 3 Format of the Advanced User Parameters File The AUP file must have this format AUP_r_s where r and s indicate the Rack and Slot location of the Ethernet Interface lt parameter name gt lt parameter value gt lt parameter name gt lt parameter value gt lt parameter name gt lt parameter value gt The AUP file has the following requirements The first line of the file must consist only of the text AUP_r_s where rand s usually indicate the Rack and Slot location of the Ethernet interface For the CPU372 PLUS and CPU374 PLUS the first line of the AUP filename is always AUP_0_1 All parameter names are lowercase The equal sign is required between the parameter name and parameter value Spaces are allowed but not required between the parameter name and the equal symbol and between the equal symbol and the parameter value Character string values are case sensitive as with Station Manager commands uppercase parameter values must be enclosed within a pair of double quotes Numeric parameters are entered in decimal or hexadecimal format hexadecimal values must be terminated with an h or H character IP addressing parameters must be entered in standard dotted decimal format Comments in the file mu
24. The Ethernet interface in the producer is configured for network 3 C SNTP error time synchronization but is not synchronized to an SNTP server The data was refreshed on schedule Specification During exchange configuration an invalid configuration parameter 4 P C ae was received by the Ethernet interface or an error occurred in communication with the PLC CPU 6 c Refresh timeout The exchange s timeout period is configured to a non zero value without data and the data has not been refreshed within the timeout period Data after The data has been refreshed since the previous consumption but 7 C ie refresh timeout not within the timeout period This status can be set during exchange configuration if the IP Layer not Ethernet interface detects that it cannot currently access a 10 P C currently Rha a network This temporary status can change if successful network initialized access becomes possible LAckofreso rte Local resources are not available to establish the exchange during 12 P C Sfor exchange configuration The PLC Fault Table may provide more detail on the specific error Data size The data size of a consumed exchange does not match the 14 C i sits ae mismatch error exchange definition The exchange is ignored Note The Series 90 30 PLUS Ethernet interface does not support EGD exchange status values 16 18 22 26 28 and 30 Exchange configuration occurs when either 1 Hardware Configuration containing EGD is
25. Word 18 contains the length in bytes of the exchange data to be read from the remote EGD device The exchange data length may not exceed 1400 bytes or the amount of memory available in the PLC for the selected memory type whichever is less Word 19 Remote Server Network Address Type Word 19 specifies the format of the remote PLC address Word 19 must contain the value 1 This indicates a dotted decimal IP address expressed using a separate register for each decimal digit GFK 2382A Chapter 5 Programming EGD Commands 5 11 Word 20 Remote Server Network Address Length Word 20 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block Word 20 must contain 4 Words 21 24 Remote Server IP Address Words 21 24 specify the four integers one integer per word of the dotted decimal IP address of the remote PLC to be accessed Note The Read EGD Exchange command can be sent to various servers 5 12 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Write EGD Exchange 4003 The Write EGD Exchange command can be used to write portions of a configured Ethernet Global Data exchange in a remote producer node EGD protocol prohibits writing to a consumed exchange This command identifies the exchange to be written using its configured Producer ID and Exchange ID It can then write the content of that data directly to the device memory This command can be s
26. Word 3 00008 0008 Memory Type of COMMREQ status word R Word 4 00009 0009 COMMREQ status word address minus 1 R10 The term local PLC is Word 5 00000 o Reserved used here to identify the client PLC the PLC that initiates the communications request Word 6 00000 0000 Reserved Word 7 02002 07D2 Retrieve Detailed Channel Status Command number Word 8 00005 0005 Channel number 5 Word 9 00008 0008 Local PLC Memory type to store Detailed Chan Stat R Word 10 00100 0064 Local PLC Starting address R100 Word 4 COMMREQ status word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number The command parameter in Word 7 requests that Detailed Channel Status words be returned The Detailed Channel Status words are written to the location specified in Words 9 and 10 The COMMREQ status word indicates successful completion of the command If the specified channel is not currently in use the latest status is returned GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 21 Word 8 Channel Number The channel number in Word 8 specifies the channel 1 32 whose status is to be read Word 9 Local PLC Memory Type Words 9 and 10 specify the starting point in the client CPU memory where the Detailed Channel Status words are to be written The length of the transfer is always 2 words
27. checkbox at the top of the page To refresh the fault data click the Refresh I O Fault Table button GFK 2382A Chapter 10 PLC Monitoring Via the Web 10 7 Downloading PLC Web Pages To add new or revised web page files or support files you will need to transfer the appropriate files to the Ethernet Interface via FTP Once the new web files have been obtained they are copied into the local computer from which the FTP utility will be run A general procedure for transferring web files via Windows FTP is described below You may also use a commercial FTP program Note You may not be able to open an FTP connection when the CPU is in Run mode and the level of Ethernet traffic is medium to heavy If the network traffic is high it is recommended that you reduce the network traffic before trying to create an FTP connection FTP Connect and Login You can either use a commercial FTP tool or use the ftp command on the DOS Prompt or Command line Not all FTP tools are guaranteed to work since the server only supports a limited set of FTP commands From the Windows DOS box command line interface enter ftp followed by the URL or IP address of the PLC as shown below ftp lt URL or IP address of the Ethernet Interface gt You will then be prompted for a login name and password as shown below The default FTP password is system login user password system The FTP server in the Ethernet inter
28. one occurs If the timeout value is specified as zero no timeout errors will be reported For most applications a timeout is not needed because the write period acts as a timeout Word 12 should be zero for no timeout However there are two special circumstances in which specifying a timeout is recommended When the number of time units Word 11 is zero so that a subsequent transfer will be issued as soon as the previous transfer completes and no period errors are reported In 6 14 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A iG this case a timeout value can be specified so that timeout errors will be reported by the Channel Error bit When the write period is very long minutes or hours In this case a shorter timeout value can be specified so the application doesn t have to wait for the write period to expire before taking action Word 13 Local PLC Memory Type Words 13 14 specify the location in the local PLC where the Ethernet interface will get the data to be written to the remote PLC Valid values for Word 13 are listed in the description of Establish Read Channel The amount of data to be transferred is specified by the number of memory units of the data written to the remote PLC Word 17 Word 14 Local PLC Memory Starting Address Word 14 determines the starting address in the local PLC from which the data is to be written The value entered is the offset 1 ba
29. stored to the PLC 2 a PLC containing EGD configuration powers up or 3 an Ethernet Interface configured for EGD is restarted 4 16 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Chapter Programming EGD Commands 5 This chapter describes a set of commands that can be used in the application program to read and write data over the Ethernet network Read PLC Memory Write PLC Memory Read EGD Exchange Write EGD Exchange Masked Write to EGD Exchange EGD Commands are supported by the enhanced Series 90 30 PLUS Ethernet interface COMMREQ driven EGD Commands can be used in the application program to read and write data into Series 90 30 PLCs or other EGD Class 2 devices The Ethernet interface supports a maximum of 10 simultaneous EGD commands Note This feature is not available in CPU374 versions prior to Release 12 00 GFK 2382A 5 1 COMMRE Q Format for Programming EGD Commands The EGD commands described in this chapter are sent using the Communications Request COMMREQ function The Communications Request is triggered when the logic program passes power to the COMMREQ Function Block Enable COMM CommReg Delivered REQ Command Block address IN FT Function Faulted logic Rack Slot Location of _ SYSID the Ethernet Interface Task value TASK For the EGD commands the parameters of the COMMREQ are Enable Control logic for a
30. 0 7 XX 224 0 0 2 address 239 255 255 255 gXX_ttl IP time to live for host group multicast messages 1 1H 0 255 OOffH hop count GFK 2382A Appendix A Configuring Advanced User Parameters A 5 RDS Parameters task d None None SRTP Client Channels Parameters task h Default Range hconn_tout TCP Connect timeout in milliseconds 75000 124F8H 10 75000 124F8H IP Parameters task i Default Range ittl IP header default time to live hop count 64 0040H 0 255 OOffH ifrag_tmr IP fragment timeout interval in seconds 3 0003H 0 65535 ffffH ICMP IGMP Parameters task j None None Network Interface Parameters task I Default Range Iduplex0 Ethernet duplex for Controller 1 half 2 full 2 0 1 2 Iduplexta Ethernet duplex for Port 1A O auto detect 1 half 0 0 1 2 2 full Iduplex1b Ethernet duplex for Port 1B O auto detect 1 half 0 0 1 2 2 full IspeedO Ethernet speed for Controller 1 10Mbit 2 100Mbit 2 0 1 2 Ispeedta Ethernet speed for Port 1A O auto detect 1 10Mbit 0 0 1 2 2 100Mbit Ispeed1b Ethernet speed for Port 1B O auto detect 1 10Mbit 0 0 1 2 2 100Mbit UDP Parameters task u None None SRTP Parameters task v None None TCP Parameters task w Default Range wnodelay TCP nodelay option 0 inactive 1 active O 000H 0 1 wkal_idle TCP keepalive timer value in seconds 240 4 0 min 0 65535 fff
31. 0000 Local PLC Starting Address MSW of memory to write with data read from Remote Device always 0 for CPU372 PLUS and CPU374 PLUS Word 13 00300 012C Address to Read From on Remote Server Word 14 00020 0014 Number of Memory Units to Read from Remote Device 1 to 125 Word 15 00008 0008 Local PLC Memory Type of memory to use for writing to the Remote Device Word 16 00100 0064 Local PLC Starting Address LSW of memory to use for writing to the Remote Device Word 17 00000 0000 Local PLC Starting Address MSW of memory to use for writing to the Remote Device always 0 for CPU372 PLUS and CPU374 PLUS Word 18 00200 00C8 Address to Write to on the Remote Server Word 19 00010 000A Number of Memory Units to Write to the Remote Device 1 to 121 Word 20 00001 0001 Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Read Write Multiple Register operation on remote Modbus TCP device Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server GFK 2382A Modbus TCP Client 8 23 Word 9 Modbus Function Code Word 9 specifies Function Code 23 Read Write Multiple Register Word 10 Local PLC Memory Type Write With Data Read From Server Words 10 12 specify the locatio
32. 1 R10 Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03000 0BB8 Open Modbus TCP Client Connection Word 8 00005 0005 Channel number 5 Word 9 00001 0001 Remote Device Address Type Word 10 00004 0004 Length of Remote Device Address Word 11 00010 0010 Numeric value of 1 Octet Word 12 00000 0000 Numeric value of 2 Octet Word 13 00000 0000 Numeric value of 3 Octet Word 14 00001 0001 Numeric value of 4 Octet Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 is the command id for an Open Modbus TCP Client Connection COMMRE If successful a TCP connection with the specified device is allocated Word 8 Channel Number Word 8 specifies the channel number to allocate for the Modbus TCP Client connection Channels 1 16 can be used for Client communications Word 9 Address Type Word 9 specifies the type of IP Address specified for the remote device A value of 1 is required in this word Word 10 Length of IP Address Word 10 specifies the length of the IP Address A value of 4 is required in this word Word 11 IP Address 15 Octet Word 10 specifies the value of the first octet of the IP Address Word 12 IP Address 2 Octet Word 11 specifies the value of the second octet of the IP Address Word 13 IP Address 3rd Octet Word 12 specifies the value of the
33. 10 millisecond increments Default is 1000ms Word 9 Local write buffer memory Memory type for the data that will be written in the local type Word 10 Local write buffer reference 1 based offset in the local PLC Word 11 __ table starting address Word 12 Remote write location Memory type into which data will be written in the memory type remote PLC s Word 13 Remote reference table write 1 based offset in the remote PLC Word 14 location starting address Word 15 _ Write Length 0 to 1400 bytes 0 to 700 words Word 16 __ Network address type Must be 1 Indicates an IP address will be used Word 17 __ Network address length Must be 4 for IP address Group ID multicast is not permitted Word 18 IP Address of the remote PLC Four integers specified as one integer per word of the Word 21 dotted decimal IP address of the remote PLC May not be a group IP address Word 22 Reserved Always 0 Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address GFK 2382A Chapter 5 Programming EGD Commands 5 7 Word 7 EGD Command Number Word 7 requests that a write PLC memory operation occur If the command is processed successfully PLC reference memory data is sent from the server to the client Word 8 Command Retry Time Word 8 specifies the time in milliseconds the Ethernet Interface will wait between retries when transferring the co
34. 100Base Tx twisted pair cables must meet the applicable IEEE 802 standards Category 5 cable is required for 100BaseTX operation Each Ethernet port automatically senses whether it is connected to a 10BaseT or 100BaseTX network half duplex or full duplex The automatic negotiation of speed and or duplex mode can be explicitly overridden using Advanced User Parameter settings 10Base T 100Base Tx Port Pinouts i TD RD Ro Receive Data Pin 1 is at the bottom of the Ethernet port connector as viewed from the front of the module Note Pinouts are provided for troubleshooting purposes only 10Base T 100Base Tx cables are readily available from commercial distributors GE recommends purchasing rather than making 10Base T 100Base Tx cables 2 8 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Connection Using a Hub Switch Repeater Connection of the Ethernet Interface to a 10Base T or 100Base Tx network is shown below Hub Switch Repeater T 10 100 Ld 10 100 Ethernet Interface 10BaseT 100Base Tx To Other Network Twisted Pair Cable Devices Direct Connection to the Ethernet Interface Connection of Ethernet devices directly to the CPU374 PLUS Ethernet interface is shown below 10 100 10 100 Ethernet Interface 10BaseT 100Base Tx Other
35. 12 Analog output memory word mode l 16 Discrete input memory byte mode 70 Discrete input memory bit mode yQ 18 Discrete output memory byte mode 72 Discrete output memory bit mode T 20 Discrete temporary memory byte mode 74 Discrete temporary memory bit mode M 22 Discrete momentary internal memory byte mode 76 Discrete momentary internal memory bit mode SA 24 Discrete system memory group A byte mode 78 Discrete system memory group A bit mode SB 26 Discrete system memory group B byte mode 80 Discrete system memory group B bit mode SC 28 Discrete system memory group C byte mode 82 Discrete system memory group C bit mode S 30 Discrete system memory byte mode 84 Discrete system memory bit mode G 56 Discrete global data table byte mode 86 Discrete global data table bit mode Read only memory cannot be written to Word 11 Local PLC Memory Address Word 11 determines the starting address in the local PLC in which the data from the remote device is to be stored The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 10 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Be sure this area is large enough to contain the requested data without overwriting other application data Word 12 Remote Device Address Word 12 specifies the address in
36. 2 7 24 An Address and Length specify the location of the data in the remote device and the number of data units to transfer The Length is the number of Registers or Coils to transfer Modbus Function Code 7 Read Exception Status does not require the address as the remote device retrieves the exception status from an internal location When transferring data between server bit or coil memory to PLC bit memory only the number of bits specified are transferred For example if the COMMREQ requests to read nine coils from the Remote Device and requests to put the data at M00001 in the Local PLC using a bit type memory type M00001 through MO00009 will be updated with the data from the Remote Device and M00010 through M00016 will be unaffected However if server bit or coil memory is transferred to PLC byte or word memory the following rules apply GFK 2382A Modbus TCP Client 8 11 1 Transferring discrete data from the Remote Device to Local PLC Word 16 bit memory If the number of requested coils is not a multiple of 16 the data is padded with Os to a 16 bit boundary For example if the COMMREQ requests reading 17 coils from the Remote Device and requests to place this data at R00010 R00010 all 16 bits and bit O of R00011 will be updated with values from the Remote Device and bits 1 through 15 of R00011 will be set to 0 2 Transferring discrete data from the Remote Device to Local PLC byte memory using byte type memory ty
37. 3 5 Assigning a Temporary IP Address Using Telnet 0 eccceeeesteeeeeeseeeeeenteeeeeeeaes 3 6 Configuring the Ethernet Parameters of the Series 90 30 PLUS CPUS 3 7 Series 90 30 PLUS Ethernet Parameters ecccccececeeeeeeeeeeeeeeeeneeeseeaeeeseenaeeees 3 7 RS 232 Port Station Manager Parameters for the Series 90 30 PLUS 3 9 GFK 2382A v Contents Configuring Ethernet Global Dala cnicos RA Eai 3 10 Installing the EGD Configuration Server essseeeeesesrreseerrsseerrrssrerrssrirrsserrrssreennt 3 10 Enabling the Use of the EGD Configuration Server eeseeeeeeseeereeeersreeeeeee 3 11 Basic EGD Configuration soreness oiiire oii aa iai a aa Ea 3 13 Installing the EGD Generic Device Editor u seeeeeeseeeeseerieserrrrserrrsrrrrressrrrnssrrenn 3 21 Converting from CPU364 to CPU374 4 ecceceennee eter eeeeeteeeeeeeaeeeeeecaeeeseeiaeeeeeeeaas 3 22 Ethernet Global Dataicis c ect teerisnsienete ine eg ees he cence eae 4 1 Ethernet Global Data Operation ccccccceeeeccecceeeeeeeeeecanaeeeeeeesescaecaeeeeeeesetsnsnsaeeeeees 4 2 The EGD Produce hiicd ii cieit eet TEE nests A AE era 4 2 EGD ConSumers e Eaa EA EREE E AA EA EERE TEA EA ATEREA 4 2 COO Exehange S enana e aa aie e an 4 3 The Content of an Ethernet Global Data Exchange ssseseeessesrrsseerresrerrsseerrrsses 4 3 The Data Ranges Variables in an Ethernet Global Data Exchange 008 4 4 Valid PLC Memory Types for
38. 9490H COMMREQ data block too short for Program name including 0 pad 9590H Internal API error See PLC Fault Table or exception log for details This problem may occur due to the Ethernet Interface being asked to perform beyond its capacity Try transferring less data per message or establishing fewer simultaneous connections 9690H Underlying TCP connection aborted reset by server end point 9790H Underlying TCP connection aborted by client end point 9890H The remote server has no Service Request Processor 9A90H Response to session request did not arrive in proper order 9B90H Session denied by server PLC 9C90H Data response did not arrive in proper order 9D90H Data response had unexpected size 9E90H Unrecognized COMMREQ command code A190H Invalid CRS word memory type GFK 2382A Chapter 11 Diagnostics 11 21 Error Code Error Description Hexadecimal A290H Failed an attempt to update the CRS word A390H Reserved A490H Reserved A590H Reserved A690H Invalid bit mask A790H Unable to connect to remote device A890H Channel Resources in Use Try the command again a resource will become available A990H Establish Read Write Send Info Report Channel COMMREQ was received while an Abort was in progress AAS0H An attempt to establish a TCP connection with a Remote Server has failed Check the following Make sure the Server is turned on Mak
39. A Channel command can establish a channel to execute multiple periodic reads or writes with a single initiation of a COMMREQ function A Channel command can also be used to execute a single read or write There are five Channel commands Establish Read Channel Establish Write Channel Send Information Report Abort Channel Retrieve Detailed Channel Status The Channel commands are a set of client commands used to communicate with a server Up to 16 simultaneous channels numbered 1 16 can be established The channel number is specified in the Command Block for the Channel command The 16 Client connections of an Ethernet interface are shared between all Client protocols For example if 16 Client connections are used for SRTP Channels there are 16 Client connections available for Modbus TCP Channels Any given channel can be assigned to only one protocol at a time Channels can be individually monitored from the application program Each SRTP channel can accommodate data transfers of up to 1KB The total number of SRTP channels is independent of the number of SRTP Server connections Channel Operations Channel commands are based on the concept of periodic data transfers The client local PLC uses a single COMMREQ function to establish a channel connection to a server remote PLC and to request that specific data be periodically transferred between the PLCs The Ethernet interface automatically manages the establishment
40. Aa Ta crate STA aE EERS 2 6 EmbeG dded Switehiscis sosceacuetetacatussieatesenecaiss e a E Ea AEAN EES REEE A e 2 6 Connection to a 10Base T 100Base Tx NetworkK ssssseerssesrrsseerrssrrrrsssrerrssrees 2 8 10Base T 100Base TX Port PInoylSercsanian eneit a RE 2 8 Station Manager POr en aa aa TAR AAE E A EE 2 10 Port Song Sen anea EE E NEEL teas leet eee te eae eta tds 2 10 Port PINOUT oaia ernerik n iea e dart ea il died ev ett 2 10 Verifying Proper Powerup of the Ethernet Interface after Configuration 08 2 11 Pinging TCP IP Ethernet Interfaces on the Network ccccccceeceeeeseeeneeeeseeneeeeeeeaeees 2 12 Pinging the Ethernet Interface from a UNIX Host or Computer Running TCP IP SOMWANG costes Rane teeter Sk ee ee IAI esas tet haere E TN 2 12 Gontlguratlon seseo eee ee eee ee 3 1 Configuration OVErViCW mei eeecceceeeceee cence ee eeeeeeeeeeeneeeeeseneeeeeseeeaeeeceneaeeeeseeeaeeesenaeeeeeeaeees 3 2 Generating Storing Loading the Configuration ccccccceeeeeeeeeeeeeeeeteeeeeeeenaeees 3 2 Backup Configuration Datas seare AERALA EAEN AA ARADEO EA A EENAA RRA 3 2 Locally Edited Configuration Data eseeeeeeeeeeeeeerneeeerretetrrstttrnsanttnnssttnnnstennssren nnt 3 2 Initial IP Address Assignment iser anr RA RE TRR RA TARET 3 3 Assigning a Temporary IP Address Using the Programming Software 0 3 3 Assigning a Temporary IP Address Using BOOTP 0 eececeeeeceeeeeeteeeeeeetteteeeeeaaes
41. CPU372 PLUS or CPU374 PLUS in the PLC For general information about module and system installation refer to the Series 90 30 Programmable Controller Installation Manual GFK 0356 1 Be sure the Series 90 30 PLC baseplate power is OFF Do not insert or remove modules with power applied This could cause the PLC to Stop damage the module or result in personal injury 2 Align the module with the CPU s base slot slot 1 and connector Tilt the module upwards so that the top rear hook of the module engages the slot on baseplate 2 Swing the module downward until the connectors mate and the lock lever on the bottom of the module snaps into place engaging the baseplate notch Visually inspect the module to be sure that it is properly seated Connect one or both of the Ethernet ports on the Ethernet interface to the network Restore power to the baseplate rT Ove ee Ge Use the PLC programming software to make sure the PLC CPU is in Stop mode GFK 2382A Chapter 2 Installation and Startup 2 3 Ethernet LEDs The EOK LAN and STAT LEDs indicate the state and status of the Ethernet interface LED State On Blinking OOff muleates EOK Fast Blink Performing Diagnostics O LAN Off 0 STAT Off x EOK Slow Blink Waiting for Ethernet O LAN Off configuration from CPU STAT Off EOK Slow Blink Waiting for IP Address ZO LAN On Traffic Off x STAT Slow Blink EOK and STAT blink in unison EOK On Operationa
42. Ethernet Global Data 00 cc cc eeeceeeeeseeeeeeenteeeeeeeaes 4 4 Planning Exchanges Sio cristae ete a erties acca at ead eae aes 4 5 Sending an Ethernet Global Data Exchange to Multiple Consumetrs cceeeeeeees 4 6 Multicasting Ethernet Global Data enun a 4 6 Broadcasting Ethernet Global Data 0 eccceccteceee tenes erties ee aiaeei 4 7 Ethernet Global Data Timing areires rinena eiieeii Eei e eee aaa 4 8 EGD Synchronization isra rosies erioet hed aceuanetevet ad EEEE AA KE A ANETE ESE Eai aTh 4 8 Configurable Producer Period for an EGD Exchange 0 e cccceceeeeeeeeeeneeeeeeeeeeeees 4 9 Consumer Update Timeout Period cccccceeeeeeeceeceeeeeeeeececenaeaeeeeeeesetsnnisaeeeeeees 4 9 Timestamping of Ethernet Global Data Exchanges ccccceeecceeeeeeeeeeeeeeteeeeeeneeeeeeaaes 4 11 SNTE Operat Messi i asters a dine decd iaacade Aa a A ctant eva mate de tated es TINETA 4 12 Effect of PLC Modes and Actions on EGD Operations cccccceeeececeeeeeteeeestnaeees 4 14 Monitoring Ethernet Global Data Exchange Status 00 0 0 eecseeeeeeeeeeeeeeeeeeeeneeeeeenaeees 4 15 Exchange Status Word Error Codes c ccccccseceeeeeeeeeeeeeseeeeeeseeeeeeseenaeeeseenaeees 4 16 Programming EGD Commands ccccceccceeeeeeeeeeeeneeeeeeseeneeeeeeeeeaeeeeneeeeaeseseeeeeeeseseeeeeeeees 5 1 COMMREQ Format for Programming EGD Command6 0 cccceeceeeteeeeeetieeeeetnieeeeees 5 2 COMMREQ Status for
43. Load Sustained heavy EGD and or SRTP Server load can utilize all processing resources within the Ethernet interface effectively locking out the Station Manager function The Station Manager appears inoperative under either local or remote operation The Ethernet interface always gives higher priority to data communication functions than to the Station Manager When the processing load is reduced the Station Manager becomes operative once again This condition is not reported to the PLC Fault Table or Ethernet exception log PING Restrictions To conserve network data buffer resources the CPU process only one ICMP control message at a time An ICMP Echo ping request that arrives while the CPU is processing another ICMP control message is discarded When multiple remote hosts attempt to ping the CPU at the same time some individual ping requests may be ignored depending upon the timing of the ping requests on the network The CPU may initiate ping requests to another host on the network via the ping Station Manager command The ping request sequence is restricted to one remote host at a time Discarded ping requests are not reported to the PLC Fault Table or Ethernet exception log GFK 2382A Chapter 11 Diagnostics 11 33 SRTP Connection Timeout When the Ethernet interface is abruptly disconnected from a remote SRTP server for example by disconnecting the Ethernet cable the underlying TCP connection attempts to re establish c
44. Remote Server Client E005H E085H Service in process cannot login E405H E485H Memory Type for this selector does not exist E905H E985H Memory Type selector not valid in context EAO5H EA85H Not logged in to process service request EEO5H EE85H Could not return block sizes EFO5H EF85H Programmer is already attached FOO5H FO85H Request only valid in stop mode F105H F185H Request only valid from programmer F205H F285H Invalid program cannot log in F405H F485H Invalid input parameter in request F505H F585H Invalid password F605H F685H Invalid sweep state to set F705H F785H Required to log in to a task for service F805H F885H Invalid program name referenced F905H F985H Task address out of range FCO5H FC85H I O configuration is invalid FEO5H FE85H No privilege for attempted operation FFO5H FF85H Service request has been aborted GFK 2382A Chapter 11 Diagnostics 11 17 Minor Error Codes for Major Error Code 11H at Remote Server PLC Error Status Hexadecimal SRTP Error Description 0111H Generic SRTP error 0211H The PLC is inaccessible 0311H 0411H Unexpected SRTP version encountered in received message 0511H Unrecognized SRTP message received 0611H Data present in SRTP message which should not contain data 0711H Generic resource problem detected 0811H SRTP message encountered in inappropriate connection state 0911H 0A11H 0B11H 0C11H 1411H 1711H 1811H 1911H Invalid source detected in a mailbox me
45. September 2007 GFK 2382A Minor Error Codes for Major Error Code 90H at Client PLC Error Code Error Description Hexadecimal 0190H Timeout expired before transfer completed still waiting on transfer 0290H Period expired before transfer completed still waiting on transfer 8190H COMMREQ data block too short for the command 8290H COMMREQ data block too short for server PLC node address 8390H Invalid server memory type 8490H Invalid Program Name 8590H Invalid Program Block Name 8690H Zero server unit length is not allowed 8790H Server unit length is too large 8890H Invalid channel number 8990H Invalid time unit for period Maximum permitted 3965 hours 8A90H Period value is too large 8B90H Zero server memory starting address is not allowed 8C90H Invalid client memory type 8D90H Invalid server host address type Must be 1 8E90H Invalid IP address integer value Must be 0 255 8F90H Invalid IP address class Must be valid Class A B or C IP address May also occur if the destination IP address in the COMMREQ is same as the sender s IP address 9090H Insufficient TCP connection resources to do request 9190H Zero local starting address is not allowed 9290H Address length value invalid Must be 4 for IP address type 9390H COMMREQ data block too short for Program Block name including 0 pad
46. The information to be sent by the producer and the exchange details are defined in the Properties for each produced exchange also called a page To configure a produced exchange right click on Produced Exchanges in the Ethernet Global Data node and select New fe EEF Series 90 30 El CPU374 Ga Data Watch Lists Elz Ethernet Global Data ae Consumed Exchanges fjip Hardware Configuratio ee ee ee Delete All Exchanges Del Gompare Report Produced Exchange Name ProdExch1 TR iD RE 1 X f Adapter Name oa gt i Destination Type Group ID Destination 0 Ss Produced Period 200 Reply Rate Fs 0 Send Type ie z Always Inspector A name assigned for this exchange Defaults to ProdExchxX where X is a Name sequential number Exchange ID A number that identifies a specific exchange to be sent by the producing device Adapter The specific Ethernet interface identified by its rack and slot location within Name the producing PLC Destination Specifies whether the data s destination will be Type An IP address Unicast A Group ID Multicast All EGD nodes on the subnet Broadcast Choosing broadcast will cause the EGD packets to be received by any node on the network This can impact performance if there are non EGD devices on the network Check with the system s network administrator if you are unsure about whether
47. Word 10 contains the least significant 16 bits of the offset word 11 contains the most significant 16 bits of the offset This offset is in bits bytes or words depending on the mode specified For example if Word 9 16 and Words 10 11 2 0 the starting address is 19 Valid ranges of values depend on the PLC s memory ranges The user is responsible for assuring that this area is large enough to contain the requested data without overwriting other application data Word 12 Remote EGD exchange Exchange Signature Words 12 contains the 16 bit exchange signature value to be compared at the remote EGD device For remote PLC s the exchange signature should ordinarily be set to 0 Words 13 14 Remote EGD exchange Producer ID Words 13 and 14 contains the 32 bit Producer ID of the desired exchange at the remote EGD device Word 13 contains the least significant 16 bits of the Producer ID word 14 contains the most significant 16 bits Words 15 16 Remote EGD exchange Exchange ID Words 15 and 16 contains the 32 bit Exchange ID of the desired exchange at the remote EGD device Word 15 contains the least significant 16 bits of the Exchange ID word 16 contains the most significant 16 bits Word 17 Remote EGD exchange Exchange Data Offset Word 17 contains the 0 based byte offset of the data to be read from the data portion of the exchange at the remote EGD device Word 18 Remote EGD exchange Exchange Data Length
48. Word 12 are listed above Note The CPU372 PLUS and CPU374 PLUS cannot access W memory on any remote device Words 13 14 Remote PLC Memory Starting Address Words 13 14 determine the starting address in the remote PLC where data is to be written The value entered is the 32 bit offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 12 Word 13 contains the least significant 16 bits of the offset word 14 contains the most significant 16 bits of the offset This offset is in bits bytes or words depending on the mode specified for example if Word 12 16 and Words 13 14 9 0 the starting address will be I65 Valid ranges of values depend on the remote PLC s memory ranges Word 15 Remote PLC Number of Memory Units Word 15 specifies the amount of data to be transferred The value entered is the number of memory units to be transferred where the size of the remote PLC memory type bit byte or word is specified in Word 12 For example if Word 12 16 and Word 15 4 then 4 bytes 32 bits of l memory will be transferred For Write PLC Memory the maximum length is 11200 bits 1400 bytes or 700 words of data or the amount of memory available in the PLC for the selected memory type whichever is less 5 8 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Word 16 Remote PLC Network Address Type Word 16 specifies the format of the remote PLC ad
49. Word 15 16 and Word 17 4 then 4 bytes 32 bits of 1 memory will be transferred The user is responsible for assuring that this area is large enough to contain the requested data without overwriting other application data A maximum of 16384 bits 2048 bytes or 1024 words of data can be specified Word 18 Remote PLC Network Address Type Word 18 specifies the format of the remote PLC address Word 18 must contain the value 1 indicates a dotted decimal IP address expressed using a separate register for each decimal digit Word 19 Remote PLC Network Address Length Word 19 specifies the length in words of the remote PLC IP address Word 19 must contain 4 Words 20 23 Remote PLC IP Address Words 20 23 specify the four integers one integer per word of the dotted decimal IP address of the remote PLC to be accessed GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 15 Words 24 27 Remote PLC Program Name Words 24 27 specify the case sensitive zero terminated and padded program name also called task name which can be found through the PROG Station Manager command on the server Ethernet interface to be used with access to remote P or L memory These words are required only for access to such memory and will be ignored if the Memory Type field is not P or L Words 28 31 Remote PLC Program Block Name Words 28 31 specify the case sensitive zero terminated and padded program block name which can be found in the
50. a COMMREQ Function the FT Output is ON there is a programming error in one or more of the following areas Invalid rack slot specified The module at this rack slot is unable to receive a COMMREQ Command Block For the CPU372 PLUS and CPU374 PLUS embedded Ethernet interfaces this must be Rack 0 Slot 1 0001H Invalid Task ID For the CPU372 PLUS and CPU374 PLUS Ethernet interface Task must be set to 21 decimal 0015H Invalid Data Block length 0 or greater than 128 This output also may indicate that no more COMMREQ functions can be initiated in the ladder program until the Ethernet interface has time to process some of the pending COMMREQ functions If the FT Output is set the CPU did not transfer the Command Block to the Ethernet interface In this case the other status indicators are not updated for this COMMREQ The Ethernet interface is unable to return a COMMREQ Status Word to the PLC logic application GFK 2382A Chapter 11 Diagnostics 11 13 Monitoring the COMMREQ Status Word Every COMMREQ Command Block instruction specifies a 1 word memory address to receive status information about the execution of the command Before executing a COMMREQ for the Ethernet interface the application program logic should the associated status word zero for example using a MOVE Word instruction After executing a COMMREQ the program should monitor its status word If the status word is updated to a 1 the command has been p
51. address has not configure the Interface with a non be STAT Slow blink Waiting for IP been configured or zero IP address ow blin Address has been Assign IP address over network oo configured as EOK and STAT blink in 0 0 0 0 unison EOK ON E If the LAN LED is Connect cable 0 LAN ON Traffic OFF mbes Hei Examine PLC Fault Table to find out 0 Operational MAY DE network why the STAT LED is OFF STAT ON OFF p cable not y connected If the STAT LED is OFF an exception condition has occurred GFK 2382A Chapter 11 Diagnostics 11 5 EOK LED Blink Codes for Hardware Failures The EOK LED indicates whether the module is able to perform normal operation This LED is on for normal operation and flashing for all other operations If a hardware or unrecoverable runtime failure occurs the EOK LED blinks a two digit error code The EOK LED first blinks to indicate the most significant error digit then after a brief pause blinks again to indicate the least significant error digit After a long pause the error code display repeats Blink Code Description Blink Code Description 0x12 Undefined or Unexpected 0x42 Firmware Loader error Interrupt 0x13 Timer failure during power up 0x51 Unexpected watchdog timer diagnostics exception 0x14 DMA failure during power up 0x52 Unexpected debug exception diagnostics 0x21 RAM failure during power up 0x61 Boot
52. bit mode M 22 Discrete momentary internal memory byte mode 76 Discrete momentary internal memory bit mode SA 24 Discrete system memory group A byte mode 78 Discrete system memory group A bit mode SB 26 Discrete system memory group B byte mode 80 Discrete system memory group B bit mode SC 28 Discrete system memory group C byte mode 82 Discrete system memory group C bit mode S t 30 Discrete system memory byte mode 84 Discrete system memory bit mode G 56 Discrete global data table byte mode 86 Discrete global data table bit mode t Read only memory cannot be written to Words 10 11 Local PLC Memory Starting Address Words 10 and 11 determine the starting address in the local PLC in which the data from the remote PLC is to be stored The value entered is the 32 bit offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 9 Word 10 contains the least significant 16 bits of the offset word 11 contains the most significant 16 bits of the offset This offset will be either in bits bytes or words depending on the mode specified For example if Word 9 16 and Words 10 11 2 0 then the starting address will be 19 Valid ranges of values depend on GFK 2382A Chapter 5 Programming EGD Commands 5 5 the PLC s memory ranges The user is responsible for assuring that this area is large enough to contain the requested data without overwriting other application data
53. can be executed from a UNIX host or computer running TCP IP most TCP IP communications software provides a ping command or from another Ethernet interface When using a computer or UNIX host you can refer to the documentation for the ping command but in general all that is required is the IP address of the remote host as a parameter to the ping command For example at the command prompt type ping 10 0 0 1 Determining if an IP Address is Already Being Used Note This method does not guarantee that an IP address is not duplicated It will not detect a device that is configured with the same IP address if it is temporarily off the network It is very important not to duplicate IP addresses To determine if another node on the network is using the same IP address 1 Disconnect your Ethernet interface from the LAN 2 Ping the disconnected interface s IP address If you get an answer to the ping the chosen IP address is already in use by another node You must correct this situation by assigning unique IP addresses 2 12 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Chapter Configuration 3 Before you can use the Series 90 30 PLUS Ethernet interface features you must configure the CPU using Machine Edition Logic Developer PLC software The configuration process for the CPU372 PLUS CPU374 PLUS embedded Ethernet interface includes Assigning a temporary IP address for initial network
54. clock on an SNTP server on the network All Ethernet Interfaces configured to use SNTP will have updated synchronized timestamps Therefore accurate timing comparisons between exchanged data can be made If SNTP is used to perform network time synchronization the timestamp information typically has 10 millisecond accuracy between PLCs on the same network CPU Ethernet interface CPU s SNTP Time time clock Server on Network timestamp SNTP Operation In an SNTP system a computer on the network called an SNTP server sends out a periodic timing message to all of the SNTP capable Ethernet interfaces on the network which keep their internal clocks synchronized with this SNTP timing message SNTP server dates before January 1 1989 are not supported Normal SNTP Operation The Ethernet interface will synchronize to a remote SNTP time server after receiving two broadcast clock values within a 150 second period The Station Manager can be used to view server status information 4 12 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Multiple SNTP Servers To guard against loss of SNTP timing messages multiple SNTP time servers can be tracked on a network An Ethernet Interface can maintain timing information from up to four total SNTP time servers at a time Each server assigns a stratum number that determines its priority The message from
55. exception log As previously explained PLC Faults generated by the Ethernet interface contain Ethernet exception events within the extra fault data See the TCP IP Communications for Series 90 30 CPU372 PLUS and CPU374 PLUS Station Manager Manual GFK 2383 for detailed descriptions of Ethernet exception events COMMREQ Fault Errors When the PLC CPU attempts to initiate COMMREQs to the Ethernet interface more rapidly than the Ethernet interface can accept them the COMMREQ delivery will fail The fault output of the COMMREQ function block will be set and the COMMREQ will not be delivered to the Ethernet interface In this case the PLC logic program should attempt to initiate the COMMREQ on another sweep after a very short delay This condition may arise when the logic Program attempts to initiate greater than 16 COMMREQs in the same logic sweep Sustained heavy COMMREQ delivery from the PLC CPU to the Ethernet interface can use a considerable portion of the Ethernet interface s processing capability Under heavy COMMREQ load the Ethernet interface may discard some received COMMREQs until it is once again able to process further COMMREQs In such cases the Ethernet interface increments the CmrqDscd tally this tally is available via the TALLY C Station Manager command Under sustained extremely heavy COMMREQ load the Ethernet interface may not respond to Station Manager commands and possibly some non Programmer data communications If th
56. network Communication occurs between the client PLC CPU and the local Ethernet interface only For these commands the actual function is performed locally within the Ethernet interface and then the COMMREQ Status word is sent immediately to the CPU 6 20 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A iG Retrieve Detailed Channel Status 2002 The Retrieve Detailed Channel Status command requests that the current Detailed Channel Status words are returned for a channel The Detailed Channel Status words contain an active inactive channel indicator and the last channel error codes seen These two words of detailed status supplement the information available in the COMMREQ Status word and the Channel Status bits The command has no effect on the value of the Channel Status bits The Detailed Channel Status words are updated every time the status of the channel changes If the channel is operating with a fast repetition period the status words may change faster than the ladder executes the COMMREQ to retrieve them If that happens some status values could be missed by the application program Example Command Block Retrieve detailed channel status for Channel 5 Store the Detailed Channel Status words to Registers R100 R101 Return the COMMREQ status word to R10 Dec Hex Word 1 00004 0004 Word 2 00000 0000 Length of Channel command Data Block 4 words Always 0 no wait mode request
57. network that are not involved with communications to the PLCs but no matter what their function each TCP IP node must have its own IP address It is the IP address that identifies each node on the IP network or system of connected networks The term host is often used to identify a node on a network IP Address Format for Network Classes A B C The P address is 32 bits long and has a netid part and a hostid part Each network is a Class A Class B or Class C network The class of a network determines how an IP address is formatted and is based on the number of bits in the netid part of the IP address 01 8 16 24 31 Class A ol netid hostid 01 8 16 24 31 Class B alo netid hostid 012 8 16 24 31 Class C 41 ol netid hostid In general the netid part is assigned by the Internet authorities and the hostid part is assigned by your local network administrator The class of network determines the number of hosts that can be supported A Class A network can support 2 2 16 777 214 hosts Class B 2 2 65 534 hosts and Class C 2 2 254 hosts The minus 2 refers to host numbers reserved for the network itself and the local broadcast Each node on the same physical network must have an IP address of the same class and must have the same netid Each node on the same physical network must have a different hostid thus giving it a unique IP address IP addresses are written in dotted decimal f
58. of reference number and transfer length is invalid 0691H The server s Service Request Queue is full or the Ethernet interface received a Modbus Exception Code 06 SLAVE DEVICE BUSY 0791H An internal server error occurred while attempting to process a Modbus request This corresponds to the Modbus exception 07 NEGATIVE ACKNOWLEDGE Note Refer to the server documentation for other error indications Minor Error Codes for Major Error Code AOH at Client PLC Error Status Hexadecimal Error Description 01A0H Remote exchange is not healthy 02A0H Remote exchange is not defined 03A0H Remote exchange signature does not match 04A0H Request data length is invalid O5A0H Response data length is invalid O6A0H Invalid memory type selector or address range at remote device 07A0H Password protection does not permit access at remote device O8A0H Attempt to write to a consumed exchange this is not permitted O9A0H Internal resource error at remote device memory allocation failed etc OAAOH Message delivery error command was not processed OBAOH Software initialization error command was not processed OCAOH Invalid RDS session was specified ODAOH Data buffer length is invalid OEAOH Invalid response message from remote device OFAOH Address type is not supported at remote device 10A0H A memory access error occurred while processing this command 11A0
59. of the IP address scheme that allows a site to use a single netid for multiple physical networks Routing outside the site continues as usual by dividing the IP address into a netid and a hostid via the class The standard format for the netid bits and hostid bits for an IP address in a Class B network is shown below 10000000 00000011 00000000 00000001 netid bits hostid bits binary Inside a site the subnet mask is used to re divide the IP address into a custom netid portion and hostid portion Consider adding another physical network to Network 2 a Class B network in the previous example The result is shown in the figure below Selecting the subnet mask shown below would add two additional netid bits allowing for four physical networks addressed as 0 64 128 and 192 The added subnet bits are normally taken from the hostid bits adjacent to the netid and the subnet mask identifies these bits 11111111 11111111 717000000 00000000 255 255 192 0 netid bits hostid bits subnet mask binary dotted decimal The bits in the subnet mask correspond one to one with the Internet address The bits in the mask that are 1 treat the corresponding bits in the IP address as part of the netid bits The bits in the mask that are 0 treat the corresponding bits as part of the hostid bits In effect two bits of the Class B hostid have been used to extend the netid creating an extended netid or subnetid Each unique combination of bits in the part
60. of the hostid where subnet mask bits are 1 specifies a different physical network GFK 2382A Chapter 9 Network Administration 9 5 e Example Network Divided into Two Subnets The new network configuration dividing Network 2 into Subnets 2 1 and 2 2 is shown below 172 16 0 1 Network 1 172 16 0 2 G1 Gateway ej e 172 17 64 3 172 17 64 4 D E G2 Gateway 472 17 128 1 172 17 128 2 Hee eS Sub Network 2 2 Here a second network with Hosts D and E has been added Gateway G2 connects Subnet 2 1 with Subnet 2 2 Hosts D and E will use Gateway G2 to communicate with hosts not on Network 2 2 Hosts B and C will use Gateways G1 and G2 to communicate with hosts not on Network 2 1 When B is communicating with D G2 the configured Gateway for B will route the data from B to D through Gateway G2 Host A will use Gateway G1 to communicate with hosts not on Network 1 9 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A L Example Two Networks Combined into a Supernet Supernetting is a technique used to combine two smaller networks into a larger network by extending the host portion of the subnet mask and reducing the network portion Supernetting works only on neighboring networks that share the same network id value such as networks 1 and 2 in this example As with subnets the subnet mask is used to divide the IP address into a custom netid
61. operation such as connecting the programmer in order to download the hardware configuration Configuring the characteristics of the Ethernet interface Configuring Ethernet Global Data if used Optional not required for most systems Setting up the RS 232 port for Local Station Manager operation Optional not required for most systems Configuring advanced parameters This requires creating a separate ASCII parameter file that is stored to the PLC with the hardware configuration The Ethernet Interface has a set of default Advanced User Parameter values that should only be changed in exceptional circumstances by experienced users The Advanced User Parameters definitions and configuration are described in appendix A Optional Setting up the PLC for Modbus TCP Server operation See chapter 7 for information about configuring Modbus TCP Server operation If the Series 90 30 PLC also includes Ethernet Interface Modules IC693CMM321 they must be included in the overall system configuration CMM321 modules are described in the TCP IP Ethernet Communications for Series 90 PLCs User s Manual GFK 1541 Information about overall system configuration is available in other Series 90 30 PLC documentation and in the Logic Developer online help GFK 2382A 3 1 Configuration Overview The CPU372 PLUS requires the Machine Edition PLC Logic Developer PLC programmer for configuration and programming A CPU374 PLUS can be configured with t
62. other transfers GFK 2382A Chapter 4 Ethernet Global Data 4 9 Timing Examples The following illustrations show the relationship between the PLC output scan time the produced exchange timer and data samples on the network Example 1 Only one sample is produced on the network per producer period expiration The variability between samples can be up to producer CPU sweep time Producer Period 1 5 Times CPU Sweep Producer PLC Output Scan ahaa SaaS Ethernet Global Data Production Timer Expires Sample on Network Example 2 More than one sample can be produced per producer period expiration and stale samples are produced to the network Producer Period 2 3 Time of CPU Sweep Producer PLC Output Scan S CS a Fee em ene een Ethernet Global Data Production Timer Expires Sample on Network Stale Data is Produced 4 10 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Timestamping of Ethernet Global Data Exchanges The CPU adds a timestamp to each Ethernet Global Data Message it produces The timestamp indicates when the data was provided to the Ethernet interface for transmission over the network The timestamp is an 8 byte value representing the time elapsed since midnight January 1 1970 The first four bytes contain a signed integer representing seconds and the next four bytes contain a signed integer representing nanoseconds This
63. portion and hostid portion For example the two networks 10 0 117 0 and 10 0 116 0 can be combined into a larger 10 0 116 0 network if the subnet mask 255 255 254 0 is applied to both addresses 11111111 11111111 71111110 00000000 255 255 254 0 netid bits hostid bits subnet mask dotted decimal binary A 10 0 116 1 Network 1 172 0 116 2 G Gateway 172 0 117 3 B Cc 10 0 117 1 10 0 117 2 Network 2 GFK 2382A Chapter 9 Network Administration 9 7 Chapter PLC Monitoring Via the Web 10 The Series 90 30 PLUS enhanced Ethernet interface provides PLC data monitoring using a standard Web browser Web server features require configuration by Machine Edition software Alternatively Station Manager CHSOSW commands can be used if no configuration has been downloaded You can use the Web server to monitor the following PLC data PLC reference tables This data is a snapshot of the PLC Reference Tables when the data is displayed in the browser and is not updated until you request another display All reference tables are supported PLC and IO Fault Tables The web server cannot be used to modify PLC data acknowledge alarms set force values in tables The maximum number of web server connections that can be configured for the Series 90 30 PLUS Ethernet interface is 16 If the system includes FTP server connections fewer web server connections are available
64. previously formatted reference table views on the computer being used to view the data To save the current reference table settings go to the section at the bottom of the page labeled Save Current Table Settings To From the drop down box select a number to assign to these settings Optionally enter a description of the table settings by typing into the text box labeled Enter Description Click on the Save button to save the reference table settings to the computer 10 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A PLC Fault Table Viewer Page The PLC Fault Table Viewer displays the contents of the PLC fault table PLC Fault Table Microsoft Internet Explorer provided by GE Infrastructure File Edit View Favorites Tools Help Q sxx Q x a EA 2a Search Sie Favorites amp 62 a be law 33 Address http 10 10 0 11 plc_Fault_tables htm Links gt IC693CPU37X PLC Fault Table Viewer PLC Name PLC Time 02 18 2000 23 56 51 View Reference Tables Refresh PLC Fault Table View I O Fault Table Fault Extra Fault Extra Total Faults 6 Data Dat Fommat Total Faults Displayed 6 fron Entries Overflowed S Table Last Cleared MM DD YY HH MM SS 00 00 2000 00 00 00 Show All O word PLC Date Time During Last Update MM DD YY HH MM SS 02 18 2000 23 56 51 ooo Oasen a PLC Fault Table Can t locate remote node discarded request 02 18 2000 23 19 26 00
65. request to the PLC because an internal message queue is full E911H Unable to send request to the PLC because the text buffer type is invalid EA11H Unable to send request to the PLC because the mailbox utility function is invalid EB11H Unable to send request to the PLC because the mailbox message is not specified EC11H Unable to send request to the PLC because the internal message queue is not initialized FE11H Request failed due to mailbox error on remote device The remote device log will have more information 2911H 2A11H device The remote device log will have more information 3011H 3111H Failure to register with backplane driver because the requested task is already registered 3211H Unable to find resource necessary for backplane driver to process a service request 3311H Bad sequence number detected in the service request because it is already in use 3411H Invalid data detected that prevents backplane driver from completing a request 3611H More than the allowable byte length in a single transfer 4811H Memory resource problem detected 4911H Network buffer resource problem detected 4C11H Error detected while attempting to receive mailbox messages from the PLC 4D11H Timed out waiting to obtain a backplane transfer buffer 4E11H Timed out waiting to transfer a mailbox message to the PLC 4F11H Timed out waiting for PLC CPU response 11 20 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS
66. that are being changed This user generated AUP file is then imported into the programmer and assigned to a particular Ethernet interface When the entire hardware configuration is stored from the programmer to the CPU the programmer also stores the parameters from the AUP file The CPU delivers any assigned AUP file data to its Ethernet interface along with its configuration AUP file data is transferred along with the rest of the hardware configuration during both download programmer to CPU and upload CPU to programmer operations AUP file data is also included in the configuration Verify operation between programmer and CPU If an Ethernet interface is not configured by the programmer its Station Manager can be used to locally modify the Advanced User Parameters for that individual module Setting the IP address subnet mask via BOOTP or the SetIP Tool does not qualify as a programmer configuration The IEEE 802 3 standard strongly discourages the manual configuration of duplex mode for a port as would be possible using AUP Before manually configuring duplex mode for a port using AUP be sure that you know the characteristics of the link partner and are aware of the consequences of your selection In the words of the IEEE standard Connecting incompatible DTE MAU combinations such as full duplex mode DTE to a half duplex MAU or a full duplex station DTE or MAU to a repeater or other half duplex network can lead to severe net
67. the channel is initially established and if the channel resumes normal operation after a transient error condition subsides The Channel Error bit is also set to O when the channel is aborted by an Abort Channel command or when the PLC CPU transitions from RUN to STOP In the case of an Establish Channel command the COMMREQ status word is always updated before the Channel Error bit is set to 1 If this bit indicates an error initiate the Abort command and then reinitiate the Read or Write commana If the error persists initiate the Retrieve Detailed Channel Status command to find out if the channel is idle and possibly why it is idle The status code may change between the time the Channel Error bit indicates an error and the time the Retrieve Detailed Channel Status command retrieves the code 6 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A L Executing a Channel Command The figure below shows how a Communications Request carries out a Channel command in this case Establish Read Channel Domain of a TCP connection Domain of a channel f Domain of a remote server Client Client PLC Ethernet Server PLC Server PLC CPU Backplane Interface LAN Ethernet Interface Backplane CPU Power flows to COMMREQ in ladder program Command Block sent to Interface gt Verify Command Block andset up channel to server PLC Read Request y gt Read Request p gt lt 4 Data
68. the remote Modbus TCP device Note The function code determines the Modbus server address area Word 12 is the address within this area Word 13 Number Registers in Remote Device Words 13 specifies the quantity of registers 16 bit words to read from the remote device Word 14 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block 8 14 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Command 3003 Example 2 Read nine Input Discretes starting from Discrete input address 5 in the remote Modbus TCP server Store the registers at location T3 bit mode Return the CRS word to R10 Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Dec Hex 00008 0008 00000 0000 00008 0008 00009 0009 00000 0000 00000 0000 03003 OBBB 00006 0006 00002 0002 00074 004A 00003 0003 00005 0005 00009 0009 00001 0001 Length of Channel command Data Block 8 14 words Always 0 no wait mode request Memory type of CRS word R CRS word address minus 1 R10 Reserved Reserved Read from a Modbus TCP Device Channel number 6 Modbus Function Code Read Input Discretes Local PLC Memory Type Local PLC Starting Address Addre
69. the remote device must be a Produced exchange Word 16 Remote EGD exchange Exchange Data Offset Word 16 contains the 0 based byte offset of the single data byte data containing the bit or bits to be overwritten in the data portion of the exchange at the remote EGD device Word 17 Remote Server Network Address Type Word 17 specifies the format of the remote PLC address Word 17 must contain the value 1 This indicates a dotted decimal IP address expressed using a separate register for each decimal digit Word 18 Remote Server Network Address Length Word 18 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block Word 18 must contain 4 GFK 2382A Chapter 5 Programming EGD Commands 5 17 Words 19 22 Remote Server IP Address Words 19 22 specify the four integers one integer per word of the dotted decimal IP address of the remote PLC to be accessed Note The Masked Write to EGD Exchange command can be sent to various servers Masked Write to EGD Exchange Bit Mask and Data Bits Word 9 of the Masked Write command contains the bit mask The most significant byte of Word 9 is ignored In the least significant byte any bits set to 1 will be written to the remote producer The equivalent bit of Word 10 of the Masked Write command contains the bit state to be written 1 or 0 The most significant byte of Word 10 is also ignored For example Bit to be written at the selecte
70. the server with the lowest stratum number is used by the Ethernet interface until communication with that server is lost Then the server with the next lowest stratum number becomes the server of choice and the Ethernet interface synchronizes to it if it receives two of its timing messages within a 150 second period A server is considered lost if more than 150 seconds elapse between timing messages Loss or Absence of SNTP Timing Signals If an Ethernet interface is configured for SNTP but does not receive two timing messages from an SNTP network time server within a 150 second period the following will happen A fault entry will be placed in the PLC Fault Table A fault entry will be placed in the Ethernet interface s exception log This log can be read using the Station Manager The Status word within a consumed exchange will indicate new data with a value of 3 instead of the normal 1 value That means SNTP is selected but the Ethernet interface is not synchronized to an SNTP server This Status word value can be obtained from the PLC register configured for the particular exchange Note The SNTP error condition is considered the least important of all possible error codes Therefore if another error condition exists its status code will appear in the Status word instead of the SNTP error code Upon loss or absence of synchronization the Ethernet interface s built in clock will operate as follows If the Ethernet inter
71. third octet of the IP Address Word 14 IP Address 4th Octet Word 13 specifies the value of the fourth octet of the IP Address GFK 2382A Modbus TCP Client 8 9 Close a Modbus TCP Client Connection 3001 The application program closes a Modbus TCP Client Connection by issuing the Close Modbus TCP Client Connection COMMREQ The Close COMMREQ closes the underlying TCP connection and frees the channel for other communication tasks An error response is returned if the channel number in the COMMREQ identifies a non Modbus TCP Client connection or an inactive channel Command 3001 Example Terminate the Modbus TCP Client connection established on Channel 5 Return the COMMREQ Status word to R10 Dec Hex Word 1 00002 0002 Length of Channel command Data Block Word 2 00000 0000 Always 0 no wait mode request Word 3 00008 0008 Memory type of CRS word R Word 4 00009 0009 CRS word address minus 1 R10 Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03001 OBB9 Close Modbus TCP Client Connection Word 8 00005 0005 Channel number 5 Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 requests the Close channel service Word 8 Channel Command Number Word 8 identifies a channel previously opened with an Open Modbus TCP Client Connection request If a Close Modbus TCP Cli
72. to EGD Exchange 5 16 Modbus Protocol 7 2 reference tables 7 3 Modbus Function Codes 7 5 Modbus TCP Client 1 7 Monitoring the communications channel 8 36 Multicast IP Addresses 9 3 Multicasting Ethernet Global Data 4 6 Multiple Gateways 9 5 Name 3 15 3 18 Network Address 6 12 6 19 Network connection 2 8 Network Names 3 12 Network time sync 3 8 Number of repetitions for a Channel Command 6 10 6 14 6 18 O Offline Configuration 3 12 Operating States 11 4 Operational state 11 5 P Password 10 9 Period for Channel Commands 6 10 6 14 6 18 PING Restrictions 11 33 Pinging the TCP IP Interfaces on the Network 2 12 Pinouts 2 8 PLC Fault Table 11 7 PLC Fault Table Viewer 10 5 PLC Timeout Errors 11 31 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Port Connectors 2 6 Port Settings 2 10 Power Up 2 11 Power up states 11 4 Private Networks IP addresses 9 3 Produced Data Exchange Definition 3 15 Produced Period 3 16 4 9 Producer 4 2 Producer ID 3 18 Programmer Response 11 34 Protocol Modbus 7 2 R Read EGD Exchange command 5 10 Read PLC Memory command 5 4 Related documents 1 2 Remote PLC 6 13 Repeater 2 9 Reply Rate 3 16 Re tasking a channel 6 2 Retrieve Detailed Channel Status command 2002 6 21 S Sample ladder program 6 24 Modbus TCP communications 8 28 Send Information Report command 2010
73. to use Broadcast GFK 2382A Chapter 3 Configuration 3 15 Destination Identifies the data s consuming device based on the Destination Type selected above a dotted decimal IP address if Destination Type is IP Address the group s ID 1 32 if Destination Type is Group ID the value 255 255 255 255 If Broadcast IP is the Destination Type Produced Period The scheduled repetition period at which the data is produced on the network Configure a value in the range of 0 or 2 3 600 000 2 milliseconds to 1 hour The value zero means data will be produced at the end of each PLC scan but not less than 2 milliseconds from the previous production Set the production period to 2 the period at which the application needs the data in this exchange Round this value up to the nearest 2 milliseconds Reply Rate Not used Send Type Fixed at always In the PLC production of EGD is controlled by the I O state when enabled EGD production is enabled and when disabled EGD production is disabled Configuring the Produced Exchange Variables Double click on the produced exchange to open a window for configuring the variables within the exchange EEF Series 90 30 El PLCI Data Watch Lists Gi W2 Ethernet Global Data 2100081 False Consumed Exchanges Produced Exchanges Bb ProdExchi Bop Uii Man EA Project 2 Info SSE Produ
74. 0 LAN transceiver fault OFF network until fixed 02 18 2000 23 19 13 000 o1 Failed battery signal 02 18 2000 23 19 08 000 i Long Short Task Group Action Error Code 0 0 18 2 Diagnostic 0 Fault Extra Data 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Rack size mismatch 02 18 2000 23 19 05 000 Rack size mismatch 02 18 2000 23 09 37 000 Failed battery signal 02 18 2000 23 07 48 000 Internet The PLC name is shown at the top of the page together with the PLC timestamp showing when the page was accessed or refreshed The PLC fault table provides up to 16 entries arranged from newest to oldest If there are fewer than 16 entries the remaining rows are blank If there are more than 16 faults the table displays the most recent faults in the first 8 rows and the oldest faults in the last 8 rows To change the format of the fault extra data select the appropriate checkbox at the top of the page To refresh the fault data click the Refresh PLC Fault Table button GFK 2382A Chapter 10 PLC Monitoring Via the Web 10 5 When using Internet Explorer the fault extra data can be viewed by using the mouse to highlight a particular fault and then clicking on the fault This is shown below PLC Fault Table Microsoft Internet Explorer provided by GE Infrastructure DER File Edit View Favorites Tools Help ay Q sxx Q x a EA pi Search JIE Favorites 2 ae x E 33 Address
75. 0 R00010 4 ETH_READY OPEN_REQ BLKMOV INT BLKMOV INT s INt Q Ro00301 5 IN1 Q RrRo0308 R00301 RO0308 3000 IN7 1 IN7 Rung 1 Input LANIFOK bit 16 of the LAN Interface Status bits monitors the health of the Ethernet interface Input LAN_OK bit 13 of the LAN Interface Status bits monitors the online offline status of the Ethernet interface If both bits are set it is OK to send a COMMREQ and the ETH_READY coil is ON ETH_READY is used as an interlock for Rungs 2 16 Rung 2 When ETH_READY is set Input DO_OPEN triggers OPEN_REQ which enables execution of the MOVE and COMMREQ functions for the Open Modbus TCP Connection Commreq OPEN_REQ is a one shot Positive Transition coil activating once when both ETH_READY and DO_OPEN have transitioned from OFF to ON Rung 3 The MOVE WORD function moves a zero to the CRS word referenced in the Command Block see rung 4 This clears the CRS word This rung also resets the OPEN_FLT output coil of the COMMREQ Function Block in rung 5 GFK 2382A Modbus TCP Client 8 29 It is vital that the CRS Status Word be cleared and the COMMREQ fault output coil be cleared each time before initiating a COMMREQ function Rung 4 The BLKMV INT functions set up the COMMREQ Command Block contents When this rung is activated the constant operands are moved into the memory beginning at the address indicated in the instruction The constant operands
76. 0 Monitoring 8 36 Numbers assigned 6 10 6 14 6 18 6 20 6 22 8 9 8 13 8 15 8 16 8 17 8 19 8 20 8 21 8 22 8 23 Re tasking 6 2 Client PLC 6 13 Client Server Capability 1 3 Collections 3 12 Command Block 8 2 8 3 8 6 COMMREQ 11 13 COMMREQ Fault Errors 11 30 COMMREQ Format for Programming EGD Commands 5 2 COMMREQ Function Block 8 2 8 5 Index COMMREQ Status 5 3 11 14 COMMREQ Status word 8 2 8 3 8 36 Pointer 6 8 8 7 COMMREQs command block 6 7 format 6 6 sequencing 6 27 Communications Request 6 6 8 2 Communications Status words 8 25 8 27 Configuration Data 3 2 Configuration Data Backup 3 2 Configuration Mismatch 11 33 Configuration Server 3 11 Configuring Ethernet Global Data 3 10 Configuring the Ethernet Interface 3 7 Consumed Data Exchange Definition 3 18 Consumed Period 3 18 Consumed Variable 3 19 Consumer 4 2 Converting from CPU364 to CPU374 target 3 22 D Data Block 6 8 8 3 8 7 Length 6 7 8 6 Data Transfer bit 6 4 11 12 Data Transfers with One Repetition 6 27 Destination Type 3 15 Detailed Channel Status words 6 21 6 23 Determining if an IP address has been used 2 12 Documentation 1 2 EGD Command Session Conflicts 11 34 11 35 EGD Generic Device Editor 3 21 EGD Management Tool 11 25 EGD Properties 3 13 EGD Signatures 3 14 3 19 EGD Validation 3 20 Embedded switches 2 6 EOK LED 2 5 Establish Read Channel command 2003 6 9 Establish Write
77. 003 Example 4 Read FIFO Queue Read the FIFO Queue from the remote Modbus TCP server Store the FIFO Queue Data at location AQ1 Return the COMMREQ Status word to R10 Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Dec Hex 00008 0008 00000 0000 00008 0008 00009 0009 00000 0000 00000 0000 03003 OBBB 00006 0006 00024 0018 00012 000C 00001 0001 00048 0030 00001 0001 00001 0001 Length of Channel command Data Block Always 0 no wait mode request Memory type of CRS word R CRS word address minus 1 R10 Reserved Reserved Read from a Modbus TCP Device Channel number 6 Modbus Function Code Read FIFO Queue Local PLC Memory Type AQ Local PLC Starting Address FIFO Pointer Address Data Size Unused Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Read Exception Status from the Modbus TCP device Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 24 Read FIFO Queue Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interf
78. 01 IN FT s R00301 4 SYsID 21 TASK ETH_READY EG INT 1 na READ_SUCCESS R00011 IN1 a s R00011 ETH_READY READ_SUCCESS CLOSE_REQ 12 T T a ETH_READY CLOSE_REQ MOVE WORD i CLOSE_FLT 13 T T r 4 o IN Q ROOO12 R00012 Rung 10 The COMMREQ Function Block has three input parameters and one output parameter The IN field points to the starting location of the Command Block parameters R00301 in this example The SYSID field of the COMMREQ Function Block defines the target rack and slot of the Ethernet interface to receive the command data This is a hexadecimal word value that gives the rack high byte and slot low byte location of the Ethernet interface module The TASK field of the COMMREQ Function Block indicates which mailbox task ID to use for the specified rack and slot For the CPU372 PLUS and CPU374 PLUS Ethernet interface TASK must be set to 21 decimal 0015H The FT output energizes the READ_FLT coil in this example is turned ON set to 1 if there were problems preventing the delivery of the Command Block to the Ethernet interface In this case the other status indicators are not updated for this COMMREQ Rung 11 When ETH_READY is set the CRS word for the Modbus TCP Read commregq is monitored for a status of 1 indicating that the Read commreq completed successfully The CRS word change to 1 sets coil READ_SUCCESS 8 32 TCP IP Ethernet Co
79. 1 2R60 ROOO10 ROOOO9 ROOOO8 oROOOO7 ROOOO6 ROOOOS ROOOO4 ROOOO3 ROOOOZ ROOOOL Choose Pre defined Table Settings Save Current Table Settings To From Settings Stored on User PC 11 R1 R60 v User PC Select Thl Y Enter Description R1 R60 Select Single Reference Table R vii Dec Click on a cell to format the number Click on Format button to format an entire row gt lt El Done E Internet Selecting Reference Table Data Initially the previously viewed reference table is shown To change the display you can Select Reference Table Data Row by Row The right column of each row contains the configuration options for that row For each row select the reference table starting address and data format You can select the R AI WAQ l WQ M T G S SA SB or SC reference table Format a row by clicking the Format button for the entire row Use the drop down box to select the data format for the selected reference address or row With Internet Explorer pressing the OK button changes the format immediately With Netscape the format changes after you refresh the screen GFK 2382A Chapter 10 PLC Monitoring Via the Web 10 3 Select the data format by clicking on a reference table address cell above the reference value and choosing the display format type For example 4 Format Reference Value Microsoft In Mi E3 Enter Format asci 7 Fo
80. 100001 32768 3 3xxxx Input Registers 1 64 A100001 64 4 4xxxx Register Table 1 1024 R00001 1024 When Modbus Address Space Mapping is set to Disabled on the Settings tab the Modbus TCP Address Map tab does not appear If the CPU module does not receive an address map from Machine Edition the Ethernet interface will respond to Modbus TCP clients with Exception Code 4 Slave Device Failure This same exception code will also be returned when the PLC s hardware configuration is cleared 7 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Modbus Function Codes This section summarizes the mapping of CPU reference tables to Modbus addresses by the Modbus function codes supported by the Modbus TCP Server The mapping shown in this table assumes that the PLC is configured to use its default reference table sizes Modbus PLC Modbus Function Code Table Start Address Length Start Address Length 1 Read Coils 5 Write Single Coil Oxxxx 1 32768 Q00001 32768 15 Write Multiple Coils 2 Read Discrete Inputs 1xxxx 1 32768 1 00001 32768 3 Read Holding Registers 6 Write Single Register 16 Write Multiple Registers 4XXXX 1 1024 RO0001 1024 22 Mask Write Register 23 Read Write Multiple Registers 4 Read Input Registers 3XXXX 1 64 AI00001 64 een Eeepiion Sal n a n a n a n a n a 8 Diagnostics GFK 2382A Chapter 7 Modbus TCP Server 7 5 Cha
81. 2 should be zero for no timeout However there are two circumstances in which specifying a timeout is recommended 6 10 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A L When the number of time units Word 11 is zero so that a subsequent transfer will be issued as soon as the previous transfer completes and no period errors are reported In this case a timeout value can be specified so that timeout errors will be reported by the Channel Error bit When the read period is very long minutes or hours In this case a shorter timeout value can be specified so the application doesn t have to wait for the read period to expire before taking action Word 13 Local PLC Memory Type Words 13 14 specify the location in the local PLC where the Ethernet interface will store data received from the remote PLC Valid values for Word 13 are listed below The amount of data to be transferred is specified by the number of memory units of the data read from the remote PLC Word 17 Type Value Decimal Description L 0 Program Block Local register memory word mode P 4 Program register memory word mode R 8 Register memory word mode AI 10 Analog input memory word mode WAQ 12 Analog output memory word mode l 16 Discrete input memory byte mode 70 Discrete input memory bit mode Q 18 Discrete output memory byte mode 72 Discr
82. 31 1 22 172 131 1 5 Unicast Producer 2004 10 15 19 49 40 3 100 500 CPUEOS 072131 3 I TANE E E ENIUSO30 172131 1 Referencelmplementation 622 172 131 1 22 172 131 1 6 Unicast Producer 2004 10 15 19 49 40 3 100 500 eE Fui 172131 1 17 Referencelmplementation 2122 172 131 1 22 172 131 1 21 Unicast Producer 2004 10 15 19 49 40 3 100 500 E A FX HMI OPC Server Referencelmplementation 5122 172 131 1 22 224 0 7 22 Multicast Producer 2004 09 16 17 14 09 2 500 k BO Gece Gee 1721 Referencelmplementation 7622 172 131 1 22 172 131 255 255 Broadcast Producer 2004 09 16 17 14 09 2 500 fE QP_CE_Ginch 172 1 z TOTTI GEA Pteria 172131 Referencelmplementation 9922 172 131 1 22 172 131 1 1 Unicast Producer 2004 10 15 15 23 08 3 500 EE Reterencelmplemente RX7i 7601 172 131 1 1 172 131 255 255 Broadcast Consumer 2004 09 09 20 13 37 2 500 eed Exchanges RX7i 7602 172131 1 1 172 131 255 255 Broadcast Consumer 2004 09 09 20 13 37 2 500 BE Unbound Variable RX7i5101 172 131 1 1 224 0 7 1 Multicast Consumer 2004 09 09 20 13 37 2 500 EP KT 172 131 1 1 FIMTi5102 172131 1 1 224 0 7 2 Multicast Consumer 2004 09 09 20 13 37 2 50 ical Test Full Device Ne ENIU9030 7603 172 131 1 3 172 131 255 255 Broadcast Consumer 2004 08 10 15 00 34 5 500 ae CPU374_DIT 7605 172 131 1 5 172 131 255 255 Broadcast Consumer 2004 09 08 20 42 25 4 2 500 Aj CPU374_DIT 5105 172131 1 5 224 0 7 5 Multicast Consumer 2004 09 08 20 42 25 2 500 Zo CPU364_DIT 7606 172 131 1 6 172 131 255 255
83. 4 specify the PLC memory location of the CRSW word Word 3 COMMREQ Status Word Memory Type This word specifies the memory type for the CRS word The memory types are listed in the table below Type Value Value Description Decimal Hex R 8 08H Register memory word mode AI 10 OAH Analog input memory word mode AQ 12 OCH Analog output memory word mode l 16 10H Discrete input memory byte mode 70 46H Discrete input memory bit mode AQ 18 12H Discrete output memory byte mode 72 48H Discrete output memory bit mode T 20 14H Discrete temporary memory byte mode 74 4AH Discrete temporary memory bit mode M 22 16H Discrete momentary internal memory byte mode 76 4CH Discrete momentary internal memory bit mode G 56 38H Discrete global data table byte mode 86 56H Discrete global data table bit mode Word 4 COMMREQ Status Word Address Offset This word contains the offset within the memory type selected The status word address offset is a zero based number For example if you want R1 as the location of the CRS word you must specify a zero for the offset The offset for R100 would be 99 decimal Note that this is the only zero based field in the Channel commands Word 5 Reserved Set to zero Word 6 Reserved Set to zero Words 7 and up Data Block The Data Block defines the Channel command to be performed For information on how to fill in the Channel command
84. Broadcast Consumer 2004 09 08 20 41 24 2 CPU364_DIT 5106 172131 1 6 224 0 7 6 Multicast Consumer 2004 09 08 20 41 24 2 VMENIU 1 172131 1 8 172 131 255 255 Broadcast Consumer 2004 08 20 19 42 59 4 UR G60 3 172131 1 15 172 131 255 255 Broadcast Consumer 2004 07 06 15 44 38 2 ComCoeTestMkVle 7616 172131 1 16 172 131 255 255 Broadcast Consumer 2004 02 16 11 16 39 2 Fuji 172131 1 17 172 131 255 255 Broadcast Consumer 2004 02 16 11 16 39 6 Fuj 2 172131 1 17 172 131 255 255 Broadcast Consumer 2004 02 16 11 16 39 Active Configuration Server EGD Server Onine EGD Sever 17213112 Miror Sever C Program Fies GE Industrial Systeme EGD Management ToohMirorCache The configuration summary data for each exchange has the following information Exchange the name of the exchange as it is stored in the EGD configuration server Producer ID the producer ID of the exchange as it is stored in the EGD configuration server Destination the destination IP address for the exchange Mode Unicast Multicast or Broadcast based on the mode of the exchange Type Producer or Consumer depending on the type of the exchange GFK 2382A Chapter 11 Diagnostics 11 27 Configuration Time the configuration timestamp of the exchange as it is stored in the EGD configuration server Signature the signature value of the exchange as it is stored in the EGD configuration server Length the byte size of the exch
85. COMMREQ to CPU Status Word lt Set Channel Open Bit Channel Open Bitis 4 set to 1 Power flows to COMMREG Q in ladder program Command Block sent to Interface gt Verify Command Block and set up channel to server This sequence must be repeated for each Read Request ipe gt Read Request read or write request Data lt Data 4 Data lt Data lt 4 Return COMMREQ Status CRS Word COMMREQ to CPU Status Word Power flows to Connection COMMREGQ in ladder program gt Verify Command Block sent to Command Block Receive Interface sand close channel gt Disconnect to server Send disconnect 4 Return COMMREQ acknowlegement Status CRS Word COMMREQ focPU Status Word Channel Open Bit is set to 0 lt Clear Channel Open Bit ma 1 A Communications Request begins when there is power flow to a COMMREQ function in the client The Command Block data is sent from the CPU to the Ethernet interface 2 The COMMREQ Status word CRS word is returned immediately if the Command Block is invalid If the syntax is correct then the CRS word is returned after the transfer of data 8 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A COMMREQO Function Block and Command Block This section describes the programming structures common to all Communications Requests the COMMREQ Function Block and the Command Block The COMMREQ Function Block The Communi
86. Channel command 2004 6 13 8 11 8 18 8 22 8 23 Establishing a channel 8 8 8 10 Ethernet Global Data 4 2 Configuring 3 10 Consumed Data Exchange Definition 3 18 Consumer 4 2 Effect of PLC modes and actions on 4 14 Index 1 Index Index 2 Exchange 4 3 Exchange Status Word 4 15 Operation 4 8 Produced Data Exchange Definition 3 15 Producer 4 2 Variables 4 4 Ethernet Global Data EGD 1 7 Ethernet Parameters 3 7 Exchange ID 3 15 3 18 Exchange Status Word Ethernet Global Data 4 15 Exchange Variables 3 17 F Fault table 11 7 Firmware upgrades 1 6 FT Output of the COMMREQ Function Block 8 3 8 25 8 26 FTP Connect and Login 10 8 G Gateways 9 4 Group ID 3 18 H Hardware failure 11 5 Host Name 3 11 Hub 2 9 I O Fault Table Viewer 10 7 Installation 2 3 IP address Configuration 3 8 Determining if it has been used 2 12 Format 9 2 Isolated network 3 8 IP Address Assignment 3 3 IP Addresses Reserved for Private Networks 9 3 IP Addresses Multicast 9 3 L Ladder programming 6 24 8 28 LAN Interface OK bit 6 3 8 27 LAN Interface Status bits 8 2 8 3 8 26 LAN LED 2 5 LED Blink Codes 11 6 LED Operation during Restart 2 4 LEDs 2 11 11 4 Local PLC 6 13 Local Producer ID 3 13 Local Server Cache Path 3 10 Logic program controlling execution of the COMMREQ 8 3 Loopback IP Addresses 9 3 M Mapping modbus to ENIU memory 7 3 Masked Write
87. Command Block parameters R00301 in this example The SYSID field of the COMMREQ Function Block defines the target rack and slot of the Ethernet interface to receive the command data This hexadecimal word value gives the rack high byte and slot low byte location of the Ethernet interface module The TASK field of the COMMREQ Function Block indicates which mailbox task ID to use for the specified rack and slot For the CPU372 PLUS and CPU374 PLUS Ethernet interface TASK must be set to 21 decimal 0015H The FT output energizes the CLOSE_FLT coil in this example is turned ON set to 1 if there were problems preventing the delivery of the Command Block to the Ethernet interface In this case the other status indicators are not updated for this COMMREQ Rung 16 When ETH_READY is set the CRS word for the Close Modbus TCP Connection commreg is monitored for a status of 1 indicating that the Close commreq completed successfully The CRS word change to 1 sets coil CLOSE_SUCCESS 8 34 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Troubleshooting a Ladder Program There are several forms of status data that can be accessed by the application program The use of the LAN Interface OK bit in the LAN Interface Status Word was described in the example program Some status data can be used to troubleshoot a program in its developmental stage The two primary sources of this data are the FT
88. Connections must not exceed 20 total connections FTP server connections are available only when configured by Machine Edition they are not supported by VersaPro RS 232 Port Station Manager Parameters for the Series 90 30 PLUS The defaults should be used for most applications Settings Scan Memory Power Consumption Ethernet FS 232 Port Station Manager Parameters Values Data Rate bps J Nl k aa Flow Control None Parity None Data Rate Data rate bits per second for the port Choices are 1200 2400 4800 9600 19 2k 38 4k 57 6k 115 2k The default value is 9600 Flow Control Type of flow control to be used for the port Choices are None or Hardware The Hardware flow control is RTS CTS crossed The default value is None Parity Type of parity to be used for the port Choices are None Even or Odd the default value is None GFK 2382A Chapter 3 Configuration 3 9 Configuring Ethernet Global Data The most convenient way is to configure Ethernet Global Data is with the Ethernet Global Data server that is provided with the PLC programming software This server holds the EGD configurations for all the devices in the EGD network When the Configuration Server is used the EGD configuration for the entire EGD network can be validated for accuracy before the configuration is stored into the devices of the network Note By default the Navigator window does not display the Ethernet Global Data componen
89. Critical interrupt exception diagnostics 0x22 Stack error during power up 0x62 Boot Machine check exception diagnostics 0x23 Shared Memory Interface error 0x63 Boot Data store exception during power up diagnostics 0x24 Firmware CRC cyclic redundancy 0x64 Boot Instruction store exception check error during power up or Factory Test 0x25 Run time exception 0x65 Boot External interrupt exception 0x26 No mail communication available 0x66 Boot Alignment exception during software load 0x27 Serial EEPROM access exception 0x67 Boot Program exception 0x28 Serial EEPROM reset exception 0x68 Boot System call exception 0x31 Machine check exception 0x69 Boot PIT interrupt exception 0x32 Data store exception 0x71 Boot FIT interrupt exception 0x33 Instruction store exception 0x72 Boot WDT interrupt exception 0x34 Alignment exception 0x73 Boot Data cache TLB miss exception 0x35 Program exception 0x74 Boot Instruction cache TLB miss exception 0x36 System call exception 0x75 Boot Debug exception 0x37 Unexpected IRQ exception 0x76 Boot Flash memory CRC error 0x38 Data cache TLB miss exception 0x77 Boot Unexpected ACFAIL interrupt 0x39 Instruction cache TLB miss 0x78 Boot Unexpected Restart exception pushbutton interrupt 0x41 BSP startup error CRC error or software error during normal operation causes Ethernet restart 11 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A PLC Fault Tabl
90. Ethernet Ta Twisted Pair Cable devices such as PCs Ethernet Interfaces on other PLCs Operator Interfaces GFK 2382A Chapter 2 Installation and Startup 2 9 Station Manager Port The RS 232 6 pin RJ 11 port is used to connect a terminal or terminal emulator to access the Station Manager software on the Ethernet interface A cable is needed to connect the terminal emulator or Software Loader to the Ethernet interface Port Settings The serial COM port of the terminal or computer that is connected to the Ethernet interface must use the same communications parameters as the Ethernet interface The default values for the Station Manager port are 9600 bps 8 bits no parity and 1 stop bit If the Ethernet interface is configured with default values for this port or the Ethernet interface has not been configured use these default values If the Ethernet interface is configured with non default values for this port use those values for the serial port settings of the terminal or computer Port Pinout a45696 Station Manager Serial Port Pinout RJ 11 Port Signal Description Pin Number 1 CTS Clear To Send input 2 TD Transmit Data output 3 SG Signal Ground 4 SG Signal Ground 5 RD Receive Data input 6 RTS Request to Send output 2 10 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Verifying Proper Powerup of the Ethernet Interface after Configuration
91. Exchange The variables within an exchange are defined in the Ethernet Global Data configuration in hardware configuration There can be Up to 100 data ranges per exchange A length of 1 byte to 1400 bytes per exchange The total size of an exchange is the sum of the data lengths of all of the data ranges configured for that exchange Different produced exchanges may share some or all of the same data ranges even if the exchanges are produced at different rates A consumer does not have to consume all of the data from a produced exchange A consumed exchange may be configured to ignore specified data ranges See Selective Consumption in chapter 3 Configuration Valid PLC Memory Types for Ethernet Global Data The PLC memory types listed below can be included in EGD exchanges at the CPU372 PLUS or CPU374 PLUS Description P Producer C Consumer R Register memory in word mode P C AI Analog input memory in word mode P C WAQ Analog output memory in word mode P C l Discrete input memory in byte mode P C AQ Discrete output memory in byte mode P C T Discrete temporary memory in byte mode P C M Discrete momentary memory in byte mode P C SA Discrete system memory group A in byte mode P C SB Discrete system memory group B in byte mode P C SC Discrete system memory group C in byte mode P C S Discrete system memory in byte mode P G Discrete global data table in byte mode P C
92. FK 2383 for more information Bit 15 Reserved Bit 16 LAN Interface OK Bit This bit is set to 1 by the Ethernet interface each PLC scan If the Ethernet Interface cannot access the PLC the CPU sets this bit to 0 When this bit is 0 all other Ethernet Interface Status bits are invalid GFK 2382A Chapter 11 Diagnostics 11 11 Channel Status Bits The Channel Status bits provide runtime status information for each communication channel Each channel has two status bits the meaning of the channel status bits depends upon the type of communication performed on that channel SRTP Client channels operation provides two Channel Status bits for each SRTP channel a Data Transfer bit and a Channel Error bit These are defined in chapter 6 SRTP Channels Bits 17 19 21 47 Data Transfer Bit The Data Transfer bit pulses 0 gt 1 0 each time there is a successful read or write Bits 18 20 22 48 Channel Error Bit This bit normally 0 indicates any channel error fatal or non fatal It does not necessarily indicate that the channel is idle 11 12 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Monitoring the FT Output of the COMMRE Function Block The COMMREQ function block indicates its status through its FT output COMM REQ Enable Command Block address Function Faulted logic Rack Slot Location of the Ethernet Interface Task value If after executing
93. GE Intelligent Platforms Programmable Control Products TCP IP Ethernet Communications for Series 90 30 CPU372 PLUS and CPU374PLUS User s Manual GFK 2382A J anuary 2010 GFL 002 Warnings Cautions and Notes as Used in this Publication Warning notices are used in this publication to emphasize that hazardous voltages currents temperatures or other conditions that could cause personal injury exist in this equipment or may be associated with its use In situations where inattention could cause either personal injury or damage to equipment a Warning notice is used Caution notices are used where equipment might be damaged if care is not taken Note Notes merely call attention to information that is especially significant to understanding and operating the equipment This document is based on information available at the time of its publication While efforts have been made to be accurate the information contained herein does not purport to cover all details or variations in hardware or software nor to provide for every possible contingency in connection with installation operation or maintenance Features may be described herein which are not present in all hardware and software systems GE Intelligent Platforms assumes no obligation of notice to holders of this document with respect to changes subsequently made GE Intelligent Platforms makes no representation or warranty expressed implied or statutory with respec
94. H Remote device did not understand the request 12A0H Remote device has no variable defined at the specified address 13A0H An attempt was made to write a Read Only variable at remote device GFK 2382A Chapter 11 Diagnostics 11 23 aO NE Error Description Hexadecimal 14A0H Data length or contents are invalid for transfer according to the data type of that variable at remote device 15A0H Response message would exceed max response size 1400 bytes 50A0H The remote server detected an unsupported protocol version in the request 51A0H The remote server did not recognize the requested command 52A0H The remote server detected a configuration time mismatch in the request 53A0H The remote server detected that the request was not a valid RDS message The RDS_Header bit required by RDS version 2 01 and higher was not set 54A0H Attempt to establish a second session to a remote server Only one session at a time is permitted between this device and each remote server 11 24 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Using the EGD Management Tool The EGD Management Tool can perform online monitoring of EGD class 2 devices such as the Series 90 30 PLUS enhanced Ethernet interface and PACSystems Ethernet Interfaces It can quickly look at the Ethernet Global Data traffic across an entire network of EGD devices to spot problems To use the EGD Ma
95. HTTP instance i e each browse window requires at least two TCP connections and each FTP session requires two TCP connections to the PLC The maximum number of web browser connections and FTP connections at the Ethernet interface at any one time are separately configurable from 0 to 16 a value of 0 means that the web server or FTP capability is disabled The total number of configured web browser connections plus FTP connections is limited to 20 connections once the number of browser FTP connections reaches the configurable limit any new browser or FTP connection requests will fail The number of Web Server and FTP connections is configurable via the Programmer The Programmer configuration details are described in the Programmer Help utility When the PLC is unconfigured the user can change the number of web server HTTP connections and FTP connections with the following Station Manager commands respectively CHSOSW web_max_conn lt number from 0 16 gt CHSOSW ftp_max_conn lt number from 0 16 gt For example CHSOSW web _max_conn 6 CHSOSW ftp_max_conn 4 Note The CHSOSW commands are not available if the PLC has received a valid configuration from the Programmer GFK 2382A Chapter 10 PLC Monitoring Via the Web 10 11 Chapter Diagnostics 11 This chapter describes diagnostic techniques for the Series 90 30 CPU372 PLUS and CPU374 PLUS enhanced Ethernet interfaces Tools Available for Diagnostics States of t
96. IC693CMM321 can be installed in the Series 90 30 PLC backplane If the PLC system includes any IC693CMM321 modules please refer to the installation instructions configuration and communication details in the TCP IP Ethernet Communications for Series 90 PLCs User s Manual GFK 1541 and the TCP IP Ethernet Communications for Series 90 PLCs Station Manager Manual GFK 1186 GFK 2382A Chapter 1 Introduction 1 3 CPU372 PLUS and CPU374 PLUS Ethernet Features Full PLC programming and configuration services Periodic data exchange using Ethernet Global Data EGD EGD Commands to read and write PLC and EGD exchange memory over the network TCP IP communication services using SRTP Support for SRTP Client Channels Modbus TCP Server supporting Modbus Conformance classes 0 1 and 2 Modbus TCP Client supporting Modbus Conformance classes 0 1 and Function Codes 15 22 23 and 24 for Conformance class 2 Basic remote PLC monitoring from a web browser Comprehensive station management and diagnostic tools Extended PLC connectivity via IEEE 802 3 CSMA CD 10Mbps and 100Mbps Ethernet LAN port connectors Network switch that has Auto negotiate Sense Speed and crossover detection Direct connection to BaseT twisted pair network switch hub or repeater without an external transceiver Protocol is stored in flash memory in the Ethernet interface and is easily upgraded through the CPU serial port Communications with remote PLC
97. IP address will be used Word 20 Network address length Must be 4 for IP address Group ID multicast is not permitted Word 21 to IP Address of the remote Four integers specified as one integer per word of the Word 24 PLC dotted decimal IP address of the remote PLC May not be a group IP address Word 25 Reserved Always 0 Word 4 COMMREQ status word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address GFK 2382A Chapter 5 Programming EGD Commands 5 13 Word 7 EGD Command Number Word 7 requests that a write EGD exchange operation occur If the command is processed successfully data for a specified EGD exchange is written from the client to the server Word 8 Command Retry Time Word 8 specifies the time in milliseconds the Ethernet Interface will wait between retries when transferring the command A total of four tries will be made to send the command If no response is received after the four tries i e after four times the retry time value an error status will be returned in the COMMREQ status word If the command retry is specified as zero the default value of one second is used Word 9 Local PLC Memory Type Words 9 11 specify the location in the local PLC where the Ethernet Interface will get the data to write to the remote EGD device Valid values for Word 9 are listed in the description of Read PLC Memory Command The amount of data
98. LUS September 2007 GFK 2382A Assigning a Temporary IP Address Using BOOTP When the Series 90 30 PLUS Ethernet interface receives the default IP address 0 0 0 0 either from hardware configuration or from internal backup configuration it attempts to obtain a temporary IP address from a BOOTP server on the Ethernet network The Ethernet interface acts as a BOOTP client The Ethernet interface issues a BOOT Request to the network If any BOOTP server on the network recognizes the Ethernet interface that server will return a BOOT Reply containing an IP address and optionally a subnet mask and gateway IP address to the requesting Ethernet interface Typically the BOOTP server must be manually configured with the MAC address and IP address and possibly other information such as subnet mask and gateway for each supported client device Each supported client must be identified by its globally unique MAC address The Ethernet interface s MAC address is specified on its MAC Address Label as described in chapter 2 Installation The BOOTP server must not be separated from the Ethernet interface by a router BOOTP uses broadcast messages which typically do not pass through routers Consult your network administrator for more details The temporary IP address set by BOOTP is not retained through a power cycle To set a permanent IP Address you must configure the Ethernet interface s IP Address at the programmer and download the hardware c
99. MI QPCone J CPU364_DIT 172 131 1 6 I E B CPUI74_DIT 172 131 1 5 e EE ENIUS030 172 131 1 3 z moma e Fuji 172131 1 17 FIX HMI OPC Server Build0923 T UDH PE_HMI_OPCSERVER_buil09Z QPControlt2 172 131 1 13 Implementation 172 7 Referen Ri Test Fu UR G60 View H VMENIU Reference DCAORCAnEN Name The name of the EGD device Active Configuration Server EGD Server Online EGD Server 172 131 1 25 Mirror Server C Program Files GE Industrial Systems EGD Management Tool MirrorCache Devices that have a red x are not responding to communications from the EGD Management Tool Devices that have a yellow triangle have some kind of error or warning condition that may require attention Use the browser pane to select the device to get further information about the failures being reported The EGD Management Tool reports a configuration mismatch for PLCs that have multiple Ethernet interfaces Only one of the interfaces in a PLC is queried by the EGD Management Tool so only a subset of the exchanges in the PLC is visible online through that interface Online information is only available for EGD Class 2 devices devices that support the EGD commands This includes the CPU374 PLUS Release 12 or later embedded Ethernet 11 26 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A interface CPU372 PLUS an
100. Output on the COMMREQ Function Block and the COMMREQ Status word CRS word FT Output is ON If after executing a COMMREQ Function the FT Output is ON then there is a programming error in one or more of the following areas Invalid rack slot specified The module at this rack slot is unable to receive a COMMREQ Command Block Invalid Task ID For the CPU372 PLUS and CPU374 PLUS Ethernet interfaces TASK must be set to 21 decimal 0015H Invalid Data Block length 0 or greater than 128 COMMREQ Status Word is Zero 0 and FT Output is OFF If after executing a COMMREQ function the CRS word is zero 0 and the FT Output is OFF then the Command Block has been sent to the Ethernet interface but no status has been returned yet If this condition persists check the PLC Fault Table for information COMMRE Q Status Word is Not One 1 If after executing a COMMREQ function the CRS word is not a value of 1 indicating success then there were Errors in the Command Block the Channel command code or parameters or The command parameters were valid but there was an error in completing the request If the CRS word does not contain a 1 indicating success then it contains either a 0 or a code indicating what error occurred GFK 2382A Modbus TCP Client 8 35 Monitoring the Communications Channel The status data can be used to monitor communications and take action after certain events Monitoring the COMMREQ Status Wo
101. P channels operation and Modbus TCP channels operation Note Do not use the 80 bits configured as Ethernet Status data for other purposes or data will be overwritten Status Length This is the total length of the Ethernet interface status data This is automatically set to either 80 bits for l and Q Status address locations or 5 words for R AI and AQ Status address locations Network Time Sync The method used to synchronize the real time clocks over the network The choices are None for no network time synchronization and SNTP for synchronization to remote SNTP servers on the network See Simple Network Time Protocol SNTP in chapter 4 Ethernet Global Data for more information 3 8 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Max Number of Web Server Connections The number of TCP connections allocated for use by the web server not the number of web clients Valid range is 0 through 16 The default is 2 Note Web server connections are available only when configured by Machine Edition they are not supported by VersaPro Max Number of FTP Server Connections The number of TCP connections allocated for use by the FTP server This is not the same as the number of FTP clients because each FTP client uses two TCP connections when an FTP connection is established Valid range is 0 through 16 Default is 2 Note The sum of Max Web Server Connections and Max FTP Server
102. PLC Fault Table Viewer Page ccccccecceceeeeeeeeeeneeeeeeeeeeeeseeeaeeeeeeeeaeeeseeeaeeeseeaeeeeenaaeees 10 5 VO Fault Table Viewer Page ccccccceescieceeee titre erties ee AEAEE EREA A RE KAARI KERA TKKF E RERET AA REA EREA 10 7 Downloading PLC Web Pages aier anar tann aE a O 10 8 FTP Gonnectiand Logi oerieormrani erna an e iia engined 10 8 Changing the Passwordisen 3 sca ed kaie nahi edad eddie Ate 10 9 vill TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Contents WebPage File Transiter ciers E stecedienteeediadiceee AEAEE 10 10 Viewing the CPU372 PLUS and CPU374 PLUS PLC Web Pages sieneen 10 11 DIAGN OSUCS naene eenaa e a a Eeee ea eaaa a aE a A a Aa e AAAA Raa ENE senap OOR SiE 11 1 Tools Available for DiaQnOstiCs cceceeeeeeneee erent ee eeecieeeeetaeeeeeeeaeeeeeecaeeeeetieeeeneaes 11 3 States of the Ethernet Interface 0 ei ecccceceeeeeeeeeeeneeeeeeaaeeeeeeaeeeeeeaeeeeeecaeeeseenaeeeeeseaas 11 4 EOK LED Blink Codes for Hardware Failures ccccceceeeeeeeeeeeeeeeseeneeeeseenaeeeeeeeaeees 11 6 PEC Paultlable paa cated gh stsen deta a ietatasane dea ede eth ede Becta dees 11 7 PLC Fault Table Descriptions cccccceeeeeeeceeceeeeeeeeeececaeeeeeeeeesecsiceeeeeeeeeeeees 11 7 Monitoring the Ethernet Interface Status Bits 20 0 0 eee eeeeee resent eeeeeneeeeeeneeeeeeeaaes 11 10 Monitoring the FT Output of the COMMREQ Function Block 11 13 Monitorin
103. Period Word 11 specifies the number of time units for the write period The write period is in effect even when the Channel command is setup to issue a single write Example Write Period Calculation If Word 10 contains a value of 3 specifying seconds as the time unit and Word 11 contains a value of 20 then the write period is 20 seconds A Channel command set up to issue a single write can have only one pending write transfer A write will normally be issued at the start of each write period If the pending write transfer has not completed during the write period the Channel Error bit and Detailed Channel Status words will be set to indicate a non fatal period error The pending transfer can still complete after the period error occurs For Channel commands set up to issue multiple writes the next write transfer will be issued only after the pending write transfer completes If the Number of Time Units is zero a subsequent transfer will be issued as soon as the previous transfer completes In this case no period errors are reported by the Channel Error bit Word 12 Timeout for Each Write Word 12 specifies the time in hundredths of a second the Ethernet interface will wait for a write transfer to complete before setting the Channel Error bit and Detailed Channel Status bits to indicate a non fatal timeout error The transfer can still complete even after a timeout occurs As a result an application can choose what to do if
104. Q 18 12H Discrete output memory byte mode 72 48H Discrete output memory bit mode T 20 14H Discrete temporary memory byte mode 74 4AH Discrete temporary memory bit mode M 22 16H Discrete momentary internal memory byte mode 76 4CH Discrete momentary internal memory bit mode G 56 38H Discrete global data table byte mode 86 56H Discrete global data table bit mode Word 4 of the COMMREQ Command Block specifies the offset within the memory type selected The status word address offset is a zero based number For example if R1 should be the location of the status word you must specify a zero for the offset The offset for R100 would be 99 decimal COMMREQ Status Values The Ethernet Interface reports the status of the COMMREQ back to the status location See chapter 11 Diagnostics for COMMREQ status values that may be reported for the EGD commands GFK 2382A Chapter 5 Programming EGD Commands 5 3 Read PLC Memory 4000 The Read PLC Memory command can be used to read memory locations from a remote PACSystems PLC This command does not require configuration of a produced consumed exchange in the PLCs The Read PLC Memory command can only be sent to an individual IP Address it cannot be sent to a Group ID multicast Read PLC Memory Command Block Word Offset Value Description Word 1 Length of command data block Always 22 Word 2 0 Al
105. Remote Device Words 13 specifies the quantity of input discretes to read from the remote device Word 14 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block GFK 2382A Modbus TCP Client 8 15 Command 3003 Example 3 Read Exception Status Read the Exception Status from the remote Modbus TCP server Store the Exception Data at location Q4 bit mode Return the COMMREQ Status word to R10 Dec Hex Word 1 00008 0008 Length of Channel command Data Block Word 2 00000 0000 Always 0 no wait mode request Word 3 00008 0008 Memory type of CRS word R Word 4 00009 0009 CRS word address minus 1 R10 Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03003 OBBB Read from a Modbus TCP Device Word 8 00006 0006 Channel number 6 Word 9 00007 0007 Modbus Function Code Read Exception Status Word 10 00072 0048 Local PLC Memory Type Word 11 00004 0004 Local PLC Starting Address Word 12 00000 0000 Reserved Word 13 00001 0001 Data Size Word 14 00001 0001 Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Read Exception Status from the Modbus TCP
106. Series 90 30 CPU372 PLUS and CPU374 PLUS Station Manager Manual GFK 2383 for details Alternatively if the PLC is not in a RUN state an IP address can be set using the Set IP method That method can be used even if the module already has a valid configured IP Address If the module has the factory default IP Address 0 0 0 0 a temporary IP address can be set using BOOTP over the Ethernet network if a BOOTP server is present Both temporary IP address assignment methods are described here Assigning a Temporary IP Address Using the Programming Software To initiate Ethernet communications with the programmer you first need to set up a temporary IP address After the programmer is connected the actual IP address for the Ethernet interface set up in the hardware configuration should be downloaded to the PLC The temporary IP address remains in effect until the Ethernet interface is restarted or power cycled or until the hardware configuration is downloaded or cleared To use the Set Temporary IP Address utility the PLC CPU must not be in RUN mode IP address assignment over the network is not processed until the CPU is stopped and is not scanning outputs The current user logged on to the PC running the Set Temporary IP Address utility must have full administrator privileges The Set Temporary IP Address utility can be used if communications with the networked Series 90 30 PLUS target travel across network switches and hubs H
107. Shutdown avoiding the TCP Linger period and reducing the chance of exhausting TCP resources when quickly transitioning between Run gt Stop and Stop gt Run The earlier Series 90 SRTP Channel implementation performed a normal stopping of the channel on a Run to Stop transition 4 lf an Abort Abort All Channel COMMREQ is issued followed by an Establish Read Write Send Info Report Channel COMMREQ before the COMMREQ Status Word for the Abort Abort All has been updated the Establish Read Write Send Information Report COMMREQ is now discarded and its COMMREQ Status Word is set to a failure value A990 That indicates it was discarded because the application logic issued the command while an Abort was in progress In earlier Series 90 SRTP Channels implementations the Establish Read Write Send Information Report was dropped and the COMMREQ Status Word was not updated it remained zero 5 This implementation uses new COMMREQ Status Codes See chapter 11 for details 6 This implementation supports Re tasking to a different remote device different IP Address 7 The Series 90 30 PLUS enhanced Ethernet interface simultaneously supports up to 16 SRTP Client Channel connections and up to 20 SRTP Server connections Prior to version 12 0 CPU374 limited the total number of SRTP Channels and SRTP Server connections to 20 connections GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 31 Chapter Modbus TCP Server 7 This section de
108. T 100Base TX RJ 45 shielded twisted pair Ethernet ports for connection to either a 10BaseT or 100BaseTX IEEE 802 3 network Each port automatically senses the speed 10Mbps or 100Mbps duplex mode half duplex or full duplex and cable straight through or crossover attached to it with no intervention required Ethernet Media The Ethernet interface can operate directly on 10BaseT 100BaseTX media via its network ports 10BaseT 10BaseT uses a twisted pair cable of up to 100 meters in length between each node and a switch hub or repeater Typical switches hubs or repeaters support 6 to 12 nodes connected in a star wiring topology 100BaseTX 100BaseTX uses a cable of up to 100 meters in length between each node and a switch hub or repeater The cable should be data grade Category 5 unshielded twisted pair UTP or shielded twisted pair STP cable Two pairs of wire are used one for transmission and the other for collision detection and receive Typical switches hubs or repeaters support 6 to 12 nodes connected in a star wiring topology GFK 2382A Chapter 1 Introduction 1 5 Station Manager The built in Station Manager function provides on line supervisory access to the Ethernet interface through the Station Manager port or over the Ethernet cable Station Manager services include An interactive set of commands for interrogating and controlling the station Unrestricted access to observe internal statistics an exce
109. The IP address will reset after power is cycled Please remember to download the hardware configuration immediately after using this tool r MAC Address Enter 12 digit MAC address using hexadecimal notation six 2 digit pairs BEE EEE IP Address to Set Enter IP address using dotted decimal notation Exit O 0 0 0 Help m Network Interface Selection If your computer has multiple network interfaces you may pick the one to use I Enable interface selection the specified IP address is not already in use then it sets the selected Ethernet interface to the specified IP address Finally the utility verifies that the Ethernet interface responds at the selected IP address Successful completion or an error that occurs during address assignment is reported These operations may take up to a minute The temporary IP address set by the Set Temporary IP Address utility is not retained through a power cycle To set a permanent IP Address you must set configure the target s IP Address and download the hardware configuration to the target The Set Temporary IP Address utility can assign a temporary IP address even if the target Ethernet interface has previously been configured to a non default IP address This includes overriding an IP address previously configured by the programmer Use this IP Address assignment mechanism with care 3 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 P
110. The Producer ID uniquely identifies each EGD device in the configuration server and must be present if the server is used EGD Consumers A consumer is a device that will update its local internal memory based on the data in an exchange The consumer is identified at the producer by an IP Address a Group ID or a local subnet broadcast IP address based upon the Subnet Mask depending on the Destination Type selected The Consumed Exchange configuration allows selective consumption of a produced EGD exchange The consumer takes in the whole exchange from the network but does not need to send all of the exchange to the PLC memory This feature is called Selective Consumption A Consumed Exchange can be set to ignore the data ranges variables that are not needed 4 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A EGD Exchanges Each exchange in EGD is identified by its Producer ID and Exchange ID Up to 128 exchanges can be configured for a Series 90 30 PLUS enhanced Ethernet interface They can be divided into any combination of produced and consumed exchanges Each exchange can be up to 1400 bytes in length Different produced exchanges can include some or all of the same data even though the exchanges are produced at different rates and sent to different consumers Consumed Exchanges should not duplicate where the data is put as variable conflicts will occur and data will be overwritten by
111. This bit is only valid if bit 13 LAN OK is 1 Bit 2 Port 1 100Mbps This bit is set to 1 when Port 1 is operating at 100Mbps Bit 3 Port 2 Full Duplex This bit is set to 1 when Port 2 is set to full duplex Full duplex or half duplex operation is automatically negotiated between the Ethernet interface and its immediately connected network device usually a network hub or switch If this bit is 0 the port is operating in half duplex Ethernet mode This bit is only valid if bit 13 LAN OK is 1 Bit 4 Port 2 100Mbps This bit is set to 1 when Port 2 is operating at 100Mbps Bit 9 Any Channel In Error This bit normally 0 indicates one or more of the channels are in error Bit 13 LAN OK This bit is 1 as long as the Ethernet interface software is able to communicate on the network If the network becomes inaccessible due to local or network problems this bit is set to 0 If LAN communication becomes possible again it is set to 1 Bit 14 Resource Problem This bit is set to 1 if the Ethernet interface software has a resource problem i e lack of data memory The bit is reset to 0 on a subsequent PLC sweep The Ethernet interface may or may not be able to continue functioning depending on the severity of the problem Look in the PLC Fault Table for details In addition the Station Manager STAT B and LOG commands can be used See the TCP IP Ethernet Communications for Series 90 30 CPU372 PLUS and CPU374 PLUS Station Manager Manual G
112. Use the Station Manager to troubleshoot a problem with the Ethernet Interface the network PLC backplane communication or with your application The LOG TALLY EXS XCHANGE and STAT Station Manager commands are especially useful The LOG command provides a complete record of exceptions occurring with the network and Interface The TALLY command provides statistics about operation and performance of the Interface and the embedded Ethernet network switch The EXS command provides information about COMMREQs The CHANNEL command displays detailed information about a specified SRTP or Modbus TCP communication channel The STAT H command provides the current status on the operation of SRTP communication channels on the Interface The STAT M command provides the current status on the operation of Modbus TCP communication channels on the Interface The XCHANGE command displays detailed information about a specified Ethernet Global Data exchange The STAT G command provides the current status on the operation of EGD communications on the Interface For information on how to access and use the Station Manager software refer to GFK 2383 TCP IP Ethernet Communications for Series 90 30 CPU372 PLUS and CPU374 PLUS Station Manager Manual GFK 2382A Chapter 11 Diagnostics 11 3 States of the Ethernet Interface 1 The Ethernet Interface is initialized by Powering up the PLC Ethernet Interface n Storing a new configuration to the PLC wi
113. Word 15 Remote PLC Memory Type Words 15 16 specify the memory type and starting address in the remote PLC from which the data is to be read Valid values for Word 15 are listed above If P memory is used you must specify a Program name in Words 24 27 If L memory is used you must specify a Program name in Words 24 27 and a Program Block name in Words 28 31 Word 16 Remote PLC Memory Starting Address Word 16 determines the starting address in the remote PLC from which the data is to be read The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 15 This offset will be either in bits bytes or words depending on the mode specified for example if Word 15 16 and Word 16 9 then the starting address will be I65 Valid ranges of values depend on the remote PLC s memory ranges Word 17 Remote PLC Number of Memory Units Word 17 specifies the amount of data to be transferred The value entered is the number of memory units to be transferred where the size of a memory unit is a bit byte or word as specified in Word 15 For example if Word 15 16 and Word 17 4 then 4 bytes 32 bits of l memory will be transferred A maximum of 16384 bits 2048 bytes or 1024 words of data can be specified Word 18 Remote PLC Network Address Type Word 18 specifies the format of the remote PLC address Word 18 must contain the value 1 This indicates a dotted decimal IP addr
114. Word 16 Remote PLC Network Address Type Word 16 specifies the format of the remote PLC address Word 16 must contain the value 1 This indicates a dotted decimal IP address expressed using a separate register for each decimal digit Word 17 Remote PLC Network Address Length Word 17 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block Word 17 must contain 4 Words 18 21 Remote PLC IP Address Words 18 21 specify the four integers one integer per word of the dotted decimal IP address of the remote PLC to be accessed Note The Read PLC Memory command can only be sent to a GE PLC server 5 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Write PLC Memory 4001 The Write PLC Memory command can be used to write memory locations to one remote PACSystems PLC Use of this command does not require a configured produced consumed exchange in the PLCs Write PLC Memory Command Block Word Value Description Offset Word 1 Length of command data Always 22 block Word 2 0 Always 0 no wait mode request Word 3 See table on page 5 3 Memory type of COMMREQ Status Word Word 4 __ 0 based Offset of COMMREQ Status Word Word 5 0 Reserved Word 6 0 Reserved Word 7 4001 fa1H Write PLC Memory command number Word 8 Retry time in milliseconds The time between retries of command transfers in
115. a oki Shad ceca as easton daha eee een eee ea died eas eae 9 2 IP Address Format for Network Classes A B C cccccsessecccececeaneeseeeeeeeteceaneeees 9 2 IP Addresses Reserved for Private NetworkS 2 ccceceeeeeeeeeeaeeeeeeeeeeseesnaeees 9 3 Multicast IP Adras 56S r raen ne Aae aa ae AEAT ERAAN E EA aR ENA EARRAS AAE RAA 9 3 opback IP AddreSSEShni impire e aaa E aod O aaaeei EaR 9 3 EEEE a A EE A A A EA A I A E E E E E E A 9 4 Networks Connected by a Gateway eesseseissserresserrssttrrstttrrststtnnssttnrssttrnssren nnt 9 4 S b etsand Sup rnetSi ras gedena a aa aaa ai aa aaia acting 9 5 Subnet Addressing and Subnet MaSkS 0 cc cceeeeeeeeeeeeeeeeeeeeeeeeeeeeaeeeseeaeeeseeaeees 9 5 Example Network Divided into Two Subnets ececeeceeeeeeeeeeeeceeeeeeeeeeeeeeteees 9 6 Example Two Networks Combined into a Supernet ccceeeeeeeeeeeeeeeeeeeeeenee 9 7 PLC Monitoring Via the Web cccssseccssseeeeeeseseeeeeesseneeeeeeeeeeeeeenseeeaeeesseeeeeeseeseeeeess 10 1 System Requirements somero aaa a akin cies 10 1 standard Web Pagos enar a icici area vee Metis 10 1 CPU372 PLUS and CPU374 PLUS Home Pages eccceccceceeeeeeeeeeeeseeeeeeeeeneeeeeeaees 10 2 Reference Tables Viewer Page ccccccccseeeeeeseeeeeeeseeeeeeeseeeeeeesenaeeeseeeeeesenaeeeeeenaeees 10 3 Selecting Reference Table Data eeccccceeeeeeeeeeneeeeeeeneeeeeenaeeeeeenaeeeseeneeeeeeaes 10 3
116. a valid configuration from the Programmer GFK 2382A Chapter 10 PLC Monitoring Via the Web 10 9 Web Page File Transfer After logging into the PLC s FTP server web page files can be copied from the PC to the PLC through the following steps 1 Set the FTP file transfer type to binary by typing in binary 2 For each file change to the desired directory if appropriate by typing cd subdirectory Then transfer the file using the put command by typing put filename htm 3 Verify all files are properly transferred by typing in dir or Is This returns a list of the files located at the current directory on the PLC Ethernet interface 4 Quit the FTP session by typing in quit or bye If you copy a file that already exists in the module the new file overwrites the existing file without warning One of the files stored will be a fault string file that will be specific for each language supported The PLC FTP server also supports the following standard FTP commands get command allows the user to transfer files from the PLC web server to their local PC for example get filename1 htm delete command allows user to delete web pages from the server for example delete filename1 htm 10 10 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Viewing the CPU372 PLUS and CPU374 PLUS PLC Web Pages Each web browser
117. able path Setting this path toa location on the local machine and setting Work Offline to True allows EGD configuration data to be updated using the saved information without accessing the server Setting the Work Offline parameter to False and performing a Validate will synchronize the server with the data from the cache Network Names n order to perform validation between producers and consumers it is necessary to know whether the producer and the consumer are on the same network The EGD Configuration Server and its validation libraries use the network name to perform this check The validation assumes that two devices that have the same network name are connected to the same network The Network Names parameter may be set to the name of the network to which the device is connected Collections The EGD Management Tool is an optional utility that can be used to provide a system level look at all the Ethernet Global Data devices in a system The EGD Management Tool can look at subsets of EGD devices called collections A collection is a logical grouping of EGD devices for example a manufacturing cell or a machine To make an EGD device part of a collection set the Collections parameter to the name of the collection for the device by default the collection for a device is the Machine Edition project name 3 12 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Basic EGD Configuration If the Ethern
118. accelerated processing can preempt EGD production activity possibly delaying transmission of produced exchanges to the network Such delay varies with network loading and the volume of consumed exchanges In applications requiring minimal produced exchange timing variability the consumed exchange acceleration may be disabled via the gc_accel AUP parameter See appendix A for details of the gc_accel parameter Under extreme network load accelerated processing of the incoming EGD samples may consume so much processing time that the watchdog timer for the network interface expires and the network interface is reset GFK 2382A Chapter 11 Diagnostics 11 35 Appendix Configuring Advanced User Parameters A This section describes a set of internal operating parameters for the Series 90 30 PLUS Ethernet interface that can optionally be modified for an application The AUP File Assigning an AUP File to the CPU372 PLUS or CPU374 PLUS Format of the Advanced User Parameters File Advanced User Parameter Definitions GFK 2382A A 1 The AUP File Advanced User Parameters AUPs are internal operating parameters used by the Ethernet interface For most applications the default Advanced User Parameters should not be changed If it is necessary to modify any of these parameters it must be done by creating an optional AUP file using any ASCII text editor This file must contain the names and values of only those parameters
119. ace and for mac_address enter the MAC address of the Ethernet interface 3 Issue a Telnet command to the IP address ijp_address being assigned to the Ethernet interface via the following command gt telnet ip_address 1 This command is always sent to port 1 This Telnet command will fail but the IP address provided with the Telnet command will be passed to the Ethernet interface and will be temporarily activated The IP address assigned over the network remains in effect until the Ethernet interface is restarted or power cycled or until the configuration is downloaded or cleared Once connected the intended IP address should be permanently downloaded to the Ethernet interface via the hardware configuration 3 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Configuring the Ethernet Parameters of the Series 90 30 PLUS CPUs This section describes how to configure the Ethernet parameters of a Series 90 30 PLUS enhanced Ethernet interface In the Project tab of the Navigator expand the desired Series 90 30 PLC Target the hardware configuration and the main rack Rack 0 EEF Series 90 30 E e CPU374 A Data Watch Lists ffia Hardware Configuration E fii Main Rack 1C693CHS391 fly PWR IC693PWR321 Slot 1 1C693CPU374 p slot 20 Right click on the desired target CPU374 as in this example the designations CPU374 PLUS or CPU372 PLUS do not appear in the progr
120. ace will store data received from the remote device Valid values for Word 10 are listed on page 8 14 Word 11 Local PLC Memory Address Word 11 determines the starting address in the local PLC in which the data from the remote device is to be stored The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 10 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Be sure this area is large enough to contain the requested data without overwriting other application data Word 12 FIFO Pointer Address Word 12 is the FIFO pointer address in the Remote Device Word 13 Data Size Word 13 is unused because the return data size is dependent on the number of items in the server s FIFO queue when the command is received This function can return 0 through 32 registers Word 14 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block GFK 2382A Modbus TCP Client 8 17 Write Data to a Modbus TCP Device 3004 The Write Data to a Modbus TCP Device COMMREQ requests a data transfer from the PLC to a Modbus TCP server The Write Data COMMREQ must reference an active Modbus TCP channel previously established with the Open Modb
121. ally due to heavy CPU loading The client should retry later It is recommended that the client wait a minimum of 10 milliseconds before sending another service request OBH Illegal Service Request The requested service is either not defined or not supported at the server PLC This value is returned in lieu of the actual service request error 01H to avoid confusion with the normal successful COMMREQ completion Call GE Intelligent Platforms for assistance 11H SRTP Error Code at server An error was detected at the SRTP server For Minor Error codes see the table on page 11 18 82H Insufficient Privilege at client PLC The minor error code contains the privilege level required for the service request 84H Protocol Sequence Error The CPU has received a message that is out of order Call GE Intelligent Platforms for assistance 85H Service Request Error at the client PLC The minor error code contains the specific error code For Minor Error codes see the table on page 11 16 86H Illegal Mailbox Type Service request mailbox type is either undefined or unexpected Call GE Intelligent Platforms for assistance 87H The client PLC CPU s Service Request Queue is full The client should retry later It is recommended that the client wait a minimum of 10 milliseconds before sending another service request 8BH Illegal Service Request The requested service is either not defined or not supported This value is returned instead of the actual ser
122. ammer and select Properties Ethernet parameters can be configured on the Ethernet tab and on the RS 232 Port Station Manager tab Configuration of the other CPU parameters is not described here Note CPU374 Hardware configurations created within Machine Edition before the 374 was released will need to be updated in order to access the web server and FTP features A replace operation in Machine Edition can be used Series 90 30 PLUS Ethernet Parameters Settings Scan Memory Power Consumption Ethernet RS 232 Port Station Manager Modbus TCP Address Map Parameters Values a Configuration Mode TCP IP Adapter Name 0 1 IP Address 0 0 0 0 Subnet Mask 0 0 0 0 Gateway IP Address 0 0 0 0 Status Address 100001 Status Lenath 80 Network Time Sync None Max number of Web Server Connections 1 Max number of FTP Server Connections 2 Configuration Mode This is fixed as TCP IP Adapter Name This is automatically generated based upon the rack slot location of the Ethernet interface 0 1 GFK 2382A Chapter 3 Configuration 3 7 IP Address Subnet Mask Gateway IP Address These values should be assigned by the person in charge of your network the network administrator TCP IP network administrators are familiar with these parameters It is important that these parameters are correct otherwise the Ethernet interface may be unable to communicate on the network and or network operation may be c
123. amming SRTP Channel Commands 6 19 Abort Channel 2001 The Abort Channel command immediately disconnects an active channel from its remote PLC and closes the channel The Channel Transfer bit the Channel Error bit and the Detailed Channel Status words for the channel are set to zero Example Command Block Abort Channel 5 Return the COMMREQ Status word to R10 Dec Hex Word 1 00002 0002 Word 2 00000 0000 Length of Channel command Data Block 2 words Always 0 no wait mode request Word 3 00008 0008 Memory type of COMMREQ status word R Word 4 00009 0009 COMMREQ status word address minus 1 R10 0 based Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 02001 07D1 Abort Channel command number Word 8 00005 0005 Channel number 5 Word 7 Channel Command Number This command parameter requests that a channel be aborted If the command is processed successfully it terminates processing on the channel by the time success is indicated in the COMMREQ status word Word 8 Channel Number The channel number specifies the channel to be disconnected 1 32 As a convenient way to abort all channels if the channel number parameter is 1 FFFFH all channels in use are aborted It is not an error to abort all channels if there are none in use Neither is it an error to abort an idle channel Note For the Abort Channel and Retrieve Detailed Channel Status commands no actual data is transmitted on the
124. ange as it is stored in the EGD configuration server Period the production period for a produced exchange or the consume timeout for a consumed exchange as it is stored in the EGD configuration server Online EGD Statistics Selecting the Online Statistics tab displays a list of the exchanges in the device and statistics information about each exchange The statistics are updated periodically based on a rate in the Options menu EGD System EGD Management Tool Configuation Summay Unine Statistics Exchange Configaahon Tee Due Tine Slalus Length Message Court Massed Court Rebech Emons b Referercelmplemertationl22 2004101519473 20041017222040 Producing 100 10656 0 0 Relerercelinpiewertabon 222 20041015134940 2004 10 17 222040 Produang 100 10656 0 0 Reterencelmelemertation S22 20041015 19 4240 2 20 40 Producing 100 10656 0 0 Reterereelmelenertn 20041015194940 2 O Producing 100 10656 0 0 i Erann 1 17 Relerercelingienertabon 2122 20041015134940 20 2040 Produang 100 10656 0 0 1 3h FX HMI OPC Server Buk Reterencelmelemertation S122 20040916 17 14 09 2 20 40 Producing 2 10656 0 0 H te PE_HMI_OPCSERVER_bu Referencelmplemertation 7822 20040916171409 20 7222040 Producing 10656 0 0 s l paral a begs a Referercelinglenertaton 3922 2004 10 15 15 22 08 7222040 Produong 3 1056 0 0 Ff Relerncsinplemertsion 1 20 40 Hesty 2 20040 1 2 E Exchanges lt 2040 Hedy 2 20824 12090 2 BE Urtvoarn
125. anges expand the Ethernet Global Data node in the Project tab Right click the Consumed Exchanges or the Produced Exchanges node and choose New The new exchange appears under the selected list node For each Consumed and Produced Exchange configure the parameters described earlier GFK 2382A Chapter 3 Configuration 3 21 Converting from CPU364 to CPU374 To convert a CPU364 target to a CPU374 CPU374 target replace the CPU364 with a CPU374 in the hardware configuration The entire target including logic and hardware configuration will be converted to a CPU374 target Items that cannot be converted are set to their default values If Name Resolution assignments and aliases for IPs are configured for the CPU364 they will be deleted Adapter names in the CPU364 EGD configuration will be converted to the Rack 0 Slot 1 location in the CPU374 configuration and the adapter name on EGD exchanges will be displayed as 0 1 SNP ID and the editable Memory tab parameters are always carried over to the new configuration You will be prompted to choose whether to convert other common parameters Hardware Configuration The SNP ID parameter and the editable parameters on the Memory Tab are always camied over Do you want to keep the current settings for the remaining common parameters If you choose Yes E Parameters that are common to both CPU models are carried over m EGD exchanges are converted to the new target E The EGD exchange
126. as explained later in this chapter System Requirements Web monitoring requires version 4 0 or later of Netscape Navigator or Internet Explorer The browser must be capable of running the Java Virtual Machine JVM version 1 3 plug in The supported host operating systems are Windows NT 4 0 SP5 or SP6 Windows 95B Windows 98 First Edition Service Pack 1 Second Edition and Windows 2000 Professional SP1 Windows Millennium Edition Windows XP and Windows CE 3 0 To view the entire Reference Table page the screen resolution must be 1024 x 768 or higher Local web firewall blocking issues will be avoided by using HTTP protocol on port 80 to transfer standard HTML files including JavaScript and Java applets from the server to the browser and HTTP Post command to transfer form information from the browser to the server Standard Web Pages The CPU Ethernet Interface is shipped with a set of standard PLC web pages already installed These standard web pages include a PLC home page a Reference Table display page a PLC Fault Table display page and an IO Fault Table display page When necessary new or revised web page files may be transferred into the Ethernet interface via the standard FTP protocol as described in this section GFK 2382A 10 1 CPU372 PLUS and CPU374 PLUS Home Pages The home page is displayed after entering the PLC CPU s URL or IP address at your web browser From the PLC home page you may navigate to the other PLC web pa
127. ask could not be registered because the message response handler was not specified 3811H The backplane task could not be registered because the unsolicited mailbox message handler was not specified 3911H The backplane task could not be registered because a required parameter was not specified 3A11H More than the allowable byte length in a single transfer 3B11H Bad sequence number in the request 3C011H Invalid command in request 3D11H Response length does not match length specified in the response qualifier 3E11H Request failed because the PLC s Service Request Processor is not initialized 3F11H Request failed due to an error in the remote device most likely running out of Dual Port RAM text buffers 4011H Unable to free dual port memory that was allocated for a connection or block transfer area 4111H The backplane task could not be registered because the service request handler was not specified 4211H No dual port memory was allocated for the connection or block transfer area needed to process the request 4311H Failure to register with backplane driver because the requested task is already registered 4411H Request failed because an invalid field was identified in the request mailbox qualifier continued GFK 2382A Chapter 11 Diagnostics 11 19 Minor Error Codes for Major Error Code 11H at Remote Server PLC Continued from previous page Error Status i Hexadecimal SRTP Error Description E811H Unable to send
128. asting Multicasting is a feature of Ethernet Global Data For more information on the use of multicasting in Ethernet Global Data see chapter 4 Loopback IP Addresses Class A IP Addresses in the 127 xxx xxx xxx range are reserved for loopback addressing A network packet using a loopback destination address is not actually transmitted on the network but instead is processed by the same device as if it were received from the network The Series 90 30 enhanced Ethernet interface recognizes only the IP address 127 0 0 1 as a loopback address All other addresses in the range 127 0 0 2 127 255 255 255 are ignored and do not provide loopback operation GFK 2382A Chapter 9 Network Administration 9 3 L Gateways Gateways also known as routers connect individual physical networks into a system of networks When a node needs to communicate with a node on another physical network a gateway transfers the data between the two networks Networks Connected by a Gateway The following example shows Gateway G connecting Network 1 with Network 2 A 172 16 0 1 Network 1 172 16 0 2 G Gateway B c 172 17 0 3 172 17 0 1 172 17 0 2 Network 2 When host B with IP address 172 17 0 1 communicates with host C it knows from C s IP address that C is on the same network In an Ethernet environment B can then resolve C s IP address to a MAC address via ARP and communicate with C direc
129. at data from the remote PLC be transferred periodically to the local PLC The Command Block specifies the period the number of reads from the server remote PLC to perform and the timeout allowed in waiting for each transfer to complete The first read is performed immediately regardless of the period specified Example Command Block iG Establish a channel Channel 5 to a remote PLC at IP address 10 0 0 1 Return the COMMREQ Status word to R10 Read remote PLC registers R50 R57 to local PLC registers R100 R107 Repeat the read 10 times once every 7 seconds with a timeout of 500 ms for each read The term local PLC is used here to identify the client PLC the PLC that initiates the communications request The term remote PLC is used here to identify the server PLC the PLC that responds to the communications request Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Word 15 Word 16 Word 17 Word 18 Word 19 Word 20 Word 21 Word 22 Word 23 Word 24 27 Word 28 31 Dec Hex 00017 0011 00000 0000 00008 0008 00009 0009 00000 0000 00000 0000 02003 07D3 00005 0005 00010 000A 00003 0003 00007 0007 00050 0032 00008 0008 00100 0064 00008 0008 00050 0032 00008 0008 00001 0001 00004 0004 00010 000A 00000 0000 00000 0000 00001 0001 Length of Channel command Data Block 17 25 words Alway
130. ational mode If the STAT LED is off an event has been entered into the exception log and is available for viewing via the Station Manager The STAT LED is on during normal operation when no events are logged In the other states the STAT LED is either off or blinking and helps define the operational state of the module EOK LED Operation The EOK LED indicates whether the Ethernet interface is able to perform normal operation This LED is on for normal operation and flashing for all other operations When a hardware or unrecoverable runtime failure occurs the EOK LED blinks a two digit error code identifying the failure GFK 2382A Chapter 2 Installation and Startup 2 5 Ethernet Port Connectors The Ethernet interface on the CPU372 PLUS and CPU374 PLUS includes two Ethernet port connectors each of which supports both 10Base T and 100Base Tx operation using either full duplex or half duplex operation These 8 pin RJ 45 connectors are used to connect the Ethernet Interface to a hub repeater switch or other Ethernet device Embedded Switch The two Ethernet port connectors are controlled by an embedded network switch in the module The module has only one interface to the network one Ethernet address and one IP address CPU374 Ethernet Interface Ethernet Processor Ethernet MAC 10 100 Network Switch Port 1 Port 2 For simple installations the embedded switch allows devices to be connected without additional componen
131. ations for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Overview The Series 90 30 CPU374 PLUS and CPU372 PLUS have a built in enhanced Ethernet interface that provides TCP IP communications with Series 90 PACSystems and VersaMax PLCs host computers running the Host Communications Toolkit or CIMPLICITY software computers running the TCP IP version of the programming software These communications use the GE SRTP and Ethernet Global Data EGD protocols over a four layer TCP IP Internet stack The Ethernet interface has SRTP server capability As a server the Ethernet Interface responds to requests from devices such as PLC programming software a Host computer running an SRTP application or another PLC acting as a client Ethernet Cable Network Network Connection SSS SSS Connection L NI i m CPU374 with PEA a Embedded Ethernet Ethernet Ethernet Interface Interface Interface Host Computer or Control Computer Running Device running a Host Programming Software Communications Toolkit TCP IP Ethernet Additional Ethernet Interfaces for the Series 90 30 PLC In addition to the embedded Ethernet interface in the CPU372PLUS and CPU374PLUS up to three Series 90 30 Ethernet Modules
132. attached to the network LAN system software fault Internal system error If problem persists contact GE Intelligent aborted Platforms connection resuming LAN system software fault Internal system error If problem persists contact GE Intelligent restarted LAN I F Platforms LAN system software fault Internal system error If problem persists contact GE Intelligent resuming Platforms LAN transceiver fault OFF Transceiver or transceiver cable failed or became disconnected network until fixed Reattach the cable or replace the transceiver cable Check SQE test switch if present on transceiver Local request to send was Internal error Check that the Ethernet Interface is online If problem rejected discarded request persists contact GE Intelligent Platforms Memory backup fault may lose Internal error accessing non volatile device If problem persists contact configuration log on restart GE Intelligent Platforms NA Replace Ethernet Interface Module software corrupted Catastrophic internal system error Contact GE Intelligent Platforms requesting reload 11 8 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A PLC Fault Module state doesn t permit COMMREQ received when Ethernet Interface cannot process CommReg discarded COMMREQ Make sure Ethernet Interface is configured and online Error may occur if the logic application is sending COMMREQs faster than the Ethernet Interfac
133. ause Corrective Action Heavy COMMREQ traffic Reduce the rate at which the logic application sends COMMREQs to the Ethernet Interface Heavy SRTP traffic Reduce the size number or frequency of SRTP requests at the remote SRTP client Long PLC sweep time Modify the PLC application to reduce the PLC sweep time PLC Communication Window Change to RUN TO COMPLETION mode set to LIMITED mode Note The CPU372 PLUS and CPU374 PLUS embedded Ethernet interfaces use the Controller Communications Window GFK 2382A Chapter 11 Diagnostics 11 31 Application Timeout Errors Application timeout errors include SRTP Channel timeout errors COMMREQ Status 0190H or 0290H at the client EGD Command timeout errors COMMREQ Status 0190H at the client EGD consumed exchange refresh errors Exchange Status 6 or 7 Application timeout errors can happen for several reasons including Incorrect destination device address or destination device not on the network The communication service cannot be performed Verify that the destination device address is correct and that the destination device is functioning properly Ping the destination device to check that it is present on the network The network throughput cannot keep up with the traffic generated by the application This condition can occur when the intervening network components between the application devices cannot handle the volume of network traffic causing network packets
134. cape cannot show fault extra data for selected faults To hide the fault extra data uncheck the Show All checkbox and again press the Refresh PLC Fault Table button 10 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A I O Fault Table Viewer Page The IO Fault Table web viewer page displays the contents of the I O Fault Table 10 Fault Table Microsoft Internet Explorer provided by GE Infrastructure File Edit View Favorites Tools Help Q sax amp x a EA pa Search S e Favorites 2 i2 z E 33 Address 4 http 10 10 0 11 io_fault_tables htm Links gt AA IC693CPU37X PLC I O Fault Table Viewer PLC Name PLC Time 02 18 2000 23 28 14 View Reference Tables View PLC Fault Table Refresh I O Fault Table Fault Extra Fault Extra Total Faults 0 Data Data Fonnat Total Faults Displayed 0 eyt yte Entries Overflowed Table Last Cleared MM DD YY HH MM SS 00 00 2000 00 00 00 C show all O word PLC Date Time During Last Update MM DD YY HH MM SS 02 18 2000 23 28 14 Oasc VO Fault Table Location Cire Ref Addr Fault Category Fault Type Date Time Internet The fault extra data can be shown or hidden by clicking on a fault The fault extra data for all faults in the table can be displayed by selecting the checkbox at the top of the page labeled Fault Extra Data To change the format of the fault extra data select the appropriate
135. cations Request is triggered when the logic program passes power to the COMMREQ Function Block COMM REQ Enable Command Block address Function Faulted logic Rack Slot Location of the Ethernet Interface Task value Each of the inputs and outputs are discussed in detail below It is important to understand that the Command Block address points to the location in memory you have setup as the Command Block Enable Control logic for activating the COMMREQ Function Block See Section 5 for tips on developing your program IN The location of the Command Block It can be any valid address within a word oriented area of memory R AI WAQ P or L for the Ethernet interface SYSID A hexadecimal word value that gives the rack high byte and slot low byte location of the Ethernet interface The CPU374 PLUS and CPU372 PLUS require a hex word value of 16 0001 indicating Rack 0 Slot 1 TASK For the CPU372 PLUS and CPU374 PLUS Ethernet interface TASK must be set to 21 decimal 0015H Entering an incorrect TASK value may cause the Ethernet interface to fail FT Output The FT output is set if the PLC CPU rather than the Ethernet interface detects that the COMMRE fails In this case the other status indicators are not updated for this COMMREQ GFK 2382A Modbus TCP Client 8 5 The COMMREQ Command Block When the COMMREQ function is initiated the Command Block is sent from the PLC CPU to the Ethernet inter
136. ced Exchange Name ProdExch1 Exchange ID 1 Adapter Name 01 Group ID Destination 0 Produced Period 200 Reply Rate to Destination Type InfoViewer 0 1 IC693CP ProdExch1 3 16 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Each exchange has its own variable list These variables contain the data that is produced to the network Each variable contains the following information Offset The location within the data area for this exchange where the start Byte Bit of the data for this variable is located The offset is expressed as Byte Bit where Byte is a zero based byte offset and Bit is a zero based bit position within that byte Valid bit values are 0 7 Bit 0 is the least significant bit within the byte bit 7 the most significant Variable The name defined for this variable It may be an existing variable or it may be defined using the variable declaration facilities of the programmer such as the variable list in the Navigator Ref Address The PLC memory reference address that contains the start of the data for this variable Ignore Not used for Produced exchange Length Size of the data for this variable expressed in units of the data type Type Data type of the variable Description An optional text description of this variable To add a new variable to the end of the ex
137. ced user parameters AUP be sure that you know the characteristics of the link partner and are aware of the consequences of your selection Setting both the speed and duplex AUPs on an IC698 Ethernet Interface port will disable the port s auto negotiation function If its link partner is not similarly manually configured this can result in the link partner concluding an incorrect duplex mode In the words of the IEEE standard Connecting incompatible DTE MAU combinations such as full duplex mode DTE to a half duplex mode MAU or a full duplex station DTE or MAU to a repeater or other half duplex network can lead to severe network performance degradation increased collisions late collisions CRC errors and undetected data corruption Note If both speed and duplex mode of an Ethernet interface port are forced using the Advanced User Parameters file that port will no longer perform automatic cable detection This means that if you have the Ethernet interface port connected to an external switch or hub port you must use a crossover cable If you have the Ethernet interface port connected to the uplink port on an external switch or hub or if you have the Ethernet interface port directly connected to another Ethernet device you must use a normal cable GFK 2382A Chapter 2 Installation and Startup 2 7 Connection to a 10Base T 100Base Tx Network Either shielded or unshielded twisted pair cable may be attached to a port The 10Base T
138. change click the Add button This does not change the data offsets of any existing variables within that exchange To insert a new variable among the existing variables click on an existing variable When you click the Insert button a new variable will be created ahead of the selected existing variable This changes the data offsets of all following variables in the exchange and will change the signature major number if you are using signatures Once a new variable has been entered double click a data field within the row to edit that value To delete an existing variable click on the variable row and then click the Delete button If you are using signatures this will cause the signature major number to change Up to 100 variables may be configured for an exchange The sum of the length for all variables in the exchange must not exceed 1400 bytes The total length of the exchange is displayed as Length Bytes above the variable list A variable is automatically created for the local exchange status that is returned to the PLC logic application The exchange status is not part of the produced exchange data and is not available to the network GFK 2382A Chapter 3 Configuration 3 17 Configuring an Ethernet Global Data Exchange for a Consumer To create a new consumed exchange right click the Consumed Exchanges node and select New A dialog box lists all produced exchanges in the EGD network that have bee
139. changes that are not being used by a consumer Producing data that is not being consumed is not necessarily an error the consumer may not be able to publish its information to the EGD configuration server or the application design may have chosen to publish data that is not needed immediately However each unconsumed variable may be an indication of an error or oversight in one or more consumers in the application Looking at the Entire EGD Network The EGD Management Tool can be used to display information about the entire EGD network both offline and online to that network You can launch the EGD Management Tool by right clicking on the Ethernet Global Data node in the Navigator and selecting Launch EGD Management Tool The EGD Management Tool opens in separate frame It allows you to visualize analyze and debug an EGD network See Chapter 9 Diagnostics for more information on the online capabilities of the EMT Also see the EMT online help for information about running the EMT 3 20 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Installing the EGD Generic Device Editor Some devices for example certain Ethernet NIUs cannot be configured using the EGD configuration server Configuration tools for third party devices that support Ethernet Global Data may not support the EGD configuration server Rather than not using the EGD configuration server in applications that contain these devices th
140. commands CAO5H CA85H Device is write protected CBO5H CB85H A communications or write verify error occurred during save or restore CCO05H CC85H Data stored on device has been corrupted and is no longer reliable CDO5H CD85H Attempt was made to read a device but no data has been stored on it CE05H CE85H Specified device has insufficient memory to handle request CFO5H CF85H Specified device is not available in the system not present D105H D185H Packet size or total program size does not match input D205H D285H Invalid write mode parameter D505H D585H Invalid block name specified D605H D685H Total datagram connection memory exceeded D705H D785H Invalid datagram type specified D805H D885H Point length not allowed D905H D985H Transfer type invalid for this Memory Type selector DAO5H DA85H Null pointer to data in Memory Type selector DBO5H DB85H Invalid Memory Type selector in datagram DCO5H DC85H Unable to find connection address DDO5H DD85H Unable to locate given datagram connection ID DEO5H DE85H Size of datagram connection invalid DFO5H DF85H Invalid datagram connection address continued 11 16 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Minor Error Codes for Major Error Codes 05H at Remote Server PLC and 85H at Client PLC Continued from previous page Error Status Hexadecimal Enoi Description
141. connection Under heavy load at the Ethernet interface the programmer may experience sluggish response over this non privileged connection If this occurs the user can manually disconnect and reconnect the programmer after the previous connection has timed out Upon reconnection the programmer should once again obtain the privileged connection EGD Command Session Conflicts EGD Commands support only one pending EGD command from a client device to each server device Attempts to issue a second EGD command from a client to the same server before completion of the first command will result in an error Some examples are 1 The logic application issues a second EGD Command COMMREQ to the same remote server perhaps from a different location in the logic program 2 The EGDCMD Station Manager command issues a command to the same remote server device as the logic application 11 34 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A SRTP Request Incompatibility with Existing Host Communications Toolkit Devices or Other SRTP Clients The Advanced User Parameter AUP named chct_comp provides greater compatibility with existing Host Communication Toolkit devices Some Host Communication Toolkit devices generate incorrectly encoded SRTP messages In some cases the Series 90 30 PLUS enhanced Ethernet interface can detect and report SRTP encoding errors that were ignored by previous Series 90 Ethernet i
142. consumption period as set in the CPU364 configuration is copied to the CPU374 configuration and is made read only If you choose No E All parameters other than SNP ID and the editable Memory tab parameters are set to their default values E EGD exchanges are deleted Note CPU374 Hardware configurations created within Machine Edition before the 374 was released need to be updated in order to access the web server and FTP features A replace operation in PME can be used 3 22 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Chapter Ethernet Global Data 4 This chapter describes basic Ethernet Global Data features of a Series 90 30 PLUS enhanced Ethernet interface Ethernet Global Data Operation EGD Exchanges The Content of an EGD Exchange The Data Ranges Variables in an EGD Exchange Valid Memory Types for Ethernet Global Data Planning Exchanges Using Ethernet Global Data in a Redundancy System Sending an Ethernet Global Data Exchange to Multiple Consumers Multicasting Ethernet Global Data Broadcasting Ethernet Global Data Ethernet Global Data Timing Configurable Producer Period for an EGD Exchange Consumer Update Timeout Period EGD Synchronization Timestamping for Ethernet Global Data Exchanges Effect of PLC Modes and Actions on EGD Operations Valid PLC Memory Types for Ethernet Global Data Monitoring Ethernet Global Data Exchange Status
143. ction is open it is unavailable to the rest of your application and The active TCP connection uses up network bandwidth because the active TCP connection generates a small amount of ongoing periodic network traffic How To Re Task a Channel 1 For Establish Read Write Channel Commands set the number of repetitions COMMREQ Word 9 to 2 and set the read write period COMMREQ Words 10 and 11 to be longer than the expected time between transfers For example if you expect to transfer data about once per minute set the read write period to about two minutes This will cause a TCP connection to be created and held open for two minutes 2 Setup the ladder program to A Issue the first COMMREQ and wait for the first transfer to complete which will be indicated when the COMMREQ Status CRS word is changed to 1 B Then before the read write period expires at which time the second and final transfer is sent and the TCP connection is dropped issue the next COMMREQ with the same parameters as specified in step 1 This will re task the channel to use the existing TCP connection instead of opening a new one and will send another data transfer restarting the timer for the read write period Repeat step 2B for each successive data transfer desired 6 28 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A iG Client Channels TCP Resource Management There is a period of time that the OS Netwo
144. ctivating the COMMREQ Function Block IN The location of the Command Block The Command Block contains the parameters of the COMMREQ request It can be located at any valid address within a word oriented memory area R AI or AQ in the PLC SYSID A hexadecimal word value that gives the rack high byte and slot low byte location of the CPU module For the CPU372 PLUS and CPU374 PLUS this must be Rack 0 Slot 1 0001H TASK For the CPU372 PLUS and CPU374 PLUS Ethernet interface Task must be set to 21decimal 0015H FT Output The FT output is set if the PLC CPU is unable to deliver the COMMREQ to the Ethernet interface When the FT output is set the Ethernet interface is unable to return a COMMREQ status word to the PLC logic application 5 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A COMMREGQ Status for the EGD Commands Words 3 and 4 of every COMMREQ Command Block specify a memory type and location to receive status information about the execution of the command Word 3 specifies the memory type for the COMMREQ status word The memory types are listed in the table below Type Value Value Description Decimal Hex R 8 08H Register memory word mode AI 10 OAH Analog input memory word mode AQ 12 OCH Analog output memory word mode l 16 10H Discrete input memory byte mode 70 46H Discrete input memory bit mode
145. d Remote Exchange a Word 9 Most Significant Byte 0 0 Ba olololo 0 mask Word 10 Most Significant Byte ofo 0 ojlojojojo data State to set the aes 5 18 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Chapter Programming SRTP Channel Commands 6 This chapter describes how to implement PLC to PLC communications over the Ethernet network using SRTP Channel commands SRTP Channel Commands Channel Operations Aborting and Re tasking a Channel SRTP Channel Commands in a Redundant System Executing a Channel Command COMMREQ Format for Programming Channel Commands Establish Read Channel Establish Write Channel Send Information Report Abort Channel Retrieve Detailed Channel Status Programming for Channel Commands COMMREQ Example Sequencing Communications Requests Managing Channels and TCP Connections Use Channel Re Tasking to Avoid using up TCP Connections Client Channels TCP Resource Management SRTP Application Timeouts Monitoring Channel Status New Features of SRTP Channels SRTP Channel commands are supported by the enhanced Series 90 30 PLUS Ethernet interface Note This feature is not available in CPU374 versions prior to Release 12 00 GFK 2382A 6 1 s SRTP Channel Commands The SRTP Channel commands are a set of client PLC commands that can be used to communicate with a server PLC
146. d 9 00022 0016 Modbus Function Code Write Mask Register Word 10 00200 00C8 Address in the Remote Device Word 11 00001 0001 AND Mask Word 12 00000 0000 OR Mask Word 13 00001 0001 Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Mask Write Register operation on remote Modbus TCP device Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Function Code 22 Mask Write Register Word 10 Remote Device Address specifies the destination register in the remote device Word 11 AND Mask Word 11 specifies the AND mask to be used in the Mask Write operation For this example all bits are cleared except bit 0 Word 12 OR Mask Word 12 specifies the OR mask to be used in the Mask Write operation In this example no bits are to be set Word 13 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block 8 22 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Read Write Multiple Registers to from a Modbus Server De
147. d Vansties PANN 2004 0303 201337 2 2040 Hetty 2 ase DES 2 ji A RAN 7 RSO 20040303201237 2 2040 Heakhy 2 20865 120249 2 ESR Test Full Devier Name TZI al 2f ENIU 7603 20W00810 1400 A 72MM Hesty 5 MEZI eT o Fi CPUI74_OIT 7605 2004 09 00 20 4225 2 7222040 Hesty 2 21191 63015 0 i 4 m 004 0908 204225 2 2 7170 ERL D CPU364_DIT 7805 2004 0908 20 41 24 20 ma 1897 0 CPU264_OIT 5106 2004 09 00 20 41 24 2 2 20175 19914 0 VMENIU 1 20040820194259 20 40 35128 37748 D URGE 3 200107 061544 38 A n2 10567 are 0 ComboeTen ikVle 7616 2004 02 16 11 16 38 2004 10 17 22 2 2 22040 pier 0 Fug 2004 0216 11 1639 20 letting amp 10600 31649 D Fup2 2004 0216 11 16 39 2004 10 17 22 20 5 130 MBTI 0 Active Conhgaation Server EGD Server Onkne EGO Server 172131 1 25 Miror Server C Progam Fies GE Inductnal Systems E GD Managernert Toof MaroCache The statistics data for each exchange has the following information Exchange the name of the exchange as it is stored in the EGD configuration server Configuration Time the date and time that the configuration for the exchange was created Due Time the date and time that a sample is due For a produced exchange this is the time that the next sample will be produced For a consumed exchange this is the time at which the exchange will time out if data is not received Status information about the status of the exchange For a produced exchange status will be Producing if the exchange is actively b
148. d all PACSystems controllers It does not include prior versions of the Series 90 30 CPU374 or most other GE Series 90 PLCs When the EGD Management Tool is used online it periodically sends Ethernet Global Data commands to each device This may have a performance impact on the network and the devices on the network Before using the EGD Management Tool in a production environment be sure to assess the performance impact of its use on your application Monitoring Status of Ethernet Global Data for a Device The EGD Management Tool can display detailed information for each exchange in an EGD Class 2 device Selecting the Exchanges node for the device in the navigator pane will display the list of exchanges for the device Configuration Summary Selecting the Configuration Summary tab displays information about the exchanges defined in the device EGD System EGD Management Tool sini x Eile Edit view Options Help Haxe Configuration Summary Online Statistics Elie EGD System Exchange ProducerID Destination Mode Type Configuration Time Signatur Length Period Gq ComCoeTestMkVle 1 H B CPU_S070_EX 172 Referencelmplementation122 172 131 1 22 172 131 1 1 Unicast Producer 2004 10 15 19 47 31 1 1 100 500 m CPU364_DIT 172 12 Referencelmplementation 222 172131 1 22 172 131 1 2 Unicast Producer 2004 10 15 19 49 40 4 0 100 500 m CPU374_DIT 172 12 Referencelmplementation 522 172 1
149. d as zero the default value of one second is used Word 9 Bit Mask Words 9 10 specify the individual data to be written to the remote EGD exchange The usage of the Bit Mask and Data are described in Masked Write to EGD Exchange Bit Mask and Data Bits below Word 9 contains a bit mask that identifies a bit or bits within a data byte The mask bit corresponding to each data bit to be written is set to 1 all other bits are set to 0 Word 10 Data Word 10 contains the data byte that contains the bit or bits to be written to the remote EGD exchange The individual data bits to be written are in the same position as the 1 bits in the Bit Mask Word 9 Word 11 Remote EGD exchange Exchange Signature Words 11 contains the 16 bit exchange signature value to be compared at the remote EGD device For remote PLC s the exchange signature should ordinarily be set to 0 Words 12 13 Remote EGD exchange Producer ID Words 12 and 13 contains the 32 bit Producer ID of the desired exchange at the remote EGD device Word 12 contains the least significant 16 bits of the Producer ID word 13 contains the most significant 16 bits Words 14 15 Remote EGD exchange Exchange ID Words 14 and 15 contains the 32 bit Exchange ID of the desired exchange at the remote EGD device Word 14 contains the least significant 16 bits of the Exchange ID word 15 contains the most significant 16 bits For the Masked Write EGD Command the exchange at
150. device Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 7 Read Exception Status Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interface will store data received from the remote device Valid values for Word 10 are listed on page 8 14 Word 11 Local PLC Memory Address Word 11 determines the starting address in the local PLC in which the data from the remote device is to be stored The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 10 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Be sure this area is large enough to contain the requested data without overwriting other application data Word 12 Reserved Word 12 is reserved and must be set to zero Word 13 Data Size Word 13 is the data size and must be set to 1 Word 14 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block 8 16 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Command 3
151. dress Word 16 must contain the value 1 This indicates a dotted decimal IP address expressed using a separate register for each decimal digit Word 17 Remote PLC Network Address Length Word 17 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block Word 17 must contain 4 Words 18 21 Remote PLC IP Address Words 18 21 specify the four integers one integer per word of the dotted decimal IP address of the remote PLC to be accessed Note The Write PLC Memory command can only be sent to a GE PLC server GFK 2382A Chapter 5 Programming EGD Commands 5 9 Read EGD Exchange 4002 The Read EGD Exchange command can be used to read some or all of a configured Ethernet Global Data exchange from either the producer or the consumer This command identifies the data to be read using its configured Producer ID and Exchange ID It can then read the content of the data for the exchange directly from the producer or consumer device memory This command can be sent to other CPU372 PLUS or CPU374 PLUS modules with enhanced Ethernet interface PACSystems PLCs and to other EGD Class 2 devices In a CPU372 PLUS or CPU374 PLUS reading an EGD exchange reads the PLC reference memory locations configured to be transferred at the specified offset in the exchange Thus current process data is read not the data that was transferred last in the exchange Read EGD Exchange Command Block
152. e In the example logic that follows the input values for the Block Move Functions are taken from the Establish Read Channel 2003 command Example 1 in this chapter Nicknames are used in this example to make the ladder program easier to follow LANIFOK is bit 16 of the LAN Interface Status bits All other nicknames can be assigned as needed 6 24 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A GFK 2382A LANIFOK LAN_OK LAN_OK READREQ 1 H BEGREAD i i i i i i READREQ 1 it LAN_OK READREQ HOVE i i i i FAULT 1 H 1 H akin RH 1 o4IN gf xR00010 _ R00010 LAN_OK READREQ 1 H 1 17 R00301 00308 8 OQ R00315 R00301 400308 _ R003215 o 50 8 8 3 1 0 4 o 10 2003 o l Qf R003222 4R00322 LAN_OK READREQ m R00301 ROOSOL Chapter 6 Programming SRTP Channel Commands 6 25 Rung 1 Input LANIFOK bit 16 of the LAN interface Status bits monitors the health of the Ethernet interface If it is OK to send a COMMREQ the LAN_OK coil is ON LAN_OK is used as an interlock for Rungs 3 6 Rung 2 Input BEGREAD triggers READREQ which enables execution of the MOVE and COMMREQ functions READREQ is a one shot Positive Transition coil activating once when BEGREAD transitions from OFF to ON Rung 3 The MOVE WORD function moves a zero to the COMMREQ status word referenced in the Command Block se
153. e Most error conditions involving the Ethernet interface generate faults in the PLC Fault table The table on the next two pages lists Ethernet interface faults and corrective actions To access the details of a PLC Fault Table entry double click the Fault Table entry and the details are displayed as fault extra data Refer to Online Help in the PLC programming software for more information An example of the fault extra data is shown below 160006000300050000000000000000000000000000000000 ie I I For the Ethernet interface the leftmost 14 digits of fault extra data underlined in the example above show the corresponding log Events 2 digits and Entries 2 3 and 4 in that order 4 digits each The example above is reporting an Event 16 Entry 2 6 Entry 3 3 and Entry 4 5 This information can be used to refer directly to detailed fault descriptions included in the Exception Log Event tables in GFK 2383 TCP IP Ethernet Communications for Series 90 30 CPU372 PLUS and CPU374 PLUS Station Manager Manual In that document refer to Appendix B Exception Log Events PLC Fault Table Descriptions Backplane communications with Check to make sure that the logic application is not sending PLC fault lost request COMMREQs faster than the Ethernet Interface can process them Reduce the rate at which the application is sending COMMREQs to the Ethernet interface If problem persists contact GE Intelligent Platforms Bad local a
154. e can process them Reduce the rate at which COMMREQs are sent Unsupported feature in PLC firmware does not support Ethernet communications software or configuration attempt has been made to configure a feature not supported by the Ethernet Interface Check CPU and Ethernet Interface revisions order upgrade kit for CPU and or Ethernet Interface Can t locate remote node A specified remote device does not exist on the network Check that the discarded request remote device IP address is correct and that the remote device is functioning properly Mailbox Queue full COMMREQ The CPU is attempting to send COMMREQs faster than the Ethernet aborted Interface can receive them The PLC logic program should retry the COMMREQ after a short delay If the condition persists the logic application should be revised to reduce the rate at which it sends COMMREQs to the Ethernet Interface Non critical CPU software event The CPU is attempting to send mail messages faster than they can be retrieved by the Ethernet Interface the messages are discarded This can result in subsequent Backplane communications with PLC fault lost request faults GFK 2382A Chapter 11 Diagnostics 11 9 Monitoring the Ethernet Interface Status Bits The Ethernet Interface Status bits normally occupy a single block of memory The memory location is specified during configuration of the Ethernet interface The status bits are updated in the CPU once each PLC scan by t
155. e rung 4 This clears the COMMREQ status word This rung also resets the FT output coil of the COMMREQ Function Block in rung 6 It is vital that the COMMREQ status word be cleared and the COMMREQ fault output coil be cleared each time before initiating a COMMREQ function Rungs 4 5 The BLKMV INT functions set up the COMMREQ Command Block contents When these rungs are activated the constant operands are moved into the memory beginning at the address indicated in the instruction The constant operands in this example are defined in the Establish Read Channel Example in this chapter Rung 6 The COMMREQ Function Block The IN field points to the starting location of the Command Block parameters R00301 in this example The SYSID field of the COMMREQ function block defines the rack and slot of the Ethernet interface to receive the command data This is a hexadecimal word value that gives the rack high byte and slot low byte location of the Ethernet interface module In the example ladder diagram shown the first three number places from left to right are zeros and are not displayed only the last number 4 appears This indicates rack 0 slot 4 For CPU372 or CPU374 you must use rack 0 slot 1 0001H or simply 1 The TASK field of the COMMREQ function block indicates which mailbox task ID to use for the specified rack and slot For CPU372 or CPU374 this value should always be 21 decimal 0015H The FT output ener
156. e sure cables are connected f using a switch make sure the switch is turned on AB90H A COMMREQ was discarded because the application program issued the COMMREQ before the COMMREQ Status Word for the previous COMMREQ was set AC90H A protocol error occurred while communicating with the local PLC AD90H A TCP Timeout occurred while communicating with the Remote PLC AE90H A protocol error occurred while communicating with the local PLC BO90H Network Address name length error The name cannot exceed 31 ASCII characters and must be terminated with a NUL character zero B190H Specified Network Address name could not be resolved into an IP address B390H Internal name resolution error See PLC Fault Table or exception log for details B490H The channel the application is trying to open is already open by Modbus TCP Client B590H The channel the application is trying to access is owned by a different protocol B690H Invalid Modbus Function Code B790H Invalid Unit ID FF9OH Abort in Progress on a Channel 11 22 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Minor Error Codes for Major Error Code 91H Remote Modbus TCP Server Device Pine seca I Error Description 0191H Illegal Function The function code received in the query is not an allowable action for the server 0291H Illegal Data Address The data address received in the query is not an allowable address for the server The combination
157. eeeeeeeeeeteee 11 32 EGD Configuration Mismatch Errors ccccccccesseeeeeeeneeeeeenaeeeeeeneeeeeennaeeessenaes 11 33 Station Manager Lockout under Heavy LOad ccceceeeeeeeeeeeeeeneeeeeeteeeeeenaees 11 33 PING RestrictloniSis tcs endothe niche teenth een RR 11 33 SRTP Connection Timeout se iee ar E A A ENE eiS 11 34 Sluggish Programmer Response after Network Disruption ceeeeeeeeee 11 34 EGD Command Session Conflicts 20 0 0 cceeeeeeeeeeeeeeeeeneeeeeeeaeeeeseenaeeeeeeneeeeneaes 11 34 SRTP Request Incompatibility with Existing Host Communications Toolkit Devices or Other SRTP Clients su agate Aieteednarl akdar aide iad t i aas 11 35 COMMREQ Flooding Can Interrupt Normal Operation 0 ccceeeeceeeeeees 11 35 Accelerated EGD Consumption Can Interfere with EGD Production 11 35 Configuring Advanced User Parameters ccccseeccesseeeeeeeeseeneeeeeeeeeeeeenseeeeeeeeneeenaees A 1 The AUP Bile act canta eae eae ee nas anniv A 2 Assigning an AUP File to the CPU372 PLUS or CPU374 PLUS oieee A 3 Format of the Advanced User Parameters File cc cccceceeceeeeeereeeeeeneeeeetnieeeeeesneeeeeeaa A 4 Advanced User Parameter Definitions 00 ccceeeseeeeeeseneeeeeeneeeeeeettaeeeeesneeeeeenaeeeeneaes A 5 GFK 2382A Contents ix Chapter Introduction 1 This manual describes the enhanced Ethernet features of the IC693CPU372 PLUS and IC693CPU374 PLUS release 12 00 and later S
158. eeeeseeneeeeeeenaees 6 29 SRTP Application Timeouts cccceecsecceceeeeeeeeeeceneaeceeeeeseeecneaeeeeeeeeeesecsaceeeeees 6 29 Monitoring Channel Stals erroria A AEA AN ET 6 30 Format of the COMMREQ Status WoOMd cccceceeeeeeeeceeeeeeeeeesecenaeeeeeeeeeteees 6 30 New Features of SRTP Channels cccccceeecceeceeeeeeeeeeeeeaeeeeeeeeeseceeceeeeeeeeeeseteesaeas 6 31 MoabDUS TCP SOIver ssisc fcc cars cans dee sescec A 7 1 Modbus l CP Seer nne eaan tte ane a Soaepatned tears E A aL Tera ARSS 7 2 Modbus TCP Server Connections cccceceececeee cece eeeeecnaeeeeeeeeeseeecnaeeeeeeeeneeeeeees 7 2 Modbus Conformance Classes ccccccceeeeeeceeceeeeeeeeeeeecneaeeeeeeeeesecsaaeeeeeeeeeteees 7 2 Server Protocol ServiCes ccccccceceescecececeeeeeseeaeaeceeeeeeeseeeaeseeeeeeeseesscnineeeeeeess 7 2 Station Manager Suppolt cccceccecccceceeceeeeeeeeeeeeceeeeeeeseeaeaeceeeeeeeeseesecieeeeseess 7 2 Reference Mapping seh cestetens etext a cael cherie oleae eter alel Nia etn ad 7 3 Modbus Reference Tables c c cccecceceeeeeeeeeneeeeeeeee cess aaeeeeeeeeesesececiaeeeeeeeseeeees 7 3 Address Configuration sisirin e ul tag ian ended bee ered anaes 7 4 Modbus Function Codes ccccccceccccecceceeeee cece ecaeceeeeeegeecaaeaaececeseeesesaanaeeeeeeeeeesnsaneeeeeeees 7 5 Mod bus TCP Cleta aanne kanuna eaen naana naaa a Aaa D aAA aa aAa AANA Enka ok ainiaan Eaei
159. eeeneeeeeeaeees 8 11 Write Data to a Modbus TCP Device 3004 0 eeceeeeneeeeeenneeeeeeeneeeeettaeeeeeenaes 8 18 Mask Write Register Request to a Modbus Server Device 3009 cceeee 8 22 Read Write Multiple Registers to from a Modbus Server Device 3005 8 23 Status Datasets Ad ec reat ots A cat ot end oes Ss ceils wea eds esi mad Se Aiea ls foaled 8 25 Types of Status Dalaran teach tie entice ca eet ea ete 8 25 Description of the Status Data cccccecceeeececcneceeeeeeeeeeeeeeaeeeeeeeeesecsicaeeeeeeeeenees 8 26 Communications Statys WOrdS ccceeeceeeeeeeeeecneeeeeeneeeeeecaeeeeeeenaeeeeeeneeeeeeaes 8 27 Controlling Communications in the Ladder Program c csecceceeeeteeeeeeeeeeeeeeneeeeeeaes 8 28 Essential Elements of the Ladder Program cccceceeeeseeeeeeeteeneeeetenneeeseenaeees 8 28 COMMREQ Example tice ae ee Bi ee ees 8 29 Troubleshooting a Ladder Program ccccceeecceeeeeeeeeeeeeeeeeeeeecneeeeeeneeeeetnaeeeeeteaes 8 35 Monitoring the Communications Channel c ccccceeeeeeeeeeeeeeeeeeneeeeeseenaeeeseenaeees 8 36 Sequencing Communications Requests cceccececeeeeeeeeeeeceeeeeeeeseeennteaeeeeeees 8 36 Differences between Series 90 30 PLUS and Series 90 Modbus TCP Channels 8 37 Network Administration inc iiieieiiecectacadacdssniadencennnieeuiieiidaadiladedanditaiitandesnnsaeindewednaiadeas 9 1 IP AGArESSING feeeesssns ios BAS ates asd
160. eft The EGD Management Tool displays devices and networks based on the configuration information in the EGD Configuration Server for the machine it is running on Using the GFK 2382A Chapter 11 Diagnostics 11 25 options menu you can configure the server information much as you do for the programming tool and also set options for the online operation of the tool Be aware that changing the server configuration will change it for all tools running on that machine including the programming software In addition to the online operations described below the EGD Management Tool has a number of offline capabilities such as View Reports for doing analysis of the Ethernet Global Data configuration See the EGD Management Tool help for more information Monitoring EGD Devices The EGD Management Tool monitors the devices on the Ethernet Global Data network provided it has access to that network To have access to the EGD network the computer running the EGD Management Tool must have a Network Interface Card that connects to the EGD network Consult with your local network administrator if you need help connecting the computer to the Ethernet Global Data network The screen below shows the EGD Monitoring Tool connected to and monitoring an EGD network 2 EGD System EGD Management Tool File Edit yiew Options Help aex r aaas ze EGD System z REEERE E A ComCoeTestMkVle 172 1311 ComCoe CPU364 CPU374 ENIU Fuji iFIXHML PE H
161. eing sent to the network and Pending if the exchange is defined but not producing A Pending status may indicate that the controller has its I O disabled thus stopping the production of EGD For a consumed exchange status will be Healthy if no timeout has occurred for the exchange and Unhealthy if the exchange is timed out Length the byte size of the data for the exchange 11 28 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Message Count the number of samples transferred on the exchange Missed Count the number of samples that were missed on the exchange Missed samples may indicate issues with the underlying Ethernet network or overloading of the consuming device Refresh Errors the number of timeouts that have occurred for a consumed exchange Produced Variables Expanding the Exchanges node in the navigator pane displays the list of exchanges for the device as recorded in the EGD Configuration Server Selecting an exchange brings up a list of variables for that exchange as shown below This can be used to look at the details of the data for an exchange GFK 2382A EGD System EGD Management Tool File Edit View Options Help la x Be Exchanges t Reference eferencelmplementation 122 Referencelmplementation 222 Bh Referencelmplementation 522 T Referencelmplementation 622 Referencelmplementation 2122 BK Referencelmplementation 5122 9 Refe
162. ent Connection is sent to a channel that is already closed a success CRS value of 1 will be returned 8 10 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Read Data from a Modbus TCP Device 3003 The Read Data from a Modbus TCP Device COMMREQ requests a data transfer from a Modbus TCP device to the PLC The Read Data COMMREQ must reference an active Modbus TCP channel previously established with the Open Modbus TCP Client Connection COMMREQ Registers Coils or Exception Status data may be read from the remote Modbus TCP device The Modbus Function Code specifies the data type Valid Function Codes for the Read Data COMMRE Q are presented in the following table Function Description Modbus Server Data Unit Maximum Data Code Memory Region Size Units Accessed Read Coils Internal Bits or Bit 2000 Physical coils Read Input Physical Discrete Bit 2000 Discretes Inputs Read Multiple Internal Registers Register 125 4 Registers or Physical Output 16 bit Registers Word Read Input Physical Input Register 125 Registers Registers 16 bit Word Read Exception Server Exception Byte Not Applicable Status Memory Read FIFO Queue Internal Registers Register 32 or Physical Output 16 bit Registers Word The table above describes the general Modbus server memory areas The actual memory accessed is dependent on how the server maps the Modbus memory regions to the server s local memory 1
163. ent to Series 90 30 PLUS PLCs to PACSystems PLCs and to other EGD Class 2 devices In a Series 90 30 PLUS CPU writing an EGD exchange modifies the PLC reference memory locations configured for transfer at the specified offset in the exchange Thus current process data is updated not the data that was transferred last in the exchange Write EGD Exchange Command Block Word Offset Value Description Word 1 Length of command data Always 25 block Word 2 0 Always 0 no wait mode request Word 3 See table on page 5 3 Memory type of COMMREQ Status Word Word 4 0 based Offset of COMMREQ Status Word Word 5 0 Reserved Word 6 0 Reserved Word 7 4003 fa3H Write EGD Exchange command number Word 8 Retry time in milliseconds The time between retries of command transfers in 10 millisecond increments Default is 1000ms Word 9 Local write buffer memory Memory type for the data in the local PLC type Word 10 Local write buffer reference 1 based offset Word 11 table starting address Word 12 Remote signature EGD Exchange signature This should be 0 for PLCs Word 13 Remote Producer ID EGD Producer ID Word 14 Word 15 Remote Exchange ID EGD Exchange ID Word 16 Word 17 Remote Exchange Offset Byte offset 0 based in the exchange that should be read Word 18 Write length Number of bytes to be written in the range O to 1400 bytes Word 19 Network address type Must be 1 Indicates an
164. erage sweep time When the Ethernet interface s producer period expires it produces the data sample from shared internal memory onto the network When the Series 90 30 PLUS is the consuming PLC shared internal memory is updated as soon as the Ethernet interface gets a data sample from the network There is no configurable consumer period The CPU updates its reference tables from shared internal memory at the end of the sweep after it is notified by the Ethernet interface that fresh data has arrived for a specific exchange The data is made available to the application on the next PLC sweep after it is received Some other types of Ethernet interfaces implement a consumption period timer EGD Synchronization Ethernet Global Data attempts to provide the most up to date process data consistent with the configured schedule The Ethernet interface maintains a timer for each produced exchange When the timer for the exchange expires the Ethernet interface requests that the data for the exchange be transferred from reference memory during the output scan portion of the CPU sweep At the output portion of the sweep the CPU puts the data into the shared memory Once the data has been transferred by the CPU sweep the Ethernet interface immediately formulates a sample and transfers the sample on the network If updated data is not available at the next production timer expiration the Ethernet interface produces a sample containing the previous data t
165. ere is an alternative that allows the EGD configuration for such devices to be put into the server so that it can be used for consumption and validation in other devices The programmer distribution includes a tool called the EGD Generic Device Editor This tool allows you to describe the EGD configuration of a device and publish it to the EGD configuration server Configuration tools for other devices can use the EGD configuration published by the EGD Generic Device Editor for consumption or validation purposes Installing the EGD Generic Device Editor The EGD Generic Device Editor is not automatically installed when you install the Programmer To install the EGD Generic Device Editor look in the directory where you installed the programmer and you will find a subdirectory named EGD Installs In that directory you will find a file named EgdGenericEditorSetup msi Double click on this file to install the EGD Generic Device Editor Running the EGD Generic Device Editor Installing the EGD Generic Device Editor adds it to the Start Programs menu of the computer s Windows system You will find it under Programs GE Industrial Systems EGD Generic Editor The online help for this tool describes its operation Configuring Ethernet Global Data Without Using the EGD Configuration Server If the EGD Configuration Server is not used each Ethernet Global Data exchange must be configured in both the producer and the consumer To add exch
166. eries 90 30 PLC CPUs Earlier versions of the CPU374 utilize a different Ethernet Interface which is described in the TCP IP Ethernet Communications for Series 90 PLCs User s Manual GFK 1541 Earlier versions of the CPU374 cannot be upgraded to provide these enhanced features Chapter 1 Introduction includes basic information about the operation of the built in enhanced Series 90 30 PLUS Ethernet interface Chapter 2 Installation describes user features and basic installation procedures Chapter 3 Configuration describes assigning a temporary IP address configuring the Ethernet interface configuring Ethernet Global Data EGD and setting up the RS 232 port for Local Station Manager operation Chapter 4 Ethernet Global Data describes basic EGD operation Chapter 5 EGD Commands describes a set of commands that can be used in the application program to read and write PLC data or EGD exchange data over the network Chapter 6 Programming SRTP Channel Commands describes how to implement PLC to PLC communications over the Ethernet network using SRTP Channel commands Chapter 7 Modbus TCP Server describes the implementation of the Modbus TCP Server feature for the Series 90 30 PLUS Ethernet interface Chapter 8 Modbus TCP Client explains how to program communications over the Ethernet network using Modbus TCP Channel commands Chapter 9 Network Administration discusses how devices are identified on the network and how data is ro
167. erminated It takes time to create and to terminate these connections If an application is constructed so that it rapidly and repeatedly establishes a channel with only one repetition one transfer the available TCP connections for the Ethernet interface may be totally consumed A snapshot of the state of the TCP connections would show some of them being created some being terminated and some active but none available If the logic for issuing COMMREQs is constructed so it does the following all available TCP connections can quickly be used up The number of repetitions Word 9 in an Establish Read or Write Channel COMMREQ is set to 1 and Anew COMMREQ is issued repeatedly and immediately upon completion of the prior one GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 27 s Use Channel Re Tasking To Avoid Using Up TCP Connections TCP connections can be used up if each successive COMMREQ is directed to the same target device same IP address In this case it is better to establish a channel with the target device once leave it active then re task the channel even if data transfers take place infrequently This method will use only one TCP connection An additional advantage of re tasking is that the time and network traffic required to create a channel and its associated TCP connection are not incurred each time a data transfer is required The disadvantages to re tasking are While the TCP conne
168. ers it is possible that the generated name for a consumed variable will not be unique This can occur when the target names of producers have the same first seven characters and variable names have the same first 21 characters When the generated variable is not unique the variable in the consumer has an underscore character and a two digit number appended to it to make it unique When not using the EGD configuration server consumed variable names default to ConsExchx where X is a sequential number Synchronizing a Consumed Exchange with Changes in the Producer If a produced exchange is changed it is necessary to reflect these changes in the consumers This can be done very quickly with the EGD configuration server Once the new definition of the produced exchange has been published to the server select the consumed exchange in each consumer right click and select synchronize to server The new definition of the produced exchange is brought in from the server Any variables that have been added to the producer must have reference addresses assigned if they are to be used or they must be selected as ignore No other action is necessary in the consumer Selective Consumption Not all data ranges within a produced exchange need to be consumed by each PLC For example a producer is producing an exchange consisting of a 4 byte floating point value followed by a 2 byte integer followed by a 2 byte analog value If the consuming PLC wa
169. ess expressed using a separate register for each decimal digit Word 19 Remote PLC Network Address Length Word 19 specifies the length in words of the remote PLC IP address Word 19 must contain 4 Words 20 23 Remote PLC IP Address Words 20 23 specify the four integers one integer per word of the dotted decimal IP address of the remote PLC to be accessed Words 24 27 Remote PLC Program Name Words 24 27 specify the case sensitive zero terminated and padded program name also called task name which can be found through the PROG Station Manager command on the server Ethernet interface to be used with access to remote P or L memory These words are required only for access to such memory and will be ignored if the Memory Type field is not P or L See Note below Words 28 31 Remote PLC Program Block Name Words 28 31 specify the case sensitive zero terminated and padded program block name which can be found in the program block declaration in the server ladder program to be used with access to remote L memory These words are required only for access to such memory and will be ignored if the Memory Type field is not P or L Note The Program Name Words 24 27 and Program Block Name Words 28 31 must have each pair of ASCII characters reversed within the PLC memory For example the name MARY M 4DH A 41H R 52H Y 59H would have 414DH in the first word and 5952H in the sec
170. esses used by Ethernet Global Data are GroupID IP Ackkess 1 224 0 7 1 2 2240 72 2 224 0 7 32 Group Multicast IP Addresses used by Ethernet Global Data should not be changed unless the defaults would cause a network conflict If necessary they can be changed within the reserved range of multicast IP addresses 224 0 0 0 through 239 255 255 255 The change must be made using an Advanced User Parameter File Broadcasting Ethernet Global Data The same Ethernet Global Data exchange can be sent to all of the consumers on a subnet by configuring the Produced Exchange to use a Destination Type of Broadcast The Destination of that exchange then changes to the value 255 255 255 255 The Ethernet interface converts this value to the appropriate subnet broadcast mask for this network As with a Group ID each consumer on the subnet can be configured to use some or all of the exchange GFK 2382A Chapter 4 Ethernet Global Data 4 7 Ethernet Global Data Timing The enhanced Ethernet interface utilizes a shared internal memory for Ethernet Global Data operations CPU ETHERNET INTERFACE SHARED INTERNAL MEMORY MEMORY i NETWORK When the Series 90 30 PLUS is the producing PLC the CPU updates its EGD internal memory with a data sample when requested by its Ethernet interface The update affects the length of the PLC sweep only for that particular exchange it has little effect on the PLC av
171. et Global Data node does not appear see the example below right click the PLC target icon PLC1 in this example Select Add Component and then select Ethernet Global Data Flea Series 90 30 PLO1 a Data Watch Lists celle Ethernet Global Data G A Hardware Configuration o f Main Rack IC693CH5391 fe PWR IC69SPWR3Z 1 WL Slot 1 Ic693CPU374 Configuring the EGD Properties 1 To configure the EGD Properties right click the Ethernet Global Data node and choose Properties oe E14 Series 90 30 El PLCI BQ Data Watch Lists eae Consumed Exche Bind and Build E E Produced Exchar Un onsumed DataReport Ef Hardware Configurat Launch EGD Management Tool Eff Main Rack ces Hardware Reference View Report Ctrl T Import from File Export to File Properties Alt Enter Ethemet Global Data tocal Producer D 0 0 0 0 Local Producer ID Number 0 ise CAA So Fetus k a z Work Offline False Colection Series 30 30 EN Network Names E Use ERES A False Be Inspector The Local Producer ID is a 32 bit value that uniquely identifies this Ethernet Global Data device across the network It can either be expressed as a dotted decimal value in the same way an IP address value is specified or specified as an integer number This value defaults to the IP address of the Ethernet Interface w
172. ete output memory bit mode T 20 Discrete temporary memory byte mode 74 Discrete temporary memory bit mode M 22 Discrete momentary internal memory byte mode 76 Discrete momentary internal memory bit mode SA 24 Discrete system memory group A byte mode 78 Discrete system memory group A bit mode SB 26 Discrete system memory group B byte mode 80 Discrete system memory group B bit mode SC 28 Discrete system memory group C byte mode 82 Discrete system memory group C bit mode S f 30 Discrete system memory byte mode 84 Discrete system memory bit mode G 56 Discrete global data table byte mode 86 Discrete global data table bit mode t Read only memory cannot be written to Can only be accessed in the Remote PLC Word 14 Local PLC Memory Starting Address Word 14 determines the starting address in the local PLC in which the data from the remote PLC is to be stored The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 13 This offset will be either in bits bytes or words depending on the mode specified for example if Word 13 16 and Word 14 2 then the starting address will be 19 Valid ranges of values depend on the PLC s memory ranges The user is responsible for assuring that this area is large enough to contain the requested data without overwriting other application data GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 11
173. fH wkal_cnt TCP keepalive probe count 2 0 65535 ffffH wkal_intvl TCP keepalive probe interval in seconds 60 seconds 0 65535 ffffH wsnd_buf TCP send buffer size in bytes 65535 ffffH 0 65535 ffffH wrcv_buf TCP receive buffer size in bytes 4096 1000H 0 32767 7fffH FTP Parameters task t Default Range tpassword Password for login for FTP access system 0 to 8 characters A 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A GFK 2382A A Abort Channel command 2001 6 20 Aborting a channel 6 2 Adapter Name 3 18 Advanced User Parameters A 2 Application Timeout 11 32 AUP file A 2 Backup Configuration Data 3 2 Base Path 3 10 BOOTP 3 5 Broadcasting Ethernet Global Data 4 7 C Cable Ethernet 1 5 Channel Commands 6 2 8 2 Abort Channel 2001 6 20 Channel number 6 10 6 14 6 18 6 20 6 22 8 9 8 13 8 15 8 16 8 17 8 19 8 20 8 21 8 22 8 23 Command period 6 10 6 14 6 18 Establish Read Channel 2003 6 9 Establish Write Channel 2004 6 13 8 11 8 18 8 22 8 23 Modbus TCP 8 3 8 8 Number of repetitions 6 10 6 14 6 18 Retrieve Detailed Channel Status 2002 6 21 Send Information Report 2010 6 17 Timeout 6 10 6 14 6 18 Channel Error bit 6 4 8 36 11 12 Channel Status 6 3 SRTP 6 4 Channel Status bits 6 4 8 2 8 3 Channel Status words 6 21 Aborting 6 2 Establishing 8 8 8 1
174. face The Command Block contains the details of a command to be performed by the Interface The address in CPU memory of the Command Block is specified by the IN input of the COMMREQ Function Block This address can be any valid address within a word oriented area of memory The Command Block is usually set up using either the BLOCK MOVE or the DATA INIT COMM programming instruction The Command Block has the following structure Word 1 Data Block Length words Word 2 WAIT NOWAIT Flag Word 3 CRS Word Memory Type Word 4 CRS Word Address Offset Word 5 Reserved Word 6 Reserved Words 7 and up Data Block Channel Command Details When entering information for the Command Block refer to these definitions Word 1 Data Block Length This is the length in words of the Data Block portion of the Command Block The Data Block portion starts at Word 7 of the Command Block The length is measured from the beginning of the Data Block at Word 7 not from the beginning of the Command Block The correct value for each command and the associated length of each command is specified in the next section Word 2 WAIT NOWAIT Flag This flag must be set to zero for TCP IP Ethernet Communications 8 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A COMMREQ Status Word The Ethernet interface updates the CRS word to show success or failure of the command Command words 3 and
175. face after its last power up restart cycle has never received an SNTP server s timing message it will continue to use the PLC CPU s local clock value that it received at power up restart for its time base If the Ethernet interface has been synchronized to an SNTP server but lost its signal it will use the most recently received SNTP time message as its time base The Ethernet interface continues supplying time values to the PLC CPU for timestamping while it listens for SNTP timing messages from the network If SNTP messages are received later the Ethernet interface synchronizes to them GFK 2382A Chapter 4 Ethernet Global Data 4 13 Effect of PLC Modes and Actions on EGD Operations The configuration and operation of Ethernet Global Data may be affected by the PLC s current mode and by certain PLC actions The normal PLC mode for EGD operation is RUN with Outputs enabled In this PLC mode Ethernet Global Data remains configured and exchanges are both produced and consumed If the PLC mode is set to STOP with I O disabled the Producer ID remains configured but production and consumption stop Note that while consumed data is not transferred to the PLC memory in this mode data from the network is still transferred to the shared memory so that the latest data is available immediately when the PLC transitions out of STOP with I O disabled mode f configuration is lost the Ethernet Global Data configuration must be stored a
176. face does not support multiple levels of login there are no distinct anon or user logins Once successfully logged on you can execute any of the FTP commands described below this login is required in order to store web page files to the Ethernet interface 10 8 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Changing the Password The default FTP password is system You can change the FTP password via a parameter in the AUP file which is stored to the PLC via the programmer or by using the Station Manager Changing the Password from the Advanced User Parameters File The following line should be added to the AUP file to change the FTP password for example to my_ftp_pw tpassword my_ftp_pw Changing the Password from the Station Manager In addition you can change the FTP password for example to my_ftp_pw using the following Station Manager command CHPARM tpassword my_ftp_pw The FTP password can be up to 10 characters long and uses the same character set listed for the reference viewer password described later in this document These passwords are not case sensitive Arguments for Station Manager CHPARM command must be enclosed in double quotes to preserve the capitalization of the argument However since these passwords are case insensitive the double quotes are not required Note The CHPARM command is not available if the PLC has received
177. figuration server This cache is ere ge used if the server becomes inaccessible for example if stents Se eee the server is on another machine and network rca pa communications are lost You can also choose to work Configuation Sever Loca offline from the server and use this cache This mode of operation is explained below Base Path Typically this field should not be changed from the default of EGD This is the path portion of the URL used to get to the server 3 10 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Host Name The host name for the computer on which the configuration server runs This can be specified as localhost if the server is on the local machine Server Port This parameter typically is left at the default of 7938 If changed it must be changed on both the programming software and on the server This value is not stored in the project but is stored in the computer It will be used as the default by other projects created on that computer and by other tools such as the EGD Management Tool that require access to the server Timeout The number of milliseconds the programming software will wait for a reply from the server before deciding that the server is not going to respond Configuration Server This read only parameter displays the value Located if the configuration server can be accessed and Unable to Locate if the server is not accessible E
178. g the COMMREQ Status Word cc ccecceeeeeeeeneeeeeecteeeeeeaeeeseetaeeeeeeeneeeeneaes 11 14 Major Error Codes in the COMMREQ Status Word c cccscceeeseeeeeenteeeeeenaes 11 15 Minor Error Codes for Major Error Codes 05H at Remote Server PLC and 85H at ClienBiREG seteaiekicie E sat bidet aida hated lan elated cet E 11 16 Minor Error Codes for Major Error Code 11H at Remote Server PLC 11 18 Minor Error Codes for Major Error Code 90H at Client PLC 0 ee 11 21 Minor Error Codes for Major Error Code 91H Remote Modbus TCP Server Device 11 23 Minor Error Codes for Major Error Code AOH at Client PLC eee 11 23 Using the EGD Management TOl ec eeeeeeceeeeeeeeeenneeeeeeaeeeseeaeeeseeiaeeeseneneeeeeeaes 11 25 Installing the EGD Management Tool cceeceeeeeeeeeeeeeeeeeeeeeseeeeeeeeeneeeeeeeeaeees 11 25 Launching the EGD Management Tool ccceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeaeeeeeeaaees 11 25 Monitoring EGD DeVICES 2 csscecchecdedecetiedesckechasedestensattecnedeceaecesaueeaeensanteeseaneds 11 26 Monitoring Status of Ethernet Global Data for a Device ee eeeeteenteteeeeees 11 27 Troubleshooting Common Ethernet Difficulties cee eeeeeeeeeteeeeeeeneeeeeeneeeeeeaas 11 30 COMMREG Fault ENOS i 2 s cce0heecdevennccgs e A e A assignee 11 30 PLG Timeout Errors channeled one a A AR 11 31 Application Timeout Errors ccccccceeeeeeeeceeceeeeeeeeeeeeceaeaeeeeeeesecennaee
179. gain Producer ID Configuration Based Exchanges PLC Mode or Action remains continue to be configured Configured Produced Consumed PLC Mode RUN Outputs Enabled RUN SUSPEND I O STOP I O Enabled STOP I O Disabled PLC Action RUN Store Logic YES YES STOP Store Logic YES YES STOP Clear Logic YES YES STOP Config Store Replaced Replaced STOP Clear Config NO NO PLC Power Cycle YES YES Ethernet Interface YES YES Restart Production and consumption is controlled by the PLC Mode as described above 1 RUN SUSPEND 1 0 refers to the SUSIO logic function The DOIO logic function does not affect EGD production or consumption Producer ID and exchange definitions are replaced Producer ID and exchange states depend on the PLC mode and configuration prior to the action 4 14 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Monitoring Ethernet Global Data Exchange Status The Exchange Status word is used to store status information about an EGD exchange A unique Exchange Status word location must be is configured for each exchange The PLC writes status codes into the Exchange Status word whenever an exchange is transferred or a consumer timeout occurs The Exchange Status word is typically set to 1 indicating that when the period expired there was no error condition The application program can monitor for error conditions repo
180. ges A 1C693CPU37X PLC Microsoft Internet Explorer provided by GE Infrastructure File Edit View Favorites Tools Help Back x A D Search Favorites 4 ab W d TAEA E k F Address http 10 10 0 11 v Eco Links IC693CPU37X PLC Home Page View Reference Tables View PLC Fault Table View I O Fault Table Done Internet Factory Default Web Page If the PLC home page file index htm is not present in the Ethernet interface file system the web server instead displays a factory default web page The default web page is displayed in English French German and Spanish if the browser is configured to use Western European encoding 10 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Reference Tables Viewer Page The Reference Tables Viewer page shows the current states of a range of data references This data is a snapshot of the PLC Reference Tables when the data was initially requested It is NOT updated until you refresh the display All the PLC Reference Tables are available reference_tables htm Microsoft Internet Explorer provided by GE Infrastructure File Edit View Favorites Tools Help Q xx Q x El EA JO search JIE Favorites amp P g X 33 Address amp http 10 10 0 11 reference_tables htm IC693CPU37X PLC Reference Viewer PLC Time 02 18 2000 23 26 01 Refresh Table View View PLC Fault Table View I O Fault Table Settings Name R
181. gizes the FAULT coil in this example is turned ON set to 1 if there were problems preventing the delivery of the Command Block to the Ethernet interface In this case the other status indicators are not updated for this COMMREQ 6 26 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A iG Sequencing Communications Requests If the Ethernet interface receives Command Blocks from the PLC CPU faster than they can be processed the Ethernet interface will log an exception event 1Bh Entry 2 000Eh and will log the PLC Fault Table entry Backplane Communications with PLC Fault Lost Request Only one COMMREQ function per channel can be pending at one time A COMMREQ function is pending from the time it is initiated in the ladder program until its COMMREQ status word has been updated to a non zero value by the Ethernet interface If the PLC CPU attempts to send COMMREQs to the Ethernet interface faster than the Ethernet interface can receive them the CPU generates the following entry in the PLC Fault Table Option module software failure The PLC logic program should retry the COMMREQ after a short delay Managing Channels and TCP Connections In Certain Conditions TCP Connections Can Be Totally Consumed When you issue a COMMREQ to establish a read or write channel a TCP connection is created the transfer s are made then upon completion of all the transfers the TCP connection is t
182. gnificant 16 bits For the Write EGD Command the exchange at the remote device must be a Produced exchange Word 17 Remote EGD exchange Exchange Data Offset Word 17 contains the 0 based byte offset of the data to be overwritten in the data portion of the exchange at the remote EGD device Word 18 Remote EGD exchange Exchange Data Length Word 18 contains the length in bytes of the exchange data to be written to the remote EGD device The exchange data length may not exceed 1400 bytes or the amount of memory available in the PLC for the selected memory type whichever is less 5 14 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Word 19 Remote Server Network Address Type Word 19 specifies the format of the remote PLC address Word 19 must contain the value 1 This indicates a dotted decimal IP address expressed using a separate register for each decimal digit Word 20 Remote Server Network Address Length Word 20 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block Word 20 must contain 4 Words 21 24 Remote Server IP Address Words 21 24 specify the four integers one integer per word of the dotted decimal IP address of the remote PLC to be accessed Note The Write EGD Exchange command can be sent to various servers GFK 2382A Chapter 5 Programming EGD Commands 5 15 Masked Write to EGD Exchange 4004 The Masked Write t
183. hannels Types of Status Data There are three main types of status data available to the application program 1 FT Output of the COMMREQ Function Block This output is set if there is a programming error in the COMMREQ Function Block itself if the rack and slot specified in the COMMREQ SYSID parameter is not configured to contain an Ethernet interface or if the data block length specified in the Command Block is out of range This output also may indicate that no more COMMREQ functions can be initiated in the ladder program until the Ethernet interface has time to process some of the pending COMMREQ functions If the FT Output is set the CPU does not transfer the Command Block to the Ethernet interface In this case the other status indicators are not updated for this COMMREQ 2 Status Bits The status bits are updated in the CPU once each PLC scan by the Ethernet interface These bits are generally used to prevent initiation of a COMMREQ function when certain errors occur or to signal a problem on an established channel The status bits include the LAN Interface Status bits and the Channel Status bits The starting location of these bits is set up when the module is configured The LAN Interface Status bits monitor the health of the Ethernet interface itself such as the LAN Interface OK bit The Channel Status bits monitor the health of a channel 3 Communications Status Word The COMMREQ Status word CRS word provides detailed infor
184. he Ethernet Interface EOK Blink Codes for Hardware Failures PLC Fault Table Monitoring the Ethernet Interface Status Bits Monitoring the FT Output of the COMMREQ Function Block Monitoring the COMMREQ Status Word Troubleshooting Common Ethernet Difficulties Using the EGD Management Tool GFK 2382A 11 1 What to do if you Cannot Solve the Problem If you cannot solve the problem contact GE Intelligent Platforms Please have the following information ready The Name and Catalog Number marked on the product PLC CPU version number from Machine Edition Status screen Ethernet interface type CPU374 PLUS Release 12 or later or CPU372 PLUS Description of symptoms of problem Depending on the problem you may also be asked for the following information The ladder logic application program and the PLC sweep time at the time the problem occurred A listing of the configuration parameters for the Ethernet interface that failed A description of the network configuration This should include the number of PLCs and host computers accessing the network the type of network cable used e g twisted pair fiber optic etc length of network cable and the number and manufacturer of transceivers hubs and network switches used Description on ALL Ethernet communication activity for the PLC Versions of all software doing Ethernet communication to the PLC PLC Fault Table showing Fault Extra Data Station Ma
185. he Ethernet interface These bits are generally used to prevent initiation of a COMMREQ function when certain errors occur The first 16 bits of the block are the LAN Interface Status LIS bits The next 32 bits are the Channel Status bits 2 for each channel Bits 48 80 are reserved Unless the LAN Interface OK bit is set Status Bit 16 the other status bits are invalid Status Brief Description Bits 1 Port 1 full duplex 2 Port 1 100Mbps 3 Port 2 full duplex 4 Port 2 100 Mbps 5 8 Reserved 9 Any Channel Error error on any channel 10 12 Reserved 13 LAN OK 14 Resource problem 15 Reserved 16 LAN Interface OK 17 Channel 1 Status Meaning is channel type specific 18 Channel 1 Status Meaning is channel type specific 47 Channel 16 Status Meaning is channel type specific 48 Channel 16 Status Meaning is channel type specific 49 80 Reserved 11 10 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A LAN Interface Status LIS Bits The LAN Interface Status bits monitor the health of the Ethernet interface itself Bit 1 Port 1 Full Duplex This bit is set to 1 when Port 1 is set to full duplex Full duplex or half duplex operation is automatically negotiated between the Ethernet interface and its immediately connected network device usually a network hub or switch If this bit is 0 the port is in half duplex Ethernet mode
186. he Logic Program Controlling Execution of the COMMREQ Function Block The COMMREQ must be initiated by a one shot to prevent the COMMREQ from being executed repeatedly each CPU scan which would overrun the capability of the Ethernet interface and possibly require a manual restart Checking certain status bits before initiating a COMMREQ function is also important In particular the LAN Interface OK bit should be used as an interlock to prevent execution of the COMMREQ function when the Ethernet interface is not operational Following initiation of a COMMREQ on a channel no further COMMREQs should be issued to that channel until a non zero CRS word has been returned to the program from the Ethernet interface GFK 2382A Modbus TCP Client 8 3 Operation of the Communications Request The diagram below shows how Communications Requests are executed to complete a data read from the remote Modbus TCP device The figure specifically illustrates the successful operation of a data read Domain of a TCP connection Domain of a channel 4 N Domain of a remote server Client Client PACSystems PLC Ethernet Server Server Server RX3i CPU Backplane Interface LAN Ethernet Interface Interface CPU Power flows to Open ConnectionCOMMREQ in ladder program Command Block sent to Verify Command Interface gt Block andsetup gt Accept channel to server connection Send connection lt Return COMMREQ acknowlegement Status CRS Word
187. he Machine Edition PLC Logic Developer PLC programmer Release 5 00 SP3 Hot Fix 3 or later It could can also be configured using VersaPro but the CPU s enhanced features would not be available VersaPro is only able to configure the CPU with the properties of a Release 11 0 CPU374 For specific programming software version requirements refer to the mportant Product Information document provided with your CPU Generating Storing Loading the Configuration The Series PLUS Ethernet interface uses several types of configuration data Ethernet Configuration optional Ethernet Global Data Configuration and optional Advanced User Parameter AUP Configuration All of these configuration parameters are generated at the programmer and stored from the programmer to the CPU as part of the hardware configuration Store sequence Configuration parameters may be loaded from the CPU into the programmer as part of the Configuration Load sequence An optional AUP file may be generated with a text editor and then imported into the programmer The programmer stores any AUP files to the PLC within the Configuration Store operation Once stored to the PLC the CPU maintains the configuration data over power cycles Run Mode Store is not permitted for Ethernet Global Data configuration data Backup Configuration Data The enhanced Ethernet interface saves a backup copy of the most recent Ethernet Configuration and AUP Configuration in non volatile memory for u
188. he PLC channels may not be properly shut down This causes a delay in re establishing these connections until a TCP timeout occurs on the devices connected to the PLC and results in a 0190H timeout expired or 0290H period expired error 11 32 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A EGD Configuration Mismatch Errors When using Ethernet Global Data the produced exchange defined at the producer must agree with the consumed exchange defined at the consumer The consumer generates an error when the size of an exchange received from the network differs from the configured size for that consumed exchange This error is indicated in the PLC Fault Table as LAN system software fault resuming with exception Event 28 Entry 2 1d As this error is generated each time the mismatched exchange is received the Ethernet exception log can quickly fill up with mismatch error events Cause Corrective Action Producer and Consumer Review the conflicting exchange definitions at exchange definitions are of the producer and at the consumer Change different size the incorrect exchange definition so that produced and consumed definitions are the same size If the consumer wishes to ignore certain portions of a consumed exchange be sure that the length of the ignored portions is correct The ignored portion is specified as a byte count Station Manager Lockout under Heavy
189. ies the number of those units The choices for the time units are shown below Value Meaning 1 hundredths of seconds 10 ms 2 tenths of seconds 100 ms 3 seconds 4 minutes 5 hours Word 11 Number of Time Units for Send Period Word 11 specifies the number of time units for the send period The send period is in effect even when the Channel command is set up to issue a single send A Channel command set up to issue a single send can have only one pending send transfer Example Send Period Calculation If Word 10 contains a value of 3 specifying seconds as the time unit and Word 11 contains a value of 20 the send period is 20 seconds A send is normally issued at the start of each send period If the pending transfer has not completed during the send period the Channel Error bit and Detailed Channel Status words are set to indicate a non fatal period error The pending transfer can still complete after the period error occurs For Channel commands set up to issue multiple sends the next transfer is issued only after the pending transfer completes If the Number of Time Units is zero a subsequent transfer is issued as soon as the previous transfer completes In this case no period errors are reported by the Channel Error bit Word 12 Timeout for Each Send Word 12 specifies the time in hundredths of a second the Ethernet interface will wait for a send transfer to complete before setting the Channel Erro
190. in this example are defined in the Open Modbus TCP Connection Example in this chapter ETH_READY OPEN_REQ COMM REG 1 I 5 OPEN_FLT R00301 IN FT s 4 R00301 4 SYsiD 21 jTASK 6 ETH_READY EG INT 4 4 OPEN_SUCCESS R00010 IN4 a 5 1 R00010 Rung 5 The COMMREQ Function Block has three input parameters and one output parameter The IN field points to the starting location of the Command Block parameters R00301 in this example The SYSID field of the COMMREQ Function Block defines the target rack and slot of the Ethernet interface to receive the command data This is a hexadecimal word value that gives the rack high byte and slot low byte location of the Ethernet interface module In the example the first three number places from left to right are zeros and are not displayed only the last number 1 appears This indicates rack 0 slot 1 The TASK field of the COMMREQ Function Block indicates which mailbox task ID to use for the specified rack and slot For the CPU372 PLUS and CPU374 PLUS Ethernet interface TASK must be set to 21 decimal 0015H The FT output energizes the OPEN _FLT coil in this example is turned ON set to 1 if there were problems preventing the delivery of the Command Block to the Ethernet interface In this case the other status indicators are not updated for this COMMREQ Rung 6 When ETH_READY is set the CRS word for the O
191. information see the next section GFK 2382A Modbus TCP Client 8 7 Modbus TCP Channel Commands This section describes the operation of the Channel commands A detailed description and example of each Channel command is included There are four Channel commands Open a Modbus TCP Connection Close a Modbus TCP Connection Read Data from a Modbus Server Device to the PLC Write Data from the PLC to a Modbus Server Device Mask Write Register Request to a Modbus Server Device Read Write Multiple Registers between PLC memory and a Modbus Server Device Please note that Modbus TCP channel COMMREQs unlike SRTP channel COMMREQs do not contain a parameter to configure a timeout value Enforcing a timeout for a Modbus channel command is at the discretion of the user and must be implemented in the user application Open a Modbus TCP Client Connection 3000 The Modbus TCP Ethernet interface transfers data to or from another Modbus TCP device using a channel Up to 16 channels are available for Modbus TCP client communications However these 16 channels are shared with SRTP Channels so that the combination of SRTP Channels and Modbus TCP Channels cannot exceed 16 The Open Modbus TCP COMMREQ requests the communication subsystem to associate a channel with a remote Modbus TCP device Using the COMMREQs defined later in this document the PLC may transfer data to and from a remote device Once a channel is allocated for Modbus TCP C
192. interval by up to one production period or one producer CPU sweep period which ever is smaller Producer period is configurable in increments of 2 milliseconds If the Producer Period is set to zero production is scheduled every scan or every 2ms whichever is slower In a PLC with rapid scan times scheduling a produced exchange at zero results in a very high load on the network and on the Ethernet interface which can degrade overall Ethernet performance Scheduling multiple exchanges for a zero period in a PLC with a low scan time can result in the Ethernet interface being unable to produce all the required data and will also degrade SRTP communication Consumer Update Timeout Period For each consumed exchange an Update Timeout period can be configured It determines how long the Ethernet interface will wait for the starting or subsequent packet of data in the exchange before declaring a refresh error The update timeout period for the consumer should be set to at least twice the producer period At very small producer periods the update timeout should also allow for network transfer variation Otherwise the PLC may occasionally falsely report refresh faults Use zero for the update timeout period of a consumed exchange to disable timeout detection Producer Period Guidelines for PLCs Do not produce and consume data faster than is required by your application This reduces the load on the network and on the devices providing capacity for
193. is occurs first switch the PLC CPU to STOP mode which ceases COMMREQ delivery in order to resume normal Ethernet operation Then modify the PLC logic application to reduce the COMMREQ traffic to a manageable level 11 30 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A PLC Timeout Errors PLC timeout errors may occur when the SRTP traffic to the Ethernet interface exceeds the PLC s ability to process the requests or when the PLC is unable to deliver mail to the Ethernet Interface PLC Timeout errors will take down an SRTP Server connection in this case the remote SRTP client must reestablish a new SRTP connection to the Ethernet interface This error is indicated in the PLC Fault Table as Backplane communication with PLC fault lost request with exception Event 8 Entry 2 8 These errors may also be accompanied by any of the following Backplane communication with PLC fault lost request with exception Event 8 Entry 2 6 location Ethernet Interface LAN system software fault resuming with exception Event 8 Entry 2 16 location Ethernet Interface Non critical CPU software event status code bytes 5 8 80 3a 00 12 location CPU module The PLC Timeout condition occurs when the CPU cannot process requests within a specified timeout period The remedy is to reduce the rate of requests or increase the processing capacity in the PLC C
194. is setup to issue a single read Example Read Period Calculation If Word 10 contains a value of 3 specifying seconds as the time unit and Word 11 contains a value of 20 then the read period is 20 seconds A Channel command set up to issue a single read can have only one pending read transfer A read will normally be issued at the start of each read period If the pending read transfer has not completed during the read period the Channel Error bit and Detailed Channel Status words will be set to indicate a non fatal period error The pending transfer can still complete after the period error occurs For Channel commands set up to issue multiple reads the next read transfer will be issued only after the pending read transfer completes If the Number of Time Units is zero a subsequent transfer will be issued as soon as the previous transfer completes In this case no period errors can occur Word 12 Timeout for Each Read Word 12 specifies the time in hundredths of a second the Ethernet interface will wait for a read transfer to complete before setting the Channel Error bit and Detailed Channel Status words to indicate a non fatal timeout error The transfer can still complete even after a timeout occurs As a result an application can choose what to do if one occurs If the timeout value is specified as zero no timeout errors will be reported For most applications a timeout is not needed because the read period acts as a timeout Word 1
195. ith the lowest rack slot location in the GFK 2382A Chapter 3 Configuration 3 13 system The same Producer ID applies to all exchanges produced by this CPU regardless of which Ethernet interface is used to send the exchange to the network While the form of the Producer ID is sometimes the same as that of an IP address and an IP address is used as its default value the Producer ID is not an IP address See Chapter 4 Ethernet Global Data for more information on how the Producer ID is used Use Signatures Setting Use Signatures to True enables signature support in the device False disables signature support Ethernet Global Data signatures can be used to make sure that the format of the data from the producer matches that expected by the consumer The EGD signature is a numeric value that has two parts the major number and the minor number The major number reflects the primary format of the data The minor number reflects backward compatible changes made to the Ethernet Global Data exchange such as adding data to the end of the exchange The primary format of the data is first established when the EGD exchange is defined At that time the signature is assigned the value of 1 0 Any change that reorders removes renames or changes the type or offset of a variable in the exchange is a primary format change that causes the signature major number to be incremented The signature major number must match between the producer and the c
196. l OBO LAN On Traffic Off als STAT On Off E EOK Blink error code Hardware failure O LAN Off O STAT off EOK Slow Blink Software Load LAN Slow Blink E STAT Slow Blink All LEDs blink in unison pattern same for awaiting or performing load LED Operation during Restart When the Ethernet firmware is manually restarted by the Ethernet pushbutton in any state the EOK LAN and STAT LEDs are briefly turned on in unison as an LED test These three LEDs are turned on for 72 second and are then turned off when the firmware is restarted The Ethernet port LEDs are not affected by a manual restart of the Ethernet firmware The LED test is performed only upon a manual pushbutton restart there is no LED test when the Station Manager initiates a restart 2 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A LAN LED Operation The LAN LED indicates access to the Ethernet network During normal operation and while waiting for an IP address the LAN LED blinks when data is being sent or received over the network directed to or from the Ethernet interface It remains on when the Ethernet interface is not actively accessing the network but the Ethernet physical interface is available and one or both of the Ethernet ports is operational It is off otherwise unless software load is occurring STAT LED Operation The STAT LED indicates the condition of the Ethernet interface in normal oper
197. ld be 0 for PLCs Word 12 13 Remote Producer ID EGD Producer ID Word 14 15 Remote Exchange ID EGD Exchange ID Word 16 Remote Exchange Offset Byte offset 0 based in the exchange that should be read Word 17 Network address type Must be 1 Indicates an IP address will be used Word 18 Network address length Must be 4 for IP address Group ID multicast is not permitted Word 19 to IP Address of the remote Four integers specified as one integer per word of the dotted Word 22 PLC decimal IP address of the remote PLC May not be a group IP address Word 23 Reserved Always 0 Word 4 COMMREQ status word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address 5 16 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Word 7 EGD Command Number Word 7 requests that a masked write EGD exchange operation occur If the command is processed successfully a data bit for a specified EGD exchange is written from the client to the server Word 8 Command Retry Time Word 8 specifies the time in milliseconds the Ethernet Interface will wait between retries when transferring the command A total of four tries will be made to send the command If no response is received after the four tries i e after four times the retry time value an error status will be returned in the COMMREQ status word If the command retry is specifie
198. lient R1 gt Server Bit M16 M1 End to end Word 0x4321 0x4321 bytes unswapped Server R1 gt Client Bit M16 M1 End to end Word 0x4321 0x4321 bytes unswapped CMM321 Modbus Client Endian Conversion Example For example depending on the direction of the transfer the end to end values result in bytes being swapped for CMM321 Modbus Client This can be seen in the example table below Memory Memory Transfer Memory Resulting Value Notes Location value Directio Location After Transfer Type example n Type Client Bit M16 M1 gt Server R1 0x4321 End to end 0x4321 Word bytes unswapped Server M16 M1 gt Client R1 0x2143 End to end Bit 0x4321 Word bytes swapped Client R1 gt Server Bit M16 M1 End to end Word 0x4321 0x4321 bytes unswapped Server R1 gt Client Bit M16 M1 End to end Word 0x4321 0x2143 bytes swapped 8 38 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Chapter Network Administration 9 This chapter discusses how devices are identified on the network and how data is routed among devices The main topics covered are P Addressing Gateways Subnets and Supernets GFK 2382A 9 1 L IP Addressing Each TCP IP node on a network must have a unique IP address The TCP IP Ethernet Interface is such a node as is a PC running TCP IP There may be other nodes on the
199. lient communications the channel remains allocated i e another protocol such as SRTP Channels cannot use the channel The channel connection is released only when the application program closes the channel the channel is automatically closed when the PLC transitions to STOP when the Ethernet interface uses a Redundant IP and the CPU transitions from the Active to the Backup unit the Ethernet interface is reset or the underlying TCP connection is terminated The IP address of the remote Modbus TCP device is specified in the Open Modbus TCP COMMREQ using the standard dotted decimal format No other IP address format is accepted 8 8 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A The COMMREQ Status Word CRS indicates the success or failure of the Open Modbus TCP Client Connection COMMREQ If the COMMREQ requests an invalid channel number or an already allocated channel the COMMREQ fails and the CRS is set to a non zero value to identify the failure See Communications Status Words on page 8 27 for information about CRS failure codes Command 3000 Example Establish a channel Channel 5 to a remote Modbus TCP device at IP address 10 0 0 1 Return the COMMREQ Status word to R10 Dec Hex Word 1 00008 0008 Length of Channel command Data Block Word 2 00000 0000 Always 0 no wait mode request Word 3 00008 0008 Memory type of CRS word R Word 4 00009 0009 CRS word address minus
200. mation on the status of the COMMREQ request The communications status word is not updated in the CPU each scan as are the status bits They are generally used to determine the cause of a communication error after the COMMREQ function is initiated The cause is reported in the form of an error code described later in this section The COMMREQ Status word CRS word is returned from the Ethernet interface to the PLC CPU immediately if the Command Block contains a syntax error or if the command is local The location of the CRS word is defined in the Command Block for the COMMREQ function GFK 2382A Modbus TCP Client 8 25 Description of the Status Data The errors and status reported in each type of status data are described below FT Output of the COMMREQ Function Block The FT Output passes power upon the following errors Invalid rack slot specified The module at this rack slot is unable to receive a COMMREQ Invalid Task ID Invalid Data Block length zero or greater than 128 Too many simultaneous active COMMREQs overloading either the PLC CPU or the Ethernet interface LAN Interface Status LIS Bits The status bits occupy a single block of memory The location of this block is specified during configuration of the Ethernet interface The first 16 bits of the block are the LAN Interface Status LIS bits The next 64 bits are the Channel Status bits 2 for each channel
201. mmand A total of four tries will be made to send the command If no response is received after the four tries i e after four times the retry time value an error status will be returned in the COMMREQ status word If the command retry is specified as zero the default value of one second is used Word 9 Local PLC Memory Type Words 9 11 specify the location in the local PLC where the Ethernet interface obtains the data to be written to the remote PLC Valid values for Word 9 are listed in the description of Read PLC Memory Command The amount of data to be transferred is specified by the number of memory units of the data written to the remote PLC Word 15 Words 10 11 Local PLC Memory Starting Address Words 10 and 11 determine the starting address in the local PLC from which the data is written to the remote PLC The value entered is the 32 bit offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 9 Word 10 contains the least significant 16 bits of the offset word 11 contains the most significant 16 bits of the offset This offset is in bits bytes or words depending on the mode specified For example if Word 9 16 and Words 10 11 2 0 then the starting address will be 19 Valid ranges of values depend on the PLC s memory ranges Word 12 Remote PLC Memory Type Words 12 14 specify the memory type and starting address in the remote PLC where data is to be written Valid values for
202. mmunications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Rung 12 When READ_SUCCESS is set it triggers CLOSE_REQ which enables execution of the BLKMOV MOVE and COMMREQ functions for the Close Modbus TCP Connection Commreq CLOSE_REQ is a one shot Positive Transition coil activating once when READ_SUCCESS transitions from OFF to ON Rung 13 The MOVE WORD function moves a zero to the CRS word referenced in the Command Block see rung 9 This clears the CRS word This rung also resets the CLOSE_FLT output coil of the COMMREQ Function Block in rung 15 ETH_READY 14 CLOSE_REQ BLKMOV INT 1 5 ETH_READY CLOSE_REQ BLKMOW INT 2 IN1 Q R00301 RO0301 COMM REQ ETH_READY 16 EQ INT IN1 Q R00012 R00012 4 H R00301 IN FT R00301 IN2 R00308 R00308 CLOSE_FLT 4 SYSID 21 jTASK s 1 CLOSE_SUCCESS s 1 Rung 14 The BLKMV INT functions set up the COMMREQ Command Block contents When this rung is activated the constant operands are moved into the memory beginning at the address indicated in the instruction The constant operands in this example are defined in the Close Modbus TCP Connection example on page 8 10 GFK 2382A Modbus TCP Client 8 33 Rung 15 The COMMREQ Function Block has three input parameters and one output parameter The IN field points to the starting location of the
203. modules have eight LEDs an On Off switch an Ethernet Restart pushbutton a connector for the Station Manager function and two Ethernet port connectors The Ethernet Restart pushbutton is used to manually restart the Ethernet firmware without power cycling the entire system It is recessed to prevent accidental operation The PS Power Supply PORT LED is not Ethernet related it indicates the presence of serial traffic through the serial port of the PLC s power supply Each of the three Ethernet LEDs EOK LAN and STAT can be ON OFF BLINKING slow or BLINKING fast These LEDs indicate the state of the Ethernet interface traffic at the Ethernet Interface LAN LED and the occurrence of exception events Each of the two Ethernet ports has two LEDs 100 and LINK The 100 LED indicates the network data speed 10 or 100 Mb sec This LED is lit if the network connection at that network port is 100 Mbps The LINK LED indicates the network link status and activity This LED is lit when the link is physically connected It blinks when traffic is detected at that network port Traffic at the port does not necessarily mean that traffic is present at the Ethernet interface since the traffic may be going between ports of the switch The default station address MAC address label is located on the outside of the module as shown above 2 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Installing the
204. mote Device Number of Registers in the Remote Device Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Write Data to Modbus TCP device Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 16 Write Multiple Registers Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interface will get the data to be written to the remote PLC Values for Word 10 are listed on page 8 14 The value 16 specifies Discrete Input Memory l byte mode Word 11 Local PLC Starting Address Word 11 determines the starting address in the local PLC from which the data is to be written The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 10 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Word 12 Remote Device Address Word 12 specifies the destination register in the remote Modbus TCP device Word 13 Number Registers in Remote Device Words 13 specifies the quantity of registers to write to the remote device Wo
205. n published to the EGD Configuration Server Select the exchange to be consumed Once selected the exchange is populated with the variable length type and description information defined in the producer The variable name consists of the target name an underscore and the variable name in the producer See below for information about name generation Enter a reference address or select ignore for each variable in the exchange Assign an adapter name and a timeout for the exchange With these steps the configuration of the consumer is complete When an individual consumed exchange is selected the following parameters can be configured in the Properties Inspector window Typically only the adapter name and the update timeout need to be specified for the exchange and the reference address specified for the variables in the exchange Changing any other values in a consumed exchange should only be done with expert help Name A name assigned for this exchange Defaults to the target name of the producer an underscore and the exchange ID in the producer Changing this name may make resynchronization of the variable with the server impossible Producer ID The ID of the PLC producing the exchange Producer ID is defined by the producer changing here it may make resynchronization with the server impossible Group ID Used only if the produced exchange has been configured with a Destination Type of Group ID Group ID is defined by
206. n in the local PLC where the Ethernet interface will write data received from the remote server Values for Word 10 are listed on page 8 14 The value 8 specifies Register Memory R Word 11 Local PLC Starting Address LSW Write With Data Read From Server Word 11 determines the least significant word LSW of the starting address in the local PLC from which the data is to be written The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 10 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Word 12 Local PLC Starting Address MSW Write With Data Read From Server Word 12 determines the most significant word MSW of the starting address in the local PLC from which the data is to be written This value is always 0 for CPU372 PLUS and CPU374 PLUS Word 13 Remote Device Read Address Word 13 specifies the register s to read from the remote Modbus TCP device Word 14 Number Registers to Read From Remote Device Words 14 specifies the quantity of registers to read from the remote device Word 15 Local PLC Memory Type Read Data to Write to Server Words 15 17 specify the location in the local PLC where the Ethernet interface will read data to use for writing to the remote server Values for Word 15 are listed on page 8 14 The value 8 specifies Register Memory R Word 16
207. na annaa aia 8 1 The Communications Request cccceececeecee cece cece eeceeeaeeeeeeeteeeecacaeeeeeeeeeseseaaeeeeeeteeeees 8 2 Structure of the Communications Request ccccceeceeeeeeeeceeeeeeeeeesecsncaeeeeeeeeees 8 2 COMMREQ Function BIOCK 2 0 0 2 cccceeceeeecee cece eres eeccaeceeeeeeeseceneaeeeeeeeeeesessnniaeeeeeess 8 2 COMMREQ Command BIOCK ecccececeeceeeeeeeeeecneaeceeeeeeesecaaaaeaeeeeeeesessnsinaeeeeeess 8 3 Modbus TCP Channel Commands ccceccececce cece ee eeeeeeceeeeeeeeesetennaeeeeeeeeeeeeneees 8 3 Status Data Piste a he a ree Meets shh a aa libs a Satin Seat bet ae sted otitis Sa 8 3 Operation of the Communications REquest cccceceeeeeeeeceeeeeeeeeesecsnaeeaeeeeeees 8 4 GFK 2382A Contents vii Contents COMMREQ Function Block and Command Block 0 ccccccceeeeeeeeeeeeeeeeeeeeeeseeeeeeeeeeaeees 8 5 The COMMREQ Function BIOCK ccceeeeeceeeeeeeeeeeneeeeeeaeeeeeeeaeeeseeceeeeeeneeeeneaaes 8 5 The COMMREQ Command BIOCK cccecccceeeeeeeeeeeneeeeeeneeeeeeaaeeeeeeaaeeeseeiaeeeeeeaes 8 6 Modbus TCP Channel Commands 0 cccccceeccneeeee eines eee eineeeeetiieeeeetiieeeeetieeeeernaeeeenead 8 8 Open a Modbus TCP Client Connection 3000 eceeeeeeeeeeeeeneeeeteeneeeeeeeenaeees 8 8 Close a Modbus TCP Client Connection 3001 eecceeeeeeeeeeenneeeeeeesieeeeeeaes 8 10 Read Data from a Modbus TCP Device 3003 eeeeceeeeeeeeeeeeneeeee
208. nabling the Use of the EGD Configuration Server In addition to installing the EGD Configuration Server on the computer its use must be enabled This is done by default However if the EGD Configuration Server was previously disabled it can be re enabled as described below 1 Right click the Ethernet Global Data node sc EEE Series 90 30 CPU374 A Data Watch Lists SE n Ethernet Global Data ofl Consumed Exchanges E aE Produced Exchanges a f Hardware Configuration fff Main Rack 1C693CH5391 Ba PWR IC693PWR321 l Slot 1 1C693CPU374 GFK 2382A Chapter 3 Configuration 3 11 2 Choose Properties to display the EGD Properties in the Inspector window Ethernet Global Data Local Producer ID 0 0 0 0 Local Producer ID Number 0 Use Configuration Server True vake Gel a e n ahaa aoa naa Collection Series 90 30 R Network Names Use Signatures ne False ae ea os MEERE E PINS E nes 5 Use Configuration Server this should be set to True to enable using the configuration server Setting it to False disables the configuration server Work Offline If this is set to True work can be done offline from the configuration server for example in order to work disconnected from the network or if the configuration server is located on another computer When Work Offline is set to True the programmer keeps a local copy of the EGD configuration information at a configur
209. nagement Tool you must have configured Ethernet Global Data using the EGD Configuration Server option as described in chapter 3 Installing the EGD Management Tool The EGD Management Tool is not automatically installed when you install the Programmer To install the EGD Management Tool look in the directory where you installed the programmer and you will find a subdirectory named EGD Installs In that directory you will find a file named EgdManagementToolSetup msi Double click on this file to install the EGD Management Tool Launching the EGD Management Tool To run the EGD Management Tool select the Ethernet Global Data node in the Navigator and right click Select Launch EGD Management Tool The EMT will begin execution in a separate frame on your desktop Namn The name of the EGD device k Aetna Conigeston Saree EGO Sarver Orina EGD Sawee 172131125 Mine Servee C Progiam Faas GE Inchuntial Syotems EGD Managiriant Tech MarodCache Banj Jam s DS M BH edad tid 3d 2d On SITE Sd SAW Mf I coco SED oN The right side of the screen shows a graphical representation of the EGD network based on the configuration data stored in the EGD Configuration Server EGD collections are displayed as a folder icon The navigator on the left side allows specific devices exchanges and variables in the configuration to be examined Properties for these elements are shown in the property pane at the lower l
210. nager Log showing Ethernet Events 11 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Tools Available for Diagnostics There are several tools to assist you in diagnosing problems with the Ethernet interface and the network Use the Ethernet Interface LEDs to troubleshoot a problem on power up of the Ethernet interface and for an immediate visual summary of the operational state of the interface Use the PLC Fault Table to troubleshoot a problem once the interface is running It provides a record of exceptions logged by the PLC the Ethernet interface and other I O and communications modules The PLC Fault Table is accessed through the PLC programming software or web browser For PLC Fault Table entries generated by the Ethernet interface the Detailed Fault Data for that entry contains the same data as the corresponding event in the Ethernet interface s exception log For information on how to interpret Ethernet exception log events refer to GFK 2383 TCP IP Ethernet Communications for Series 90 30 CPU372 PLUS and CPU374 PLUS Station Manager Manual Use the Ethernet Status Data to troubleshoot the Ethernet interface status For Ethernet Global Data operation the EGD Management Tool can be used to check online operation of the EGD network as described in this section For Ethernet Global Data operation Exchange Status words can be used to troubleshoot exchange operations
211. nges are configured using the programmer and stored into the PLC Both Produced and Consumed exchanges can be configured The Ethernet interface supports both selective consumption of EGD exchanges and EGD exchange production and consumption to the broadcast IP address of the local subnet The Ethernet interface can be configured to use SNTP to synchronize the timestamps of produced EGD exchanges The enhanced Ethernet interface implements the capabilities of a Class 1 and Class 2 device COMMREQ driven EGD Commands can be used in the application program to read and write data into EGD Class 2 devices GFK 2382A Chapter 1 Introduction 1 7 Chapter Installation and Startup 2 This chapter describes the CPU372 PLUS and CPU374 PLUS Ethernet interface user features and basic installation procedures Module Appearance Installing the CPU in the PLC Ethernet LEDs Ethernet Port Connectors Embedded Switch Connection to a 10Base T 100Base Tx Network Station Manager Port Verifying Proper Powerup of the Ethernet Interface After Configuration Pinging TCP IP Ethernet Interfaces on the Network GFK 2382A 2 1 Module Appearance EOK PORT SLAT CPU374 DEFAULT STATION ADDRESS LABEL ETHERNET RESTART gt STATION e MGR LINK ACT PORT 1 100Mbps LINK ACT SERIAL NUMBER PORT2 LABEL 100Mbps 10 100 ETHERNET 10 100 ETHERNET FRAME The front panels of the CPU372 PLUS and CPU374 PLUS
212. nly one COMMREQ function per channel can be pending at one time A COMMREQ function is pending from the time it is initiated in the ladder program until its COMMREQ status word has been updated to a non zero value by the Ethernet interface If the PLC CPU attempts to send COMMREQs to the Ethernet interface faster than the Ethernet interface can receive them the CPU generates the following entry in the PLC Fault Table Option module software failure The PLC logic program should retry the COMMREQ after a short delay 8 36 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Differences between Series 90 30 PLUS and Series 90 Modbus TCP Channels This section lists the known differences between the Series 90 30 PLUS implementation of Modbus TCP Channels and the earlier Series 90 implementation 1 On the 90 30 CMM321 if a Modbus error response is received for a Modbus TCP channel the Ethernet interface closes the TCP connection and updates the CRSW with an appropriate error code For Series 90 30 PLUS Ethernet the Modbus error response results in an updated CRSW with an appropriate error code but the TCP connection is NOT closed 2 A CRS word of 0x8390 Invalid Server Memory Type is returned when an invalid Modbus Function code is specified for the CMM321 For CPU372 PLUS and CPU374 PLUS Ethernet an improved CRSW of 0xB690 Invalid Unsupported Modbus Function Code is returned 3 The TCP co
213. nly this value requires subtracting 1 from the intended address Word 7 EGD Command Number Word 7 requests that a read EGD exchange operation occur If the command is processed successfully it will result in data from a specified EGD exchange being read from the client to the server 5 10 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Word 8 Command Retry Time Word 8 specifies the time in milliseconds the Ethernet Interface will wait between retries when transferring the command A total of four tries will be made to send the command If no response is received after the four tries i e after four times the retry time value an error status will be returned in the COMMREQ status word If the command retry is specified as zero the default value of one second is used Word 9 Local PLC Memory Type Words 9 11 specify the location in the local PLC where the Ethernet interface obtains the data to be read from the remote EGD device Valid values for Word 9 are listed in the description of Read PLC Memory Command The amount of data to be transferred is specified by the Exchange Data Length Word 18 Words 10 11 Local PLC Memory Starting Address Words 10 and 11 determine the starting address in the local PLC where data is read from the remote EGD exchange The value entered is the 32 bit offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 9
214. nnect timeout i e the amount of time to wait for the Remote server or Gateway to establish a TCP connection with a Modbus TCP Channel is 90 seconds on the Series 90 and 75 seconds on Series 90 30 PLUS An error is returned in the CRSW for the Open Modbus TCP Connection COMMREQ when this timeout occurs 4 The station manager command stat m on the Series 90 results in displaying Closed for specific Closed channels while on the Series 90 30 PLUS Modbus TCP Channels it results in displaying nothing for a specific Closed channel 5 When sending a Close Modbus TCP Connection COMMREQ the Series 90 30 PLUS Modbus TCP Client returns a success CRS word 0x0001 while the CMM321 module returns an error CRS word GFK 2382A Modbus TCP Client 8 37 6 The rules for Endian conversion when transferring between Word and Bit types of memory are different in order to make these types of conversions consistent Series 90 30 PLUS Modbus Client Endian Conversion Example The following example table shows the Endian conversion behavior for the Modbus Client as implemented in the CPU372 PLUS and CPU374 PLUS Memory Memory Transfer Memory Resulting Value Notes Location value Directio Location After Transfer Type example n Type Client Bit M16 M1 gt Server R1 0x4321 End to end 0x4321 Word bytes unswapped Server Bit M16 M1 gt Client R1 0x4321 End to end 0x4321 Word bytes unswapped C
215. nnel re tasking of an active channel to a different remote device changing the remote device s IP address etc However re tasking to a different remote device will neither conserve TCP connections nor save on the time it takes to create a channel SRTP Application Timeouts The application timeouts within SRTP Channels also include the time needed to establish and maintain the underlying network and SRTP connection Examples are establishing the TCP connection for a new channel establishing communication with the remote device and TCP retransmissions during Channel operations If the time needed for TCP connection establishment or maintenance exceeds the user specified channel application timeout values an application timeout will occur Channel application timeouts are temporary errors the channel continues to run when the expected response is received If the application is seeing timeouts during channel startup there are a few different options 1 Increase timeout value to account for Channel connection overhead 2 Ignore the timeout error on the first transfer 3 Use a two step setup approach where the first COMMREQ has a timeout large enough to account for the connection overhead and then Re Task the channel to the normal operating timeouts GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 29 s Monitoring Channel Status The COMMREQ Status word is returned from the Ethernet interface to the PLC CPU immediately if
216. nterfaces including versions of the Series 90 30 CPU374 Ethernet interface prior to Release 12 0 These errors cause the Series 90 30 PLUS SRTP server to drop the SRTP connection to the Host Communications Toolkit device If possible the Host Communications Toolkit device should be upgraded so that it will generate properly encoded SRTP messages If the device cannot be upgraded the chct_comp AUP parameter can be used to tell the Ethernet interface to ignore known SRTP errors that were not detected by previous Series 90 products See Appendix A for details of the chct_comp parameter COMMREQ Flooding Can Interrupt Normal Operation The PLC logic application program should generally wait for a response from each COMMRE Q function block before activating another COMMREQ function block to the same endpoint Extremely heavy COMMREQ delivery loading such as activating the same COMMREQ every logic sweep can prevent normal SRTP Modbus EGD and Station Manager operation During such loading the Ethernet LAN LED may be frozen If this occurs first switch the PLC CPU to STOP mode which ceases COMMREQ delivery in order to resume normal Ethernet operation Then modify the PLC logic application to reduce the COMMREQ traffic to a manageable level Accelerated EGD Consumption Can Interfere with EGD Production Consumed EGD exchanges received from the network normally receive accelerated processing for increased overall EGD performance This
217. nts to consume only the analog value and place it into AI003 the consumer might be configured as shown below Offset Variable Ref Address Ignore Length Type Description 00 ignore True 6 Byte ignore float and integer 60 vaor awoos 1 worn i O Note that where EGD signatures are not used the total length of the exchange must be the same in producer and consumer even if the consumer is ignoring a portion of the exchange Failure to configure any ignored bytes in the consumed exchange results in exchange exception log and fault table entries error status in the exchange status data and no data being transferred for the exchange GFK 2382A Chapter 3 Configuration 3 19 Validating the EGD for a Device One advantage of using the EGD configuration server is the ability to validate the EGD configuration before downloading the configuration to the device If you right click on the Ethernet Global Data node in the Navigator you will see a selection for Bind and Build Selecting this menu item causes the EGD definitions for the target to be cross checked against the definitions in the server Each consumed exchange is compared to the produced exchange published by the producer and any discrepancies are noted see above for how to correct any errors detected in the consumer It is also possible by selecting the menu item Unconsumed Data Report to generate a report listing any variables in produced ex
218. o EGD Exchange command can be used to write one or more bits in a single byte of a configured Ethernet Global Data exchange in a remote producer node EGD protocol prohibits writing to a consumed exchange This command can be sent to Series 90 30 PLUS and to PACSystems PLCs and to other EGD Class 2 devices In a Series 90 30 PLUS writing an EGD exchange modifies the PLC reference memory locations configured to be transferred at the specified offset in the exchange Thus current process data is updated not the data that was transferred last in the exchange Masked Write EGD Exchange Command Block Word Offset Value Description Word 1 Length of command data Always 23 block Word 2 0 Always 0 no wait mode request Word 3 See table on page 5 3 Memory type of COMMREQ Status Word Word 4 0 based Offset of COMMREQ Status Word Word 5 0 Reserved Word 6 0 Reserved Word 7 4004 fa4H Masked Write to EGD Exchange command number Word 8 Retry time in milliseconds The time between retries of command transfers in 10 millisecond increments Default is 1000ms Word 9 Bit mask set bit to be The bit mask selects the individual bit to be written The most written to 1 rest to 0 significant bytes of Word 9 and Word 10 are ignored Word 10 Write O or 1 to selected bit Value to set the bit selected by the bit mask in Word 9 Word 11 Remote signature EGD Exchange signature This shou
219. o the network As soon as a sample for a consumed exchange is received it is transferred to the CPU during the next input scan portion of the CPU sweep The result of this scheduling method for Ethernet Global Data is a variability of up to one producer CPU sweep time in the interval between samples produced on the network This 4 8 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A variability in the time between samples is present to assure that the most up to date data is being transferred In general it is not useful or necessary to configure the production period to be less than the CPU sweep time If the producer period for an exchange is set lower than the CPU sweep time the Ethernet interface will send a stale sample a sample containing the same data as previously sent at the configured interval When the fresh CPU data becomes available at the end of the sweep the Ethernet interface will immediately send another sample with the fresh data The timer of the produced exchange is not reset when this sample is sent This can result in more samples in the network than would be expected from the configured period Configurable Producer Period for an EGD Exchange The Producer period for an EGD exchange can be 2 milliseconds to one hour In the PLC the Ethernet interface attempts to produce the data at this interval As explained above the exchange production may vary from the configured
220. of communications and the periodic data transfer Parameters in the Command Block specify the frequency and direction of the transfer and the memory locations in the client and server to be used in the transfer Aborting and Re tasking a Channel There are four ways a channel can be aborted 1 When the PLC CPU is stopped all channels in use are aborted automatically 2 Achannel or all channels can be aborted by issuing an Abort Channel command 6 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A iG 3 A channel in use can be re tasked by issuing an establish command for its channel number This aborts the previous channel operation and then performs the new channel operation 4 Achannel is also automatically aborted if a fatal error occurs Monitoring the Channel Status The Ethernet Interface status bits occupy a single block of memory The memory location is specified during configuration of the Ethernet interface The status bits are updated in the CPU once each PLC scan by the Ethernet interface These bits are generally used to prevent initiation of a COMMREQ function when certain errors occur or to signal a problem on an established channel The first 16 bits of the block are the LAN Interface Status LIS bits The next 32 bits are the Channel Status bits 2 for each channel Bits 49 80 are reserved Unless the LAN Interface OK bit is set Status Bit 16 the other status bit
221. om the beginning of PLC memory for the memory type and mode specified in Word 10 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Word 12 Remote Device Address specifies the destination register in the remote device Word 13 Number Registers in Remote Device Word 13 specifies the quantity of registers to write to the remote device For Function Code 6 Write Single Register this must be set to 1 Word 14 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block GFK 2382A Modbus TCP Client 8 19 Command 3004 Example 2 Write Single Coil Set coil 501 ON in the remote Modbus TCP device using the value at Q4 Return the COMMREQ Status word to R10 Use channel 6 a channel previously opened with the Open Modbus TCP Client Connection COMMREQ Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Dec Hex 00008 0008 00000 0000 00008 0008 00009 0009 00000 0000 00000 0000 03004 OBBC 00006 0006 00005 0005 00072 0048 00004 0004 00501 01F5 00001 0001 00001 0001 Length of Channel command Data Block Always 0 no wait mode request Memory type of CRS word R CRS word add
222. ommunication The SRTP connection in the Ethernet interface may remains open for approximately 3 minutes 30 seconds while TCP attempts to reconnect during this interval the SRTP connection is unavailable If all the SRTP connections in the Ethernet interface are in use or otherwise unavailable a new SRTP server connection must wait until the TCP reconnect time expires on an existing connection The SRTP connection timeout is normal expected behavior and is consistent with other GE PLC products Sluggish Programmer Response after Network Disruption The network programmer attempts to use a special privileged SRTP server connection at the Ethernet interface in order to establish and maintain connection even under heavy load due to EGD and other SRTP connections The Ethernet interface supported only one such privileged connection Once established no other privileged connections are permitted until the current privileged connection is terminated This normally occurs when the network programmer disconnects from the target PLC As described above under SRTP Connection Timeout when the programmer PLC network connection is abruptly broken not the orderly termination performed during disconnection the SRTP server connection and its underlying TCP connection remain alive until the TCP connection eventually times out about 3 minutes 30 seconds If the programmer reconnects during this interval it actually obtains a new non privileged
223. on Block It can be any valid address within a word oriented area of memory R AI or AQ The Command Block is set up using an appropriate programming instruction such as a BLOCK MOVE or DATA INIT COMM The Command Block has the following structure Word 1 Data Block Length words Word 2 WAIT NOWAIT Flag Word 3 COMMREQ status word Memory Type Word 4 COMMREQ status word Address Offset Word 5 Reserved Word 6 Reserved Words 7 and up Data Block Channel Command Details Word 1 Data Block Length This is the length in words of the Data Block portion of the Command Block The Data Block portion starts at Word 7 of the Command Block The length is measured from the beginning of the Data Block at Word 7 not from the beginning of the Command Block The correct value for each command and the associated length of each command is specified in the next section Word 2 WAIT NOWAIT Flag Must be set to zero for TCP IP Ethernet communications GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 7 COMMREQ Status Word The Ethernet interface updates the COMMREQ status word to show success or failure of the command Command words 3 and 4 specify the PLC memory location of the COMMREQ status word COMMREQ Status Word values are described in chapter 11 Word 3 COMMREQ Status Word Memory Type This word specifies the memory type for the COMMREQ status word The memory types are listed in the table below
224. ond word 6 12 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Establish Write Channel 2004 The Establish Write Channel command requests that a channel be connected to a remote PLC and that data from the local PLC be transferred periodically to the remote PLC The Command Block specifies the period the number of writes to the server remote PLC to perform and the timeout allowed in waiting for each transfer to complete The first write is performed immediately regardless of the period specified Example Command Block Establish a write channel Channel 6 to a remote PLC at IP address 10 0 0 1 Return the COMMREQ Status word to R10 Write local PLC registers R50 R57 to remote PLC registers R100 R107 Repeat the write indefinitely once every 7 seconds with a timeout of 500 ms for each write The term local PLC is used here to identify the client PLC the PLC that initiates the communications request The term remote PLC is used here to identify the server PLC the PLC that responds to the communications request Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Word 15 Word 16 Word 17 Word 18 Word 19 Word 20 Word 21 Word 22 Word 23 Word 24 27 Word 28 31 Dec Hex 00017 0011 00000 0000 00008 0008 00009 0009 00000 0000 00000 0000 02004 07D4 00006 0006 00000 0000 00003
225. onfiguration to the PLC GFK 2382A Chapter 3 Configuration 3 5 Assigning a Temporary IP Address Using Telnet The temporary IP address assignment performed by the programmers Set Temporary IP Address utility can also be performed manually from a computer s DOS command window if the programming software is not available This method uses an attempted Telnet connection to transfer the IP address even though the enhanced Ethernet interface does not support normal Telnet operation The Telnet method can assign a temporary IP address whether or not the Ethernet interface already has in IP address even if the Ethernet interface has been previously configured to a non default IP address This includes overriding an IP address previously configured by the programming software Use this IP Address assignment mechanism with care To temporarily set the IP address over the network the PLC CPU must not be running IP address assignment over the network will not be processed until the CPU is stopped and is not scanning outputs 1 Obtain the Ethernet interface s MAC address from its MAC Address Label as shown in chapter 2 Installation 2 On the computer open a standard DOS command window Associate the desired IP address for the Ethernet interface with the MAC address of the Ethernet interface In the DOS command window enter gt ARP s ip_address mac_address for jp_address enter the IP address being assigned to the Ethernet interf
226. onsumer for the consumer to consume the data The signature minor number is incremented when backward compatible changes are made in the format of the produced data Backward compatible changes are made by adding data to unused areas of the exchange including adding data to the end of the exchange After checking the signature major number the consumer checks the signature minor number If the signature minor number in a sample is greater than the signature minor number configured for the exchange in the consumer then the consumer can consume the data truncating any unexpected data at the end of the sample The consumer can do this because the minor number change guarantees that only backward compatible changes have been made in the format of the data If the signature of a produced exchange is specified as zero the consumers will not check it If the signature of a consumed exchange is configured as zero any signature from a producer is accepted and if the data length exactly matches the expected length the data is used Use of signatures is enabled by default for CPU372 PLUS and CPU374 PLUS as well as PACSystems RX7i and RX3i targets It is disabled for other targets and for existing projects All other targets force the signature for both produced and consumed exchanges to be zero TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Configuring an Ethernet Global Data Exchange for a Producer
227. opens a connection that connection stays open until the client terminates the connection or until the connection is terminated for some other reason Station Manager Support The Modbus TCP Server supports the standard Station Manager commands STAT TALLY and TRACE plus the Modbus TCP server specific KILLMS command The Modbus TCP Server task letter is o 7 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Reference Mapping The Modbus protocol s reference table definition is different from the internal structure of the Series 90 30 PLUS reference tables Modbus refers to Holding Register Input Register Input Discrete and Coil tables Series 90 30 PLUS uses Discrete Input l Discrete Output Q Analog Input Al and Register R reference tables for Modbus data The following table shows how each Modbus table is mapped to the Series 90 30 PLUS reference tables Note For details on how PLC memory addresses are mapped to Modbus registers in the IC693CMM321 Ethernet interface module refer to TCP IP Ethernet Communications for Series 90 PLCs User s Manual GFK 1541 Modbus Reference Tables Modbus Holding Modbus Input Modbus Input Modbus Coil Register Table Register Table Discrete Table Table Series 90 30 PLUS 4Xxxx 3xxxx 1Xxxx Oxxxx Reference Tables 11 2048 bits Al1 64 16 bit words 16 bit words 1 2048 Q1 2048 bits bits 1
228. ormat as four decimal integers 0 255 separated by periods where each integer gives the value of one byte of the IP address For example the 32 bit IP address 00001010 00000000 00000000 00000001 is written as 10 0 0 1 9 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A L One can determine the class of an IP address by examining the first integer in its dotted decimal IP address and comparing with the range of values in the following table Range of first integer Class 0 126 A 127 Loopback 128 191 B 192 223 C 224 239 D Reserved for Multicast Use 240 255 E Reserved for Experimental Use IP Addresses Reserved for Private Networks RFC 1918 reserves IP addresses in the following ranges to be used for private networks 10 0 0 0 10 255 255 255 Class A 172 16 0 0 172 31 255 255 Class B 192 168 0 0 192 168 255 255 Class C Multicast IP Addresses Multicast IP Addresses are used in multicasting a technique that allows delivery of a single packet of data to multiple nodes on the network Any node that joins a Multicast group will respond to the Multicast IP address assigned to that group Subsequently any data sent to that Multicast IP address may be received by all nodes that are members of that Multicast group Multicast Class D IP addresses 224 0 0 0 through 239 255 255 255 are reserved by the Internet authorities for multic
229. orrupted It is especially important that each node on the network is assigned a unique IP address If you have no network administrator and are using a simple isolated network with no gateways you can use the following range of values for the assignment of local IP addresses 10 0 0 1 First Ethernet interface 10 0 0 2 Second Ethernet interface 10 0 0 255 Programmer TCP or host Also in this case set the subnet mask and gateway IP address to 0 0 0 0 Note lf the isolated network is connected to another network the IP addresses 10 0 0 1 through 10 0 0 255 must not be used and the subnet mask and gateway IP address must be assigned by the network administrator The IP addresses must be assigned so that they are compatible with the connected network Status Address The Status Address is the reference memory location for the Ethernet interface status data The Ethernet interface will automatically maintain 16 LAN Interface Status LIS bits in this location and 64 Channel Status bits in this location for a total of 80 bits The Status address can be assigned to valid l Q R Al or WAQ memory The default value is the next available l address See chapter 9 Diagnostics for definitions of the LAN Interface Status LIS portion of the Ethernet Status data The meaning of the Channel Status portion of the Ethernet Status depends upon the type of operation for each channel See chapter 6 for the meaning of the Channel Status bits for SRT
230. ot used Communications Status Words The COMMREQ Status word CRS word reports status in the format shown below The CRS word location is specified in Words 3 and 4 of the Command Block CRS Word in Hex Format High Low 00 00 Minor Error Codes high byte Success and Major Error Codes low byte The Ethernet Interface reports the status of the COMMREQ back to the status location See chapter 11 Diagnostics for COMMREQ major and minor error codes that may be reported for in the CRS words for Modbus TCP commands GFK 2382A Modbus TCP Client 8 27 Controlling Communications in the Ladder Program This section provides tips on how to control communications in your ladder program Only segments of actual ladder logic are included Topics discussed are Essential Elements of the Ladder Program Troubleshooting Your Ladder Program Monitoring the Communications Channel Essential Elements of the Ladder Program Every ladder program whether in the developmental phase or the operational phase should do the following before initiating a COMMREQ function 1 Initiate the COMMREQ function with a one shot transitional coil This prevents sending the same COMMREQ Command Block more than once 2 Include at least the LAN Interface OK bit in the LAN Interface Status Word as an interlock contact for the COMMREQ function You may choose to add more interlocks 3 Zero the word location you specify for the COMMREQ Status CRS wo
231. owever that does not work if communications travel through a router The target must be located on the same sub network subnet as the computer running the Set Temporary IP Address utility The sub network is specified by the computer s subnet mask and the IP addresses of the computer and the Series 90 30 PLUS enhanced Ethernet interface GFK 2382A Chapter 3 Configuration 3 3 To set the IP address you need the MAC address of the Ethernet interface The MAC address is located on a label on the module as shown in chapter 2 Installation Connect the Series 90 30 PLUS CPU to the Ethernet network 1 In the Project tab of the Navigator right click the CPU372 PLUS or CPU374 PLUS target Choose Offline Commands then Set Temporary IP Address The Set Temporary IP Address dialog box appears 2 Inthe Set Temporary IP Address dialog box do the following Specify the MAC address of the Ethernet interface In the IP Address to Set box specify the temporary IP address you want to assign to the Ethernet interface If the system has multiple Ethernet network interface modules select the Enable Network Interface Selection check box and specify the network interface being set up 3 When the fields are properly configured click the Set IP button 4 The Set Temporary IP Address utility verifies that Set Temporary IP Address x This utility is designed to set the IP address of the target for a temporary time period
232. pe If the number of requested coils is not on an 8 bit boundary the data is padded with Os to an 8 bit boundary For example if the COMMREQ requests nine coils from the Remote Device and requests to place this data at M00001 M00001 through MO00009 will be updated with values from the Remote Device and M00010 through M00016 will be set to 0 Data returned from the remote device is stored in the PLC data area specified in the Read Modbus TCP Device COMMRE Q Data can be stored in any of the PLC data areas Refer to page 8 14 for the list of data areas and identification codes for the PLC Note that the first item referred to in each data area is item 1 not item 0 The COMMREQ Status Word CRS indicates the success or failure of the Read Data COMMRE If the COMMREQ requests an invalid channel number or any other field is invalid the COMMREQ fails and the CRS is set to a non zero value to identify the failure See the section Communications Status Words on page 8 27 for information about CRS failure codes 8 12 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Command 3003 Example 1 Read four Input Registers from Input Registers in the remote Modbus TCP device Store the registers at location R20 Return the COMMREQ Status word to R10 Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Dec Hex 00008 0008 00000 0000
233. pen Modbus TCP Connection commreg is monitored for a status of 1 indicating that the Open commreq completed successfully The CRS word change to 1 sets coil OPEN_SUCCESS 8 30 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A ETH_READY OPEN_SUCCESS READ_REQ 7 1H T r i 8 ETH_READY READ_REQ MOVE WORD READ_FLT ii 1 R 1 4 o IN Q roo011 R00011 ETH_READY READ_REQ BLKMOV INT BLKMOV INT i T 1 1 s IN1 Q R00301 RO0301 M R00308 RO0308 Rung 7 When OPEN_SUCCESS is set it triggers READ_REQ which enables execution of the BLKMOV MOVE and COMMREQ functions for the Modbus TCP Read Commreq READ_REQ is a one shot Positive Transition coil activating once when OPEN_SUCCESS transitions from OFF to ON Rung 8 The MOVE WORD function moves a zero to the CRS word referenced in the Command Block see rung 9 This clears the CRS word This rung also resets the READ_FLT output coil of the COMMREQ Function Block in rung 10 Rung 9 The BLKMV INT functions set up the COMMREQ Command Block contents When this rung is activated the constant operands are moved into the memory beginning at the address indicated in the instruction The constant operands in this example are defined in the Modbus TCP Read Example in this chapter GFK 2382A Modbus TCP Client 8 31 1 0 ETH_READY READ_REQ COMM REG 14 READ_FLT R003
234. ple Coils forces multiple Coils On or Off If the PLC memory type is a bit type remote device coils are set to the same state as the corresponding bits in the specified PLC memory location If the PLC memory type is byte or word type the remote device coils follow the state of the packed bits contained in the byte or word memory For example if 16 coils are written to a Series 90 30 PLUS Modbus server starting at Q1 from the client PLC memory at R1 containing a value of 0x1111 the following remote server coils will be set Q1 Q5 Q9 and Q13 and the following remote server bits will be cleared WQ2 Q3 Q4 WQ6 Q7 Q8 Q10 Q11 Q12 Q14 Q15 Q16 The COMMREQ Status Word CRS indicates the success or failure of the Write Data COMMRE If the COMMREQ specifies an invalid channel number or any other invalid field the COMMREQ fails and the CRS is set to a non zero value to identify the failure See Communications Status Words on page 8 27 for information about CRS failure codes 8 18 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Command 3004 Example 1 Set Single Register Write one register from AI10 to register address 200 in the remote Modbus TCP server Return the COMMREQ Status word to R10 Use channel 6 a channel previously opened with the Open Modbus TCP Client Connection COMMREQ Dec Hex Word 1 00008 0008 Length of Channel command Data Block Word 2 00000 0000
235. pplication request Check for valid COMMREQ command code If problem persists contact discarded request GE Intelligent Platforms Bad remote application request Try to validate the operation of the remote node If problem persists discarded request contact GE Intelligent Platforms Can t locate remote node Error reported when message received where IP MAC address cannot discarded request be resolved Error may indicate that remote host is not operational on the network Check that remote host is operational on network and its addresses are correct COMMREQ Bad task ID Message from PLC for unknown Ethernet Interface task Check programmed COMMREQ function block COMMREQ Wait mode not Check COMMREQ to make sure sent in no wait mode allowed Configured gateway address bad Error in configuration Verify that IP address Subnetwork Mask and can t talk off local net default Gateway IP address are correct Connection to remote node failed Underlying communications software detects error transferring data resuming without it resuming If persistent error check connection to LAN and operation of remote node GFK 2382A Chapter 11 Diagnostics 11 7 PLC Fault LAN controller fault restart LAN HW fault perform a power cycle If problem persists contact GE I F Intelligent Platforms LAN controller Tx underflow Internal system error If problem persists contact GE Intelligent attempt recovery Platforms LAN controller unde
236. program block declaration in the server ladder program to be used with access to remote L memory These words are required only for access to such memory and will be ignored if the Memory Type field is not P or L The Program Name Words 24 27 and Program Block Name Words 28 31 must have each pair of ASCII characters reversed within the PLC memory For example the name MARY M 4DH A 41H R 52H Y 59H would have 414DH in the first word and 5952H in the second word 6 16 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Send Information Report 2010 The Send Information Report COMMREQ requests that a particular block of memory within the PLC CPU reference tables be transferred periodically from an Ethernet interface to a host application SRTP server The Command Block specifies the repetition period the number of transfers to the server to perform and the timeout allowed in waiting for each transfer to complete The first send is performed immediately regardless of the period specified Note Send Information commands are used for communication with non PLC devices Example Command Block Establish a channel Channel 7 to a remote Host application server at IP address 10 0 0 1 Return the COMMREQ Status word to R10 Send local PLC registers R50 R57 to remote host Repeat the send 10 times once every 7 seconds with a timeout of 500ms for each
237. pter Modbus TCP Client S This chapter explains how to program communications over the Ethernet network using Modbus TCP Channel commands This chapter applies only to PLCs being used as client PLCs to initiate Modbus TCP communications The Communications Request The COMMREQ Function Block and Command Block Modbus TCP Channel Commands Status Data Controlling Communications in the Ladder Program Differences between Series 90 30 PLUS and Series 90 Modbus TCP Channels GFK 2382A 8 1 The Communications Request Communications Request is a term used to describe all the user elements required for correctly initiating Channel commands in the client No programming of Communications Requests is required for devices acting as servers Structure of the Communications Request The Communications Request is made up of the following elements The figure below illustrates the relationship of these elements The COMMREQ Function Block ladder instruction The COMMREQ Command Block The Channel Command Status Data COMMREQ Status word LAN Interface Status and Channel Status bits The logic program controlling execution of the COMMREQ Function Block CONTROL COMMREQ LOGIC FUNCTION BLOCK INITIATES COMMREQ gt So AETS BLOCK COMMREQ OUTPUTS EOR COMNREG COMMAND BLOCK FUNCTION CONMMPES TATU COMMAND gt WORD BLOCK ADDRESS ADDRESS DETAILS OF THE CHANNEL COMMAND OMMREQ
238. ption log and configuration parameters Password security for commands that change station parameters or operation For remote Station Manager operation over the Ethernet network the Ethernet interface uses IP addressing The Ethernet interface cannot send or receive remote Station Manager messages that are sent to a MAC address For complete information on the Station Manager functions refer to the TCP IP Ethernet Communications for Series 90 30 CPU372PLUS and CPU374PLUS Station Manager Manual GFK 2383 Firmware Upgrades The embedded Ethernet interface firmware is upgraded using the WinLoader software utility along with the rest of the CPU firmware WinLoader seamlessly upgrades first the CPU firmware and then the embedded Ethernet firmware without intervention Any additional Ethernet Interface module in the PLC can have its firmware explicitly upgraded by specifying the rack and slot location of the module to the WinLoader utility Built In Web Server The enhanced Ethernet interface provides built in Web Server capability Web pages can be stored and maintained on the Ethernet interface and served up via the web to standard web browsers A basic set of predefined web pages in English is provided they include a home page Reference Table data PLC Fault Table and I O Fault Table Pages can be stored to the Ethernet interface via FTP SRTP Client Channels SRTP channels can be set up in the PLC application program SRTP suppor
239. r Address RO0010 To 2R00010 OK Cancel Binary uses 1s and Os to represent the bits in a byte or word of data If a discrete bit is overridden for the l Q M or G tables the bit is underlined Dec signed decimal for one word of data Valid range is 32768 to 32767 Dec unsigned decimal for one word of data Valid range is 0 to 65535 Hex a four digit hexadecimal value for one word of data The value has 16 as a prefix for example 16 4241 Valid range is 16 0000 to 16 FFFF ASCII ASCII representation of two 8 bit values For example a hex value of 16 4142 appears as A B ASCII display requires Internet Explorer 4 0 or Netscape 4 7 or later DbIDecimal signed decimal for a double word 32 bits Valid range is 2 147 483 648 to 2 147 483 647 This format is only available for word type memory R AI AQ P and L DbIDecimal unsigned decimal for a double word 32 bits Valid range is O to 4 294 967 295 This format is only available for word type memory R AI AQ P and L Real 7 decimal digits plus a decimal point and exponent if necessary for example 123 4567 1 234567e 038 This format uses 2 words or 32 bits This format is only available for word type memory R AI WAQ P and L The range is 1 401298e 045 to 3 402823e 038 Blank The associated cell or row will have no value or reference address header Saving Reference Table Settings You can save up to 10
240. r bit and Detailed Channel Status bits to indicate a non fatal timeout error The transfer can still complete even after a timeout occurs As a result an application can choose what to do if one occurs If the timeout value is specified as zero no timeout errors will be reported 6 18 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A iG For most applications a timeout is not needed because the send period acts as a timeout Word 12 should be zero for no timeout However there are two circumstances where a timeout is recommended f number of time units Word 11 is zero so that a subsequent transfer is issued as soon as the previous transfer completes and no period errors are reported In this case a timeout value can be specified so that timeout errors will be reported by the Channel Error bit Ifthe send period is very long minutes or hours In this case a shorter timeout value can be specified so the application doesn t have to wait for the send period to expire before taking action Word 13 Local PLC Memory Type Words 13 14 specify the location in the local PLC where the Ethernet interface will get the data to be written to the remote SRTP server Valid values for Word 13 are listed for Establish Read Channel Word 14 Local PLC Memory Starting Address Word 14 determines the starting address in the local PLC from which the data is to be sent The value entered is the offset
241. r run overrun Internal system error If problem persists contact GE Intelligent resuming Platforms LAN data memory exhausted The Ethernet Interface does not have free memory to process check parameters resuming communications If problem persists contact GE Intelligent Platforms LAN duplicate MAC Address A frame was received in which the source MAC Address was the same resuming as this station s MAC Address All stations on a network must have a unique MAC address Immediately isolate the offending station it may be necessary to turn it off or disconnect it from the network This station remains Online unless you intervene to take it Offline LAN I F can t init check Internal system error If problem persists contact GE Intelligent parameters running soft Sw utl Platforms LAN I F capacity exceeded Verify that connection limits are not being exceeded discarded request LAN interface hardware failure Replace the Ethernet Interface switched off network LAN network problem exists Excessive backlog of transmission requests due to excessive traffic on performance degraded the network For a sustained period the MAC was unable to send frames as quickly as requested If problem persists contact GE Intelligent Platforms LAN severe network problem External condition prevented transmission of frame in specified time attempting recovery Could be busy network or network problem Check transceiver to make sure it is securely
242. ramming for Channel Commands The COMMREQ function for a Channel command must be initiated by a one shot That will prevent the COMMREQ from being executed each CPU scan which would overrun the capability of the Ethernet interface and possibly require a manual restart Checking certain status bits before initiating a COMMREQ function is also important In particular the LAN interface OK bit should be used as an interlock to prevent execution of the COMMREQ when the Ethernet interface is not operational After initiating a COMMREQ on a channel no further COMMREQs should be issued to that channel until a non zero COMMREQ status word has been returned to the program from the Ethernet interface Every ladder program should do the following before initiating a COMMREQ function 1 Initiate the COMMREQ function with a one shot This prevents sending the same COMMREQ Command Block more than once 2 Include at least the LAN interface OK bit in the LAN interface Status Word as an interlock contact for the COMMREQ function 3 Zero the word location you specify for the COMMREQ status word and FT Outputs of the COMMREQ function block before the COMMREQ function is initiated 4 Move the command code and parameters for the Channel command into the memory location specified in the IN input of the COMMREQ Function Block before the COMMREQ function is initiated An example ladder program segment on the next page illustrates these points COMMREQ Exampl
243. rd It is critical to monitor the CRS word for each COMMREQ function First zero the associated CRS word before executing the COMMREQ function When the CRS word becomes non zero the Ethernet interface has updated it If the CRS word is updated to a 1 the Command Block was processed successfully by the Ethernet interface If the CRS word is updated to a value other than 1 an error occurred in processing the Command Block Do not use data received from a server until the CRS word for that channel is 1 In addition do not initiate any additional commands to a channel until the CRS word has been updated The exception to this rule is when you want to terminate a command by using the Close Modbus TCP Connection command Monitoring the Channel Open Bit This bit is 1 when a Channel has successfully established a connection with a remote server and is 0 when a Channel has been closed The Channel Open Bit is meaningful when the CPU is in Run mode and the particular channel is being used by Modbus TCP The Channel Open Bit is set at the same time the successful status is returned to the CRS word for the Open Modbus TCP Connection COMMREQ Sequencing Communications Requests If the Ethernet interface receives Command Blocks from the PLC CPU faster than they can be processed the Ethernet interface will log an exception event 1Bh Entry 2 000Eh and will log the PLC Fault Table entry Backplane Communications with PLC Fault Lost Request O
244. rd 14 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block GFK 2382A Modbus TCP Client 8 21 Mask Write Register Request to a Modbus Server Device 3009 The Mask Write Register Request to a Modbus Server Device COMMREQ is used to modify the contents of a specified remote device register using a combination of an AND mask OR mask and the current register s value This function is used to set or clear individual bits in a register The register is modified per the following algorithm Register value Current register value AND And Mask Value OR OR Mask Value AND NOT And Mask Value Command 3009 Example Mask Write Register Modify register at address 200 in the remote Modbus TCP server and clear all bits except bit 0 Return the COMMREQ Status word to R10 Use channel 6 a channel previously opened with the Open Modbus TCP Client Connection COMMREQ Dec Hex Word 1 00008 0008 Length of Channel command Data Block Word 2 00000 0000 Always 0 no wait mode request Word 3 00008 0008 Memory type of CRS word R Word 4 00009 0009 CRS word address minus 1 R10 Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03009 0OBC1 Mask Write Register to a Modbus TCP Server Device Word 8 00006 0006 Channel number 6 Wor
245. rd and the FT Outputs of the COMMREQ Function Block before the COMMREQ function is initiated 4 Move the command code and parameters for the Channel command into the memory location specified by the IN input of the COMMREQ Function Block before the COMMREQ function is initiated Note When using a Write Data or Read Write COMMREQ data is not read from the local PLC synchronously with execution of the COMMREQ A number of CPU sweeps may occur before the data is read It is recommended that the data not be changed until after the COMMREQ Status Word indicates completion of the command The sample ladder program segment starting on the next page illustrates how to incorporate these important points into your program 8 28 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A COMMREQ Example The input values for the Block Move Functions in this example are taken from the Open Modbus TCP Connection 3000 Modbus TCP Read 3003 and Close Modbus TCP Connection 3001 examples in this chapter Named variables are used in this example to make the ladder program easier to follow LANIFOK is bit 16 of the LAN Interface Status bits LAN_OK is bit 13 of the LAN Interface Status bits All other nicknames can be assigned as you choose LANIFOK LAN_OK ETH_READY 1 1 1 H 4 2 ETH_READY DO_OPEN OPEN_REQ ii j es 1 ETH_READY OPEN_REQ move WORD OPEN_FLT 3 1 4 R 1 4 o IN R0001
246. rd of the DCS words indicates when the channel is active If a channel error is indicated by the Channel Error bit after the channel is established the first word of the DCS words contains an error code indicating the cause of the error The second word of the DCS words indicates whether the channel is active or idle The Detailed Channel Status words are updated in the Ethernet interface every time the status of the channel changes If the channel is operating with a fast repetition period the status words may change faster than the ladder executes the COMMREQ to retrieve them Therefore some status values may be missed by the program logic The DCS words location is specified in the Retrieve Detailed Channel Status Command The contents of these status words are defined below The initial value of the Detailed Channel Status words is all zeros DCS words are reset to zero when The Ethernet interface is powered up or restarted The CPU transitions from STOP to RUN A channel abort COMMREQ aborts the channel Format of the Detailed Channel Status Words DCS Words Display the DCS status words in hexadecimal form to differentiate the high and low bytes DCS Word in Hex Format Word 2 Word 1 High Low 0000 00 00 Channel Active 0001 channel active 0000 channel not active Minor Error Codes high byte Success and Major Error Codes low byte GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 23 s Prog
247. rencelmplementation 7622 fb Referencelmplementation 9922 PX7i 7601 AX7i 7602 AX7i5101 RX7i 5102 ENIU9030 7603 CPU374_DIT 7605 B CPU374_DIT 5105 i CPU364_DIT 7606 CPU364_DIT 5106 i VMENIU 1 UR G60 3 B ComCoeTestMkVle 7616 Fuit Be Fui2 of Pre oducer Active Configuration Server EGD Server Online EGD Server 172 131 1 25 Produced Variables Name Access Value Location lt Healt Description E0122_Var01 E0122_Var02 E0122_Var03 E0122_Var04 E0122_Var06 E0122_Var07 E0122_Var08 E0122_Var09 0122 Varl0 0122_Varl1 E0122_Varl2 E0122 Varl3 E0122_Varl4 E0122_Varl5 0122 Varl6 E0122 Varl7 0122 _Varl8 0122 Var13 E0122_Var20 Chapter 11 Diagnostics ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly ReadOnly 122 0000 0 N A 122 0002 0 N A 122 0004 0 N A 122 0008 0 N A 122 0020 0 N A 122 0024 0 N A 122 0032 0 N A 122 0040 0 N A 122 0048 0 N A 122 0052 0 N A 122 0054 0 122 0056 0 122 0060 0 122 0064 0 122 0072 0 122 0080 0 122 0088 0 122 0096 0 122 0098 0 Mirror Server C Program Files GE Industrial Systems EGD Management Tool MirrorCache 11 29 Troubleshooting Common Ethernet Difficulties Some common Ethernet errors are described below Ethernet errors are generally indicated in the PLC Fault Table and the Ethernet
248. ress minus 1 R10 Reserved Reserved Write to a Modbus TCP Device Channel number 6 Modbus Function Code Write Single Coil Local PLC Memory Type Local PLC Starting Address Address in the Remote Device Number of Coils in the Remote Device Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Write Data to Modbus TCP device Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 5 Write Single Coil Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC from where the Ethernet interface will get the data to be written to the remote PLC Valid values for Word 10 are listed on page 8 14 Word 11 Local PLC Starting Address Word 11 determines the starting address in the local PLC from which the data is to be written The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 10 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Word 12 Remote Device Address Word 12 specifies the destination coil address in the Modb
249. rk stack hangs on to the TCP resources associated with a connection after it is closed It applies to the initiator of the close which is almost always the client side This time is referred to as the TCP Linger Period Once the TCP Linger Period expires 60 seconds in the current OS implementation the TCP resources are released Application developers using client channels need to be aware of this behavior when designing their logic There are a finite number of TCP resources allocated to client channels and if channel connections are brought up and down so fast that these resources are depleted then the application may have to wait until a TCP resource frees up in order to establish another client channel a COMMREQ Status of 0xA890 is returned if no TCP resources are currently available application should wait and retry again SRTP Client Channels provides features that help the user preserve TCP connections These include a period time where one can establish an SRTP Channel and specify the channel to run at a given interval or run as fast a possible One can also specify a number of iterations or run forever Additionally SRTP Channels allows channel re tasking of an active channel to the same remote device where the parameters of an active channel such as changing the channel command type Read Write number of repetitions time periods local memory address remote memory address etc can be changed SRTP Channels also allows cha
250. rocessed successfully If the status word is updated to a value other than 1 an error has occurred Any data returned by that command should not be used until the problem is corrected and the status word indicates success It is critical to monitor the COMMREQ status word for each COMMREQ function If after executing a COMMREQ function the COMMREQ status word is zero 0 the success Output is ON and the FT Output is OFF the Command Block has been sent to the Ethernet interface but no status has been returned If this condition persists check the PLC Fault Table for information Format of the COMMREQ Status Word The CRS word location is specified in Words 3 and 4 of the Command Block Status Word in Hex Format f High Low 00 00 Minor Error Codes high byte Success and Major Error Codes low byte There are several points to remember when interpreting the contents of the COMMREQ Status word 1 Display the Status Words in hexadecimal form to differentiate the high and low bytes One way to do this is to use a MOVE WORD function block to display the hexadecimal value within the ladder program 2 The Ethernet interface will never send a zero for the COMMREQ Status word to the PLC CPU The application program should zero the COMMREQ Status word before issuing the COMMRE Q function and then check for a non zero value indicating that the Ethernet interface is responding to the COMMREQ A MOVE WORD function block can be used to zero
251. rted in the Exchange Status word by setting it to 0 once a non zero value is written to it The program should also monitor the LAN Interface OK Status bit see chapter 8 Diagnostics for each of the Ethernet interfaces performing EGD The Exchange Status word is invalid if the bit is 0 Note that when an EGD exchange message received from the network contains an invalid Protocol Version Number the Ethernet interface cannot decode the message in order to identify the exchange In this case the Exchange Status Word cannot be updated GFK 2382A Chapter 4 Ethernet Global Data 4 15 Exchange Status Word Error Codes The following table shows the error codes that can be written to the Exchange Status word in the Producer P and Consumer The Exchange Status Word value for each exchange may be displayed via the STAT G Station Manager command The Exchange Status Word values are displayed within parentheses Value PA Dec P C Error Description Produced Initial value until the first producer period refresh No new status occurs 0 P C event has occurred Consumed The data has not been refreshed since the previous consumption scan and the consumer timeout has not expired i No error The exchange is producing data currently exists This value should be ignored in the Output Disabled PLC modes 1 c No error data The data has been refreshed on schedule since the previous consumed consumption
252. s 0 no wait mode request Memory type of COMMREQ status word R COMMREQ status word address minus 1 R10 Reserved Reserved Establish Read Channel command number Channel number 5 Number of read repetitions read 10 times Time unit for read period 3 seconds Number of time units for read period every 7 seconds Timeout for each read 500 ms Local PLC Memory type at which to store data R Local PLC Starting address at which to store data R100 Remote PLC Memory type from which to read data R Remote PLC Starting address from which to read data R50 Remote PLC Number of memory units 8 registers Remote PLC Network Address type IP Address Remote PLC Network Address length in words 4 Remote PLC Register 1 of IP address 10 Remote PLC Register 2 of IP address 0 Remote PLC Register 3 of IP address 0 Remote PLC Register 4 of IP address 1 Remote PLC Program Name needed for access to remote P or L zero terminated and padded Remote PLC Program Block needed for access to remote L zero terminated and padded Word 4 COMMREQ status word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 requests that a read channel be set up If the command is processed successfully it will result in attempting the specified number of transfers from the server to the client
253. s and other nodes reachable through routers The gateway IP address must be configured Internet access via web pages served up to standard web browsers Enhanced Ethernet feature not available prior to CPU374 PLUS Release 12 00 Enhanced Ethernet feature not available prior to CPU374 PLUS and CPU372 PLUS Release 12 10 1 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A CPU372 PLUS and CPU374 PLUS Ethernet Interface Specifications Ethernet processor speed 200 MHz Connectors Station Manager RS 232 Port 9 pin female D connector Two 10BaseT 100BaseTX Ports 8 pin female shielded RJ 45 LAN IEEE 802 2 Logical Link Control Class IEEE 802 3 CSMA CD Medium Access Control 10 100 Mbps Number of IP addresses One Number of Ethernet Port Two both are 10BaseT 100BaseTX with auto sensing RJ 45 Connectors connection Embedded Ethernet Switch Yes Allows daisy chaining of Ethernet nodes Serial Port Station Mgr Port RS 232 DCE 1200 115200 bps Programmer Compatibility The CPU372 PLUS and CPU374 PLUS require the Machine Edition PLC Logic Developer PLC programmer for configuration and programming For specific programming software version requirements refer to the Important Product Information document provided with your CPU CPU372 PLUS and CPU374 PLUS Ethernet Interface Ports The embedded Ethernet interface provides two auto sensing 10Base
254. s are invalid Status Brief Description Bits 1 Port 1 full duplex 2 Port 1 100Mbps 3 Port 2 full duplex 4 Port 2 100 Mbps 5 8 Reserved 9 Any Channel Error error on any channel 10 12 Reserved 13 LAN OK 14 Resource problem 15 Module Overtemperature RX3i only 16 LAN Interface OK 17 Data Transfer Channel 1 18 Channel Error Channel 1 47 Data Transfer Channel 16 48 Channel Error Channel 16 49 80 Reserved The LAN Status bits bits 1 16 are described in chapter 9 Diagnostics They monitor the health of the Ethernet interface itself Bit 16 LAN interface OK Bit This bit is set to 1 by the Ethernet interface each PLC scan If the Ethernet interface cannot access the PLC the CPU sets this bit to 0 When this bit is 0 all other Ethernet Interface Status bits are invalid GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 3 Channel Status Bits The Channel Status bits provide runtime status information for each communication channel Each channel has two status bits the meaning of the channel status bits depends upon the type of communication performed on that channel SRTP channels operation provides two Channels Status bits for each SRTP channel a Data Transfer bit and a Channel Error bit Bits 17 19 21 47 Data Transfer Bit Typically a channel is used to perform repetitive reads or writes The Data Transfer bit pulses 0
255. s subtracting 1 from the intended address Word 7 Channel Command Number Word 7 requests that a write channel be set up If the command is processed successfully it will result in attempting the specified number of transfers from the client to the server GFK 2382A Chapter 6 Programming SRTP Channel Commands 6 13 Word 8 Channel Number Word 8 specifies the channel to be used for the write This value must be in the range of 1 32 If the channel number is out of range a command error indication will be placed in the COMMREQ Status word If the channel number is the same as a channel already in use the channel will be re tasked to perform this new command Word 9 Number of Write Repetitions Word 9 specifies the number of writes to be performed before automatically completing the communications request and closing the channel If this value is set to 1 only a single write will be issued If this value is set to 0 writes will be issued on the requested period until the channel is aborted Word 10 Time Units for Write Period Words 10 11 together define how often the write is to be performed write period Word 10 specifies the time unit such as seconds or minutes for the write period Word 11 specifies the number of those units The choices for the time units are Value Meaning 1 hundredths of seconds 10 ms 2 tenths of seconds 100 ms 3 seconds 4 minutes 5 hours Word 11 Number of Time Units for Write
256. scribes the implementation of the Modbus TCP Server feature for the CPU372 PLUS and CPU374 PLUS products Modbus TCP Server Reference Mapping Modbus Function Codes GFK 2382A 7 1 Modbus TCP Server The Series 90 30 products listed below support Modbus TCP Server functionality CPU374 PLUS with primary firmware version 12 10 or later CPU372 PLUS all versions Ethernet Interface IC693CMM321 FH or later For information about this product refer to the TCP IP Ethernet Communications for Series 90 PLCs User s Manual GFK 1541 Modbus TCP Server Connections The Modbus TCP Server supports up to 16 simultaneous connections These connections are not shared with any other applications Other TCP based application protocols such as SRTP Server use a different set of TCP connections Modbus Conformance Classes The Series 90 30 PLUS Modbus TCP Server supports Modbus Conformance classes 0 1 and 2 The CPU374 PLUS and CPU372 PLUS modules have been certified by the Modbus TCP Conformance Test Laboratory to be in conformance with Conformance Test Policy Version 2 1 Server Protocol Services The Modbus TCP Server responds to incoming Request Connection Terminate Connection and Request Service messages The client with which the server is interacting should wait for the server s response before issuing the next Request Service otherwise requests could be lost There is no inactivity timeout in the server If a client
257. se when the PLC is cleared Ethernet Global Data configuration is maintained only in the CPU Locally Edited Configuration Data If the PLC configuration was not stored from the programmer the CHSOSW and CHPARM Station Manager commands can be used to locally edit Ethernet configuration or AUP configuration data These Station Manager commands are not active if the PLC configuration has been stored from the programmer Locally edited configuration changes cannot be retrieved into the PLC and loaded to the programmer Locally edited configuration changes are always overwritten when a PLC configuration is stored into the PLC from the programmer 3 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Initial IP Address Assignment The Series 90 30 CPU372 PLUS and CPU374 PLUS come from the factory with a default IP address 0 0 0 0 for its embedded Ethernet interface This default address is not valid on any Ethernet network so an initial IP address must be assigned for initial network operation such as connecting the programmer to download the first hardware configuration The initial IP address must be selected for proper operation with your network and application see your network administrator for the proper initial IP address value One way to assign the initial IP address is via the CHSOSW command from a local serially connected Station Manager terminal See the TCP IP Ethernet Communications for
258. sed from the beginning of PLC memory for the memory type and mode specified in Word 13 This offset will be in bits bytes or words depending on the mode specified for example if Word 13 16 and Word 14 2 then the starting address will be l9 Valid ranges of values depend on the PLC s memory ranges Word 15 Remote PLC Memory Type Words 15 16 specify the memory type and starting address in the remote PLC where the data is to be written Valid values for Word 15 are listed under Establish Read Channel If P memory is used you must specify a Program name in Words 24 27 If L memory is used you must specify a Program name in Words 24 27 and a Program Block name in Words 28 31 Word 16 Remote PLC Memory Starting Address Word 16 determines the starting address in the remote PLC where the data is to be written The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 15 This offset will be either in bits bytes or words depending on the mode specified for example if Word 15 16 and Word 16 9 then the starting address will be 165 Valid ranges of values depend on the remote PLC s memory ranges Word 17 Remote PLC Number of Memory Units Word 17 specifies the amount of data to be transferred The value entered is the number of memory units to be transferred where the size of a memory unit is either a bit byte or word as specified in Word 15 For example if
259. ss in the Remote Device Number of Input Discretes to Read from the Remote Device Unit Identifier Word 4 CRS word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 Channel Command Number Word 7 identifies the COMMREQ as a Read Data from Modbus TCP Device command block Word 8 Channel Number Word 8 identifies the channel number previously allocated for communication with the remote Modbus TCP server Word 9 Modbus Function Code Word 9 specifies Modbus Function Code 2 Read Input Discretes Word 10 Local PLC Memory Type Words 10 11 specify the location in the local PLC where the Ethernet interface will store data received from the remote device Valid values for Word 10 are listed on page 8 14 Word 11 Local PLC Memory Address Word 11 determines the starting address in the local PLC in which the data from the remote device is to be stored The value entered is the offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 10 This offset will be either in bits bytes or words depending on the mode specified Valid ranges of values depend on the PLC s memory ranges Be sure this area is large enough to contain the requested data without overwriting other application data Word 12 Remote Device Address Word 12 specifies the address in the remote Modbus TCP device Word 13 Number Registers in
260. ssage 1A11H Invalid slot number detected in a mailbox message l 1B11H nvalid rack number detected in a mailbox message 1D11H Bad text buffer address in dual port memory 2111H Unable to find control data required to send a mailbox message to the PLC 2211H Timed out waiting for availability of mail communications with the PLC 2311H Invalid task ID detected while attempting to send a mailbox message to the PLC 2411H Unable to send mailbox message to PLC because the mail queue is full 2611H Unable to communicate with PLC 2711H Backplane driver not initialized or unable to acquire a dual port memory semaphore 2A11H The backplane driver could not access the PLC 2B11H nvalid binding on the message sent to the backplane driver 2C11H The message could not be sent to its destination because the mailbox was not open 2D11H The maximum number of transfers to the destination is already taking place 2E11H The maximum number of transfers of this transfer type is already taking place 2F11H Cannot obtain a backplane transfer buffer continued 11 18 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Minor Error Codes for Major Error Code 11H at Remote Server PLC Continued from previous page erased SRTP Error Description 3011H O 1H Cannot obtain resources other nan Cannot obtain resources other than backplane transfer buffers transfer buffers 3711H The backplane t
261. st start with a semicolon character All characters in the same line following a semicolon are ignored Blank lines are ignored The maximum line length in the AUP file is 80 characters Any line including comments that exceeds this length will cause errors in processing Example The following example sets the station manager password to system and the IP time to live for point to point Ethernet Global Data exchanges to 4 A 4 AUP_0_1 stpasswd system set the password to system gucast_ttl 4 i set the EGD unicast IP TTL to 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Advanced User Parameter Definitions The following Advanced User Parameters can be configured for the Ethernet interface System Memory Parameters task b Default Range staudp Remote command UDP port 18245 4745H 0 65535 ffffH stpasswd Station Manager password only visible from system 0 8 characters case MODIFY prompt sensitive no spaces Backplane Driver Parameters task c Default Range crsp_tout CPU response timeout Amount of time to wait for 60 seconds 10 3600 E10H the CPU to respond to a request sent through the PLC Driver chct_comp HCT compatibility option Allows Ethernet interface to 0 OH 0 1 ignore SRTP header errors typically generated by remote HCT devices that were not detected in previous Series 90 products 0 HCT compatibili
262. support for client and server capability O state unless there is user intervention E Uses user defined Advanced Parameters 11 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A LED Pattern Where Possible Cause Corrective Actions Stopped Q EOK OFF A Fatal Hardware Make sure the PLC has power O LAN OFF Error Examine PLC Fault Table for clues a STAT OFF Hardware i Recheck PLC Programmer Failure configuration Power off baseplate inspect the Interface for loose components reseat the module and Restart If the problem persists replace the PLC hardware x EOK Slow blink B Software corrupt Connect a PC Software Loader and LAN Slow blink load new software 4 STAT Slow blink Sowar Loader All LEDs blink in unison EOK Slow blink C Did not configure Use the PLC Programmer O LAN OFF slot using the PLC configuration software to configure O STAT OFF Waiting for Programmer the Interface then store the Configuration CPU not configuration to the PLC CPU from PLC communicating Power cycle the PLC with Ethernet Clear faults and Restart Interface Interface Condition can last a maximum of 5 minutes E EOK Blinking error Unrecoverable See the list of blink codes on the next O code hardware or page O LAN Off runtime failure STAT Off pea EOK Slow blink D Interface s IP Use the PLC Programmer to 480 LAN ON Traffic OFF
263. t the command parameters were valid but there was an error in establishing a channel Chapter 11 lists the Major and Minor error codes that may be returned in the COMMREQ status words Do not use data received from a server until the COMMREQ status word for that channel is 1 or the Data Transfer bit goes to 1 6 30 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A iG New Features of SRTP Channels This section lists differences between earlier implementations of SRTP Channels in Series 90 family PLCs and the new implementation that is used for both Series 90 30 PLUS and PACSystems Ethernet interfaces 1 The TCP Connect Timeout for an SRTP Channel was 90 seconds For the Series 90 30 PLUS and PACSystems interfaces a new SRTP AUP parameter SRTP Channel TCP Connect Timeout specifies the amount of time to wait for a TCP connection to be established hconn_tout The default value is its maximum 75 seconds The minimum value is 10 milliseconds 2 For Series 90 30 PLUS and PACSystems there is now a TCP Linger Period The TCP Linger Period is the period of time the OS Network stack hangs onto the TCP resources associated with a connection after it is closed The TCP resources from a channel that was stopped become available again after the 60 second TCP linger period expires The earlier Series 90 Channels implementation had no linger period 3 A Run to Stop transition now causes an Abrupt
264. t for new projects If the Ethernet Global Data node does not appear in the Navigator Window immediately beneath the Data watch Lists right click the PLC target icon Select Add Component and then select Ethernet Global Data The Ethernet Global Data component should be displayed beneath Data Watch Lists Installing the EGD Configuration Server The EGD Configuration Server tool is supplied with the Machine Edition software but it is not automatically installed with Machine Edition If the EGD Configuration Server has not already been installed on the computer follow these steps to install and configure the tool 1 In Windows Explorer navigate to the directory where the Machine Edition software is installed 2 Open the folder named EGD Installs 3 Select the file EgdCfgServerSetup msi 4 Double click on the file to install the EGD Configuration Server Customizing the EGD Configuration Server After installing the EGD Configuration Server it can be customized as described below 1 In Machine Edition click on the Options tab in the Navigator window a SFC H State Logic Diagram H Text B Import Export E Invalid Character Replacement 5 6 Machine Edition 2 In the Machine Edition folder select the EGD item to display the configuration options for the configuration server Local Server Cache Path The path to be used for ee caching data from the con
265. t to and assumes no responsibility for the accuracy completeness sufficiency or usefulness of the information contained herein No warranties of merchantability or fitness for purpose shall apply indicates a trademark of GE Intelligent Platforms Inc and or its affiliates All other trademarks are the property of their respective owners Copyright 2009 GE Intelligent Platforms Inc All Rights Reserved Contact Information If you purchased this product through an Authorized Channel Partner please contact the seller directly General Contact Information Online technical support and http www ge ip com support GlobalCare Additional information http Awww ge ip com Solution Provider solutionprovider ip ge com Technical Support If you have technical problems that cannot be resolved with the information in this guide please contact us by telephone or email or on the web at www ge ip com support Americas 1 780 420 2010 if toll free 800 option is unavailable Technical Support Email support ip ge com Europe the Middle East and Africa 4352 26 722 780 if toll free 800 option is unavailable or if dialing from a mobile telephone Asia Pacific support ip ip ge com ini i 21 3217 4826 su cn i i customercare cn ip ge com China Contents DEVE CRUE sais waa faa ccc weenie staat eis eal san eta wed eats ence dba cn baa Sas ele eas awe 1 1 Other Documents 3 s 4 eshte tisk Sheed tise di
266. te Abe edi Me eet ieee tet 1 2 OV ERVICW ss II EA A A ET P AE tactic aches vanced es nena tiv nates E E TT 1 3 Additional Ethernet Interfaces for the Series 90 30 PLC uu eeceeeeeeeeenteeeeeeenaes 1 3 CPU372 PLUS and CPU374 PLUS Ethernet Features 0 cccceeeeeeeeeeteeeeeneeees 1 4 CPU372 PLUS and CPU374 PLUS Ethernet Interface Specifications 1 5 CPU372 PLUS and CPU374 PLUS Ethernet Interface Ports 1 5 Station Manage i e aeseceueideuccishastacchs E E 1 6 Firmware WU porades cists ccsshoarieiets neea E E EE 1 6 Built In Web Server oaoiiaaiiiai iaer tiini deve AAA Sanae ANEAN AARAA aR 1 6 SRTP Client Channels jadore iaeiaiai nett iiair ONEAN AENEA 1 6 Modbus TCP Client Channels ssseesessssinssesrnsseerreserrstttrrstttrrrsstinnssttnrssttnnssrennnt 1 7 Ethernet Global Data EGD eesssssesrresesrrrssrrrresisrnndinraastentdarinaeadsnnadanuaanaanuaannaana 1 7 Installation and StamUp eseria iia eter eens le te cee 2 1 Module Appearance uiae iiae aaa e eraai aa eaa aaar iada eiad daaa 2 2 Installing the CPU372 PLUS or CPU374 PLUS in the PLC neeesser 2 3 Ethermet LED Senari or TAE TA nee eee 2 4 LAN LED Operation fs acter tactic tees iol ie dette eat bel ae a a a ea edad retin lees 2 5 STAT LED Operations e a gedus da sbatieaseneae canes anceade sated cans Eaa 2 5 EOK LED Ope ration rinate peel nese eet ees ete det i a a ae 2 5 Ethernet Port Connectors cence fA decane rn arinaa AiAi agen ess O TAES
267. tennne 6 2 Monitoring the Channel StatuS seeeseesrrissriesrsrrrsrirrssrrirrdsrriieeiirnrsrerinderiuandinana 6 3 Executing a Channel Command 1 00 0 ceceeccceeeeeeeeeeeeeeeeneeeeeecieeeeetiieeeeeetieeeestnieeeeeeaa 6 5 COMMREQ Format for Programming Channel Commands 0 cccceeceeeeeeeeeeeenteeeeees 6 6 The COMMREQ Command Block General Description cccccceeseeeeeeeeeees 6 7 Establish Read Channel 2003 00 ecccceeceeeeeeeecteee seen ee nAn EA EARS eieeeeeteeeeeteeeesnaeeeeeeaa 6 9 Establish Write Channel 2004 eeccceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeeaeeeseneaeeesennaeeeeeeaneees 6 13 Send Information Report 2010 rissani aaa aidi aia a 6 17 Abort Channel 2001 e e a 6 20 Retrieve Detailed Channel Status 2002 a ssseeesrsieerrrisrrrreeirnnssrerraerinneeinrnaaiennasereinaant 6 21 Monitoring the Detailed Channel Status Words 0 cccccceseeeeeeeeeeeeeeeenieeeeeenaeees 6 23 Programming for Channel Commands c ccccceeceeeeeeeeeeeeeeeeeeeeeeeaeeeseeeeeeeseeaeeeeeeeaaees 6 24 COMMREG Example iiaeaa t aaea ie i ead aaa aeee ieie 6 24 Sequencing Communications Requests ececcececeeeeeeeeeeeeeeeeeeeeeetsesteaeeeeeees 6 27 Managing Channels and TCP Connections 0 ccceeeeeeeeeeeeeeenieeeeeenneeeeetneeeeees 6 27 Use Channel Re Tasking To Avoid Using Up TCP Connections 05 6 28 Client Channels TCP Resource Management ccccceeeeeeeeeeen
268. th changes for the Ethernet Interface O Initializing 1 m Pressing the Restart pushbutton QO approx 2 6 7 Issuing a Station Manager RESTART command seconds Internal System Error occurring when Interface is operational O A Diagnostics o Hardware Pass QO Failure 2 Software Load caused by a Pressing the Restart pushbutton Load B Detection of corrupt software Request or ve Soft Software X oftware 3 Waiting for IP Address caused by Corrupted X Load g Not configuring Interface using configuration software l Configuring Interface with IP Address 0 0 0 0 l New CPU with no configuration 7 CPU failure to communication with Interface C 4 i i X Pr Continue to Operational State caused by Waiti ng for m IP Address received over network O Configuration from Q PLC CPU max 5 min 10 sec Symbols The LEDs are labeled from top to bottom as follows EOK LAN STAT D x O Waiting for sk IP Address IP address 0 0 0 0 O The symbols used for the LEDs in the chart are OFF ON IP Address Received Slow Blink multiple slow blinking LEDS blink in unison Fast Blink O Operational O Traffic blinks when there is traffic on the line The process symbols use in this chart are Temporary condition requires no intervention Decision point during powerup Operations 7 Interface State normally the Interface remains in a 7 Full
269. th methods allow many consumer devices to simultaneously receive the same data from one producing EGD device If an exchange is Broadcast or Multicast the same exchange must be configured at the producer and at each consumer Each consumer can use all of the data or just a selected portion as configured for the consumed exchanges For more information about Multicasting and Broadcasting refer to chapter 6 Network Administration Multicasting Ethernet Global Data If more than one device on the network should consume a Global Data exchange those devices can be set up as a group The network can include up to 32 numbered groups Groups allow each sample from the producer to be seen simultaneously by all consumers in the group A device can belong to more than one group as illustrated below In the following example device 10 0 0 2 consumes exchanges from Group 2 and from Group 1 Each device in a group responds to the group s assigned ID number from 1 to 32 Note Each device on the network using EGD should have a unique local producer ID If the devices using multicast EGD do not have unique local producer IDs unexpected results can occur when using group addressing for EGD exchanges 4 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Each Group ID corresponds to a Multicast Class D IP address reserved by the Internet authorities The default Multicast IP addr
270. the CRS word 3 A status code of 1 in the low byte and 0 in the high byte indicates that the request was successful All other non zero values indicate errors Refer to the tables below for a complete listing of major and minor error codes 11 14 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Major Error Codes in the COMMREQ Status Word Success or a Major Error Code appears in the low byte of the COMMREQ Status Word Hexadecimal values for the low byte are listed below For many Major Error Codes additional information appears as a Minor Error Code in the high byte of the COMMREQ Status Word Hexadecimal values for the high byte are listed on the following pages Error Status Major Error Description Hexadecimal 01H Successful Completion This is the expected completion value in the COMMREQ Status word 02H Insufficient Privilege at server PLC 04H Protocol Sequence Error The server CPU has received a message that is out of order Call GE Intelligent Platforms for assistance 05H Service Request Error at server PLC The minor error code contains the specific error code For Minor Error codes see the table on page 11 16 06H Illegal Mailbox Type at server PLC Service request mailbox type is either undefined or unexpected Call GE Intelligent Platforms for assistance 07H The server PLC CPU s Service Request Queue is full usu
271. the Command Block contains a syntax error or if the command is local For remote commands with no syntax error it is returned either after the channel is established successfully and the first transfer has completed or if there is an error establishing the channel The location of the COMMREQ status word is defined in the Command Block for the COMMRE Q function Format of the COMMREQ Status Word COMMREQ Status Word Hex Format High Low 00 00 Minor Error Codes high byte Success and Major Error Codes low byte It is critical to monitor the COMMREQ status word for each COMMREQ function Zero the associated COMMREQ status word before executing the COMMREQ function When the COMMREQ status word becomes non zero the Ethernet interface has updated it If after executing a COMMREQ function the COMMREQ status word is zero 0 and the FT Output is OFF the Command Block has been sent to the Ethernet interface but no status has been returned If this condition persists check the PLC Fault Table for information If the COMMREQ status word is updated to 1 the Command Block was processed successfully by the Ethernet interface If the COMMREQ status word is updated to a value other than 1 an error has occurred in processing the Command Block The cause may be Errors in the Command Block the Channel command code or parameters or For an establish command Establish Read Channel Establish Write Channel or Send Information Repor
272. the EGD Commands 1 00 0 cee cccecceeeeeeeeeeeeeeeeeeeeeeseeeaeeeeeeeaeereeeaees 5 3 COMMREG Status Values i s s2cc tetteclaabteccctsazseicaaatdcheug dodge dud aeea e aaas 5 3 Read PEG Memory 4000 cci0tiseetrteiee an ats eet een eee tt eee 5 4 Read PLC Memory Command BIOCK cccececeeceeeeeeeeeeeeieeeeetineeeeeetiieeeeetneeeeneaa 5 4 Write PLE Memory 4001 cescicteccts senecetestbeceteta ce ee EE A REE AAE 5 7 Write PLC Memory Command Block cceeeeeceeeeeeeeeeeeeeeeeeaeeeeeeenaeeesetnaeeeeeeaaes 5 7 Read EGD Exchange 4002 crieririiiniikeeiri inania iniii ied caecteeslesnvetiaeceweeloeioets 5 10 Write EGD Exchange 4003 reser a E E E T T 5 13 Write EGD Exchange Command BIOCK 0 cccceeeeceeeeeeeeeeeeeeenneeeeeeneeeeeenaeeeeeeaes 5 13 Masked Write to EGD Exchange 4004 sssssssssssssrrssesrrssrtrrssrtrrssttrrssttrrssttnnnssrennnet 5 16 Masked Write EGD Exchange Command BIOCK cccceeeeeeeeeeeeeeeeeeneeeeeeaeees 5 16 Masked Write to EGD Exchange Bit Mask and Data Bits eeeeeeeeeeeees 5 18 vi TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Contents Programming SRTP Channel COMMAS sesseccceeeeseeeeeeeeeeeeeeeeeeeeeeeeeseeeeeseneeeeeeenes 6 1 SRTP Channel Commands S a r a E a aa e a aaar 6 2 Channel Operati NS a a a a ade espace r a aa 6 2 Aborting and Re tasking a Channel ssssessssissesrrsseeerresetrrssttrrsttirnssetrrssternnss
273. the multiple exchanges Ethernet Global Data is designed for simple efficient communication of sampled data between devices It is not intended for event notification where the possible loss of a sample of data would be significant Some EGD devices support the concept of an EGD page An EGD page consists of one or more exchanges that are produced on the same schedule to the same destination Pages remove the 1400 byte size limitation of EGD exchanges Machine Edition does not currently show information about EGD pages you will instead see the constituent exchanges for each page The Content of an Ethernet Global Data Exchange Each Ethernet Global Data exchange is composed of one or more data ranges transmitted as a sequence of 1 to 1400 bytes of data The data ranges are commonly called variables they may be configured to correspond to PLC variables The content of the data is defined for both the producer and consumers of the data In this example a producer sends an 11 byte exchange consisting of the current contents of R00100 through R00104 followed by the current contents of l00257 through l00264 Address Length Type Description R00100 5 WORD Conveyor1 in PLC1 100257 1 BYTE Conveyor1 limit switch in PLC1 The same exchange can be configured at each consumer to suit the needs of the application GFK 2382A Chapter 4 Ethernet Global Data 4 3 The Data Ranges Variables in an Ethernet Global Data
274. the producer changing it here may make it impossible to consume the data from the producer Exchange ID Identifies a specific data exchange to be received by the consuming device Exchange ID is defined by the producer changing it here may make resynchronization with the server impossible Adapter The specific Ethernet interface identified by its rack and slot location within Name the consuming PLC Consumed Not used Always displayed as 200 milliseconds not editable Period Update A value in the range 0 to 3 600 000 milliseconds 1 hour The Ethernet Timeout interface will declare a refresh error if the first or subsequent packet of data does not arrive within this time The Update Timeout should be at least double the producer period and should allow for transient network delays The default is 0 indicates no timeout Resolution is in 2ms increments 3 18 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Name Generation for Consumed Variable The EGD configuration server automatically creates consumed variables based on the variable name in the producer The name consists of up to seven characters of the beginning of the target name of the producer followed by an underscore character _ followed by up to 21 characters of the beginning of the variable name of the variable in the producer Because the PLC programming software allows names of up to 32 charact
275. tly When host B communicates with host A it knows from A s IP address that A is on another network the netids are different In order to send data to A B must have the IP address of the gateway connecting the two networks In this example the gateway s IP address on Network 2 is 172 17 0 3 This address would be configured in the Ethernet Interface s module configuration for PLC B as its default gateway address Note that the gateway has two IP addresses 172 16 0 2 and 172 17 0 3 The first must be used by hosts on Network 1 and the second must be used by hosts on Network 2 To be usable a host s gateway must be addressed using an IP address with a netid matching its own 9 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A L Subnets and Supernets Subnets allow a site s network administrators to divide a large network into several smaller networks while still presenting the overall network as one single entity to the outside world Each of the site s interior gateways need only maintain the subnet numbers of other interior gateways instead of every single host on the entire network CPU372 PLUS and CPU374 PLUS support supernetting a technique of configuring the subnet mask to allow communication to multiple subnets The resulting supernet is a block of contiguous subnets addressed as a single subnet Subnet Addressing and Subnet Masks Subnet addressing is an extension
276. to be dropped For SRTP this causes TCP retransmissions repetitive retransmissions can slow the SRTP responses enough that the client detects an application timeout error For EGD this causes samples to be dropped If the consumer misses enough samples it detects a consumer timeout error when that exchange subsequently receives samples the consumer may detect a Data with Refresh error This condition typically arises when intermediate network routers or switches lack the buffering or processing capacity to handle the network load Reduce the volume of traffic on the network or identify and upgrade the network component s that are unable to handle the traffic volume Consult your network administrator for assistance The SRTP channel timeout and period include the time required to establish the TCP connection It is important to consider the connection time when configuring these values If more than one SRTP channel is being established and the CPU372 or CPU374 server has just been restarted or updated with a new hardware configuration the channel timeout and period should be more than one second This allows sufficient time for the high level of TCP traffic required to establish new network connections When first establishing a channel a channel timeout lower than one second may result in a 0190H channel timeout COMMREQ status A channel period lower than one second may result in a 0290H period expired error When power is lost to t
277. to be transferred is specified by the Exchange Data Length Word 18 Words 10 11 Local PLC Memory Starting Address Words 10 and 11 determine the starting address in the local PLC from which data is to be written to the remote EGD exchange The value entered is the 32 bit offset 1 based from the beginning of PLC memory for the memory type and mode specified in Word 9 Word 10 contains the least significant 16 bits of the offset word 11 contains the most significant 16 bits of the offset This offset will be either in bits bytes or words depending on the mode specified For example if Word 9 16 and Words 10 11 2 0 then the starting address will be 19 Valid ranges of values depend on the PLC s memory ranges Word 12 Remote EGD exchange Exchange Signature Words 12 contains the 16 bit exchange signature value to be compared at the remote EGD device For remote PLC s the exchange signature should ordinarily be set to 0 Words 13 14 Remote EGD exchange Producer ID Words 13 and 14 contains the 32 bit Producer ID of the desired exchange at the remote EGD device Word 13 contains the least significant 16 bits of the Producer ID word 14 contains the most significant 16 bits Words 15 16 Remote EGD exchange Exchange ID Words 15 and 16 contains the 32 bit Exchange ID of the desired exchange at the remote EGD device Word 15 contains the least significant 16 bits of the Exchange ID word 16 contains the most si
278. tored using the Channel Status bits The 16 Client connections of an Ethernet interface are shared between all Client protocols For example if 8 Client connections are used for SRTP Channels there are 8 Client connections available for Modbus TCP Channels Any given channel can be assigned to only one protocol at a time Status Data There are several types of status available to the client application program LAN Interface Status Bits LIS Bits The LIS bits comprise bits 1 16 of the 80 bit status area The location of this 80 bit status area is assigned using the Configuration software The LIS bits contain information on the status of the Local Area Network LAN and the Ethernet interface Channel Status Bits The Channel Status bits comprise bits 17 80 64 bits of the 80 bit status area When used for Modbus TCP channels these bits consist of a connection open bit and an unused bit reserved for future use for each of the 16 channels that can be established Status bits for unused channels are always set to zero COMMREQ Status Word CRS Word The 16 bit CRS word will receive the initial status of the communication request The location of the CRS word is assigned for each COMMREQ function in the COMMREQ Command Block FT Output of the COMMREQ Function Block This output indicates that the PLC CPU detected errors in the COMMREQ Function Block and or Command Block and did not pass the Command Block to the Ethernet interface T
279. transfer Dec Hex Word 1 00017 0011 Length of Send Information Report Data Block 17 words Word 2 00000 0000 Always 0 no wait mode request Word 3 00008 0008 Memory type of COMMREQ status word R Word 4 00009 0009 COMMREQ status word address minus 1 R10 Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 02010 07DA Send Information Report Channel command number Word 8 00007 0007 Channel number 7 Word 9 00010 000A Number of repetitions send 10 times The term local PLC is Word 10 00003 0003 Time unit for send period 3 seconds used here to identify the Word 11 00007 0007 Minimum interval between host accesses every 7 seconds client PLC the PLC Word 12 00050 0032 Timeout on each individual transfer response 500 ms that initiates the Word 13 00008 0008 Local PLC Memory type from which to send data R communications Word 14 00050 0032 Local PLC Starting address from which to send data request R50 Word 15 00008 0008 Local PLC Number of memory units 8 registers The term SRTP Server Word 16 00000 0000 Reserved is used here to identify word 17 00000 0000 Reserved the Host server Word 18 00001 0001 Remote Network Address type IP Address Word 19 00004 0004 Remote Network Address length in words 4 Word 20 00010 000A Remote Host Register 1 of IP address 10 Word 21 00000 0000 Remote Host Register 2 of IP address 0 Word 22 00000 0000 Remote Host
280. ts Operator Personal Interface Computer It is possible to daisy chain PLCs together without additional components but that should be done with great care Power loss or reset at an Ethernet interface causes loss of communication to any devices downstream from that Ethernet interface in the daisy chain Restarting the Ethernet interface via the Ethernet Restart pushbutton for example disrupts daisy chain communication 2 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Each switch port auto negotiates by default to the correct link speed and duplex mode for the device connected to the other end of the link Each port operates independently so devices at two different speeds and or duplex modes may be attached to the two ports Each port also automatically detects the attached cable and will work properly with either straight through or crossover cables by default The two Ethernet ports on the Ethernet interface must not be connected directly or indirectly to the same device The connections in an Ethernet network based on twisted pair cabling must form a tree and not a ring otherwise duplication of packets and network overload may occur Caution The IEEE 802 3 standard strongly discourages the manual configuration of duplex mode for a port as would be possible using Advanced User Parameters Before manually configuring duplex mode for an Ethernet Interface port using advan
281. ts COMMREQ driven channel commands to establish new channels abort existing channels and retrieve the status of an existing channel The enhanced CPU374 CPU372 Ethernet interface supports up to 16 simultaneous Client connections shared between all Client protocols and 20 SRTP Server connections SRTP Client allows the Ethernet interface to initiate data transfer with other SRTP capable devices on the network Any given channel can be assigned to only one protocol at a time 1 6 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Modbus TCP Client Channels Modbus TCP channels can be set up in the PLC application program The Modbus TCP Client supports COMMREQ driven channel commands to open new channels close existing channels and transfer data on an existing channel The Series 90 30 PLUS Ethernet interface supports up to 16 simultaneous Client connections shared between all Client protocols and 16 Modbus TCP Server connections For example if 8 Client connections are used for SRTP Channels there are 8 Client connections available for Modbus TCP Channels Any given channel can be assigned to only one protocol at a time Modbus TCP Client allows the PACSystems PLC to initiate data transfer with other Modbus TCP server devices on the network Ethernet Global Data EGD The Series 90 30 PLUS enhanced Ethernet interface supports up to 128 simultaneous Ethernet Global Data EGD exchanges EGD excha
282. ts that a read PLC memory operation occur If the command is processed successfully it will result in PLC reference memory data being retrieved from the server to the client 5 4 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Word 8 Command Retry Time Word 8 specifies the time in milliseconds the Ethernet Interface will wait between retries when transferring the command A total of four tries will be made to send the command If no response is received after the four tries i e after four times the retry time value an error status will be returned in the COMMREQ status word If the command retry is specified as zero the default value of one second is used Word 9 Local PLC Memory Type Words 9 11 specify the location in the local PLC where the Ethernet interface will store data received from the remote PLC Valid values for Word 9 are listed below The amount of data to be transferred is specified by the number of memory units of the data read from the remote PLC Word 15 Type Value Description Decimal R 8 Register memory word mode AI 10 Analog input memory word mode AQ 12 Analog output memory word mode l 16 Discrete input memory byte mode 70 Discrete input memory bit mode Q 18 Discrete output memory byte mode 72 Discrete output memory bit mode T 20 Discrete temporary memory byte mode 74 Discrete temporary memory
283. ty disabled report all errors 1 HCT compatibility enabled ignore some errors RDS Parameters task d None None ARP Parameters task f Default Range fflush Interval in seconds at which to flush the ARP cache 600 10 minutes 0 604800 93A80H Ethernet Global Data Parameters task g Default Range gctl_port UDP port for EGD control messages 7937 1f01H 0 65535 ffffH gdata_port UDP port for point to point unicast EGD messages 18246 4746H 1 65535 ffffH Note Do not use a value of 0 The stack does not support assigning port 0 to a socket gbcast_ttl IP time to live for global broadcast messages hop 1 1H 0 255 OOffH count gucast_ttl IP time to live for point to point unicast messages 16 10H 0 255 OOffH hop count gp_phase Startup delay time in ms for successive produced 0 OH 0 65535 ffffH exchanges gcmd_ pri The CPU372 PLUS and CPU374 PLUS do not 0 OH 0 support this AUP gc_accel Enable consumed exchange acceleration 1 1H 0 1 0 Acceleration disabled 1 Acceleration enabled EGD provides a UDP port parameter and host group IP address parameter for each of 32 possible host groups 0 31 The parameter formats for each host group are shown below XX specifies host group 0 31 gXX_udp UDP port for host group XX 18246 4746H 0 65535 ffffH gXX_addr IP time to live for host group XX must be Class D 224
284. us TCP Client Connection COMMREQ Registers or Coils may be written to the remote Modbus TCP device The Modbus Function Code specifies the data type Valid Function Codes for the Write Data COMMREQ are presented in the following table Function Description Modbus Server Memory Data Unit Maximum Data Code Region Accessed Size Units Write Single Coil Internal Bits or Physical coils Bit Write Single Internal Registers or Physical Register 1 Register Output Registers 15 Write Multiple Internal Bits or Physical coils Bit Coils 16 Write Multiple Internal Registers or Physical Register Registers Output Registers An Address Offset and Length specify the location in the Modbus TCP device and the number of data units to transfer The Address Offset is the offset from the Base Address for that memory region in the server The Length is the number of Registers or Coils to transfer A PLC data area is the source for the data written to the Modbus TCP device The source of data can be any of the PLC data areas see page 8 14 Function Code 5 Write Single Coil forces a Coil On or Off To force a coil off the value 0 is used as the COMMREQ data value If the PLC memory type is a bit type the remote device coil is set to the same state as the specified PLC memory location If the PLC memory type is a byte or word type a value of zero 0 is used to force a coil off and a value of 1 is used to force a coil on Function Code 15 Write Multi
285. us TCP device Word 13 Number Coils in Remote Device Words 13 specifies the quantity of coils to write to the remote device For Modbus Function Code 5 Write Single Coil this must be set to 1 Word 14 Unit Identifier This field is typically used by Ethernet to Serial bridges to specify the address of a Modbus Slave on a multidrop link The Modbus TCP Unit Identifier is a special control code used in a Modbus TCP message block 8 20 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Command 3004 Example 3 Set Multiple Registers Write the four registers from Discrete Input Memory I40 to address 200 in the remote Modbus TCP server Return the COMMREQ Status word to R10 Use channel 6 a channel previously opened with the Open Modbus TCP Client Connection COMMREQ Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Dec Hex 00008 0008 00000 0000 00008 0008 00009 0009 00000 0000 00000 0000 03004 OBBC 00006 0006 00016 0010 00016 0010 00040 0028 00200 00C8 00004 0004 00001 0001 Length of Channel command Data Block Always 0 no wait mode request Memory type of CRS word R CRS word address minus 1 R10 Reserved Reserved Write to a Modbus TCP Device Channel number 6 Modbus Function Code Write Multiple Registers PLC Memory Type PLC Starting Address Address in the Re
286. uted among devices Chapter 10 PLC Monitoring Via the Web describes the Web browser feature Chapter 11 Diagnostics describes diagnostic techniques and lists COMMREQ status codes Appendix A Configuring Advanced User Parameters describes optional configuration of internal operating parameters used by the Ethernet interface For most applications the default Advanced User Parameters should not be changed GFK 2382A 1 1 Other Documents TCP IP Ethernet for Series 90 30 CPU372 PLUS and CPU374 PLUS Station Manager Manual GFK 2383 Machine Edition Logic Developer PLC Getting Started GFK 1918 Installation Requirements for Conformance to Standards GFK 1179 TCP IP Communications for Series 90 PLCs User s Manual GFK 1541 Describes Ethernet communications for other Series 90 products including earlier versions of the CPU374 with embedded Ethernet interface and the Series 90 30 TCP IP Ethernet Module IC693CMM321 TCP IP Communications for Series 90 PLCs Station Manager Manual GFK 1186 Describes the Station Manager function for other Series 90 PLC products including earlier versions of the CPU374 with embedded Ethernet interface and the Series 90 30 TCP IP Ethernet Module IC693CMM321 The most recent system documentation is available online at www ge ip com The Infolink for PLC CD set of documentation for GE PLC products is updated periodically It can be ordered as part number IC690CDRO02 1 2 TCP IP Ethernet Communic
287. value can be examined to determine whether a packet received from the network has a new data sample or if it is the same data received previously Ethernet interface The time clock in the Ethernet Interface is synchronized to either the clock in the CPU or an external SNTP server on the network Selection of the timestamp source for Ethernet Global Data is part of the basic configuration of the Ethernet Interface as explained in chapter 3 Configuration The PLC CPU obtains the timestamp data from the time clock in the Ethernet interface The CPU only uses this timestamp for Ethernet Global Data exchanges The timestamp from the Ethernet interface does not affect the time of the CPU s internal time clock Ethernet interface CPU Time timestamp GFK 2382A Chapter 4 Ethernet Global Data 4 11 PLC s Time Clock If this source is selected the Ethernet Interface s built in time clock is synchronized at power up or at restart to the clock in the PLC CPU The timestamp information produced by the PLC has a resolution of 100 microseconds Because the time clocks in the PLCs on the network are not synchronized EGD timestamps produced by different PLCs cannot be compared accurately Ethernet interface CPU Time SNTP Server s Time Clock if this source is selected the Ethernet interface s built in clock is periodically synchronized to the
288. vice 3005 The Read Write Multiple Registers to from a Modbus Server Device COMMREQ is used to read and write data between the remote server and the PLC with one COMMREQ operation Note the write operation occurs first and the data exchange does not occur coherently i e data can change in the server between the write and read operations Command 3005 Example Read Write Multiple Register Write 10 values starting at R100 in the Local PLC to register address 200 in the remote Modbus TCP server and read 20 values starting from register 300 in the remote Modbus TCP server and write this value to R300 in the Local PLC Return the COMMREQ Status word to R10 Use channel 6 a channel previously opened with the Open Modbus TCP Client Connection COMMREQ Dec Hex Word 1 00008 0008 Length of Channel command Data Block Word 2 00000 0000 Always 0 no wait mode request Word 3 00008 0008 Memory type of CRS word R Word 4 00009 0009 CRS word address minus 1 R10 Word 5 00000 0000 Reserved Word 6 00000 0000 Reserved Word 7 03005 OBBD Read Write Multiple Registers to from a Modbus TCP Device Word 8 00006 0006 Channel number 6 Word 9 00023 0017 Modbus Function Code Read Write Multiple Registers Word 10 00008 0008 Local PLC Memory Type of memory to write with data read from Remote Device Word 11 00300 012C Local PLC Starting Address LSW of memory to write with data read from Remote Device Word 12 00000
289. vice request error 01H to avoid confusion with the normal successful COMMREQ completion Call GE Intelligent Platforms for assistance 90H SRTP Client Channels or Modbus TCP Client error For Minor Error codes see the table on page 11 21 Some EGD command errors also use major code 90 when indicating the same error condition as SRTP or Modbus TCP channels 91H Modbus TCP Error Codes at server An error was detected at the Modbus TCP server For Minor Error codes see the table on page 11 16 AOH EGD Command error For Minor Error codes see the table on page 11 23 GFK 2382A Chapter 11 Diagnostics 11 15 Minor Error Codes for Major Error Codes 05H at Remote Server PLC and 85H at Client PLC Error Status Hexadecimal Error Description Remote Server Client 8F05H 8F85H Session already exists 8E05H 8E85H Memory write is prohibited 6805H 6885H Invalid PLC memory reference range 9305H 9385H Text buffer length count does not agree with request parameters C105H C185H Invalid block state transition C305H C385H Text length does not match traffic type C605H C685H Control Program CP tasks exist but requestor not logged into main CP C705H C785H Passwords are set to inactive and cannot be enabled or disabled C805H C885H Password s already enabled and cannot be forced inactive C905H C985H Login using non zero buffer size required for block
290. ways 0 no wait mode request Word 3 See previous page Memory type of COMMREQ Status Word Word 4 0 based Offset of COMMREQ Status Word Word 5 0 Reserved Word 6 0 Reserved Word 7 4000 fa0H Read PLC Memory command number Word 8 Retry time in milliseconds The time between retries of command transfers in 10 millisecond increments Default is 1000ms Word 9 Local read buffer memory type Memory type for the data to be placed in the local PLC Word 10 Local read buffer reference table 1 based offset in the local PLC Word 11 starting address Word 12 Remote read location memory Memory type from which data will be read in the remote PLC type Word 13 Remote reference table read 1 based offset in the remote PLC Word 14 location starting address Word 15 Remote reference table length in Number of remote memory units to be read remote memory units Word 16 Network address type Must be 1 Indicates an IP address will be used Word 17 Network address length Must be 4 for IP address Group ID multicast is not permitted Word 18 IP Address of the remote PLC Four integers specified as one integer per word of the dotted Word 21 decimal IP address of the remote PLC May not be a group IP address Word 22 Reserved Always 0 Word 4 COMMREQ status word address is the only zero based address in the Command Block Only this value requires subtracting 1 from the intended address Word 7 EGD Command Number Word 7 reques
291. work performance degradation increased collisions late collisions CRC errors and undetected data corruption Note If the speed and duplex mode of a port are forced using Advanced User Parameters the switch will no longer perform automatic cable detection This means that if you have the switch port connected to a switch or hub port you must use a crossover cable If you have the switch port connected to the uplink port on a switch or hub or if you have the switch port connected to another Ethernet device you must use a normal cable A 2 TCP IP Ethernet Communications for CPU372 PLUS and CPU374 PLUS September 2007 GFK 2382A Assigning an AUP File to the CPU372 PLUS or CPU374 PLUS At the Machine Edition programmer follow these steps to assign an AUP file to the CPU372 PLUS or CPU374 PLUS Ethernet interface 1 In the Project tab of the Navigator window expand the desired target PLC device 2 Right click on the Hardware Configuration for the target PLC then select Add AUP File 3 Inthe resulting dialog box navigate to the desired AUP file for the Ethernet interface For the CPU372 PLUS and CPU374 PLUS the AUP file must be named aup_0_1 apf Click Open The specified AUP file is added to the AUP Files folder under Supplemental Files for the PLC target To edit an AUP file that has been assigned to a target expand the Supplemental Files folder for the PLC target then double click the AUP Files folder

TCP/IP Ethernet Communications for Series 90

Contents

Download Pdf Manuals

Related Search

Related Contents