Siemens S7 Ip Fetch/Write

This driver supports communication over Ip with Siemens S7 PLCs , including the S7-300 and S7-400 series.

If you update the driver from CWIPS7.DLL version 1.x to 2.0, you must reconfigure the PLC coupler using the Step7 utility. In Step7, the partner IP address and port number field must be left blank.

Supported functions

The protocol uses the Fetch/Write messaging to read and write data to/from the PLC. In any exchange, the PC is the master and the PLC is a slave.

Prerequisites

Follow the steps below before configuring an equipment. The PLC Ethernet coupler must be configured using the Siemens Step7 software. For the driver to work, you need to configure at least two ports:

Fetch Passive
Write Passive which must be equal to Fetch Passive port + 1.

The partner IP address and port number field must be left blank.

You should reset the PLC after modifying any TCP/IP parameters using the Step7 programming software. That enables the coupler to re-initialize itself.

Network properties

This topic only includes a reference of objects' properties.

See the topic How to configure networks devices and frames for more information about how to configure communication objects.

General properties
Name	The name of the network
Description	The description of the network (optional)

Activate at start-up

If enabled, the network will start upon Equipment communication start-up

Advanced properties
Timeout	Use default value
Networking
Servers	The list of PcVue stations where the network will be active

Device properties

General properties
Name	The name of the device
Description	The description of the device (optional)

Equipment type

Select the type of equipment that best suits the field device you want communicate with.
The list of frame types and address ranges depend on the equipment type.

Address

The Ip address of the field device.
Some drivers also support configuration by host name.

Activate at start-up

If enabled, the device will start upon network start-up

Advanced properties
Connection
Timeout	Maximum waiting time between a request and the reply from the equipment

Port number

The port number of the field device.
It shall be set to the same value as the Fetch passive port configured in the PLC using Siemens Step7 software.

The Write port is deduced from the Port number.

Shared connection

Connection sharing is normally used when communicating with a gateway with a single TCP/IP connection on one side and several serial devices on the other.

Sharing the connection allows a single TCP/IP address and Port to be used to communicate with several devices. If connection sharing is not enabled then each connection requires its own TCP port.

When you use connection sharing, communication is managed serially. That is communication with one device (send and reply) must be completed before communication with the next device is started. The disadvantage of this method is that if one device is faulty, the communication is delayed to all the other devices while the connection times out. A connection on the TCP/IP side will only be restarted if all shared connections time out.

By default, shared connections are allocated to a single group (group 0), and a single connection to a gateway typically allow communication with one or more PLC field devices. If you have more than one gateway, you should allocate all devices accessible via a given gateway to the same group by the setting the Group number property to the same value. If you allocate shared connections to different groups this way, the connection on the TCP/IP side is restarted if all shared connections within the group time out. It is normal practice to configure one group for each physical connection on a gateway.

Reconnect period

Minimum period between attempts to recover a connection. This period is also used as a waiting period after a time-out.

Timestamping
Enable	Tick to enable field device timestamping mode
Error address	If timestamping is enabled, the address used to indicate a full stack. Must be set to a positive value (greater than 0).
Timestamp UTC	Specify if the field device transmits timestamps as UTC or as local time
Delta TS	Used to set-up direct archiving. If the difference between the timestamp coded in a received timestamped block and the current time is greater than the Delta TS value, the data is sent directly for archiving but is not considered fresh enough to be used as instantaneous value. As a consequence, the value of the corresponding variable is not updated.

Redundancy groups

Redundancy connection n

Allows the configuration of up to 4 additional field devices to provide redundant behavior for an item of equipment. When the application starts, the communication manager communicates with the primary device. When an error occurs, it switches to the next device in the sequence.

For each device with redundant configuration, you can manage the operation using register variables linked to frames of type Command and Information (see below).

Miscellaneous
Virtual	Reserved. Do not select.
Message delay	Reserved. Leave default value 0.

Frame addressing

Depending on the equipment type you have selected when configuring the device, you have access to the following type of frames.

The Starting address and Quantity properties define the memory address range for each frame, how it is read from and written to, and how it is interpreted in PcVue.

The maximum quantity of data that can be read per frame is 32 000 Words. Since the approximate amount of data exchanged per TCP/IP packet is 700 Words, if the frame size is greater than 700 words, the frame is transmitted in a series of TCP/IP packets.

Data type	Access	Max quantity	Starting address
Bit
Wordbit EW	Read	1024	0..65535
Wordbit DBW	Read/Write	65528	0..65535
Wordbit MW
Wordbit TW	Read/Write	2048	0..255
Wordbit AW	Read/Write	1024	0..65535
Wordbit PW	Read/Write	2048	0..255
Wordbit ZW
Byte
ZW	Read/Write	256	0..255
PW
DBW	Read/Write	65535	0..65535
MW
AW	Read/Write	128	0..65535
EW
TW	Read/Write	256	0..255
Word
DBW	Read/Write	32768	0..65535
MW
EW	Read/Write	64	0..65535
AW
ZW	Read/Write	128	0..255
TW
Information	Read	2	0..1
Command	Read/Write	1	0
S7 CEI	Read	4095	0..65535
Real
TW	Read/Write	64	0..255
DBW	Read/Write	16384	0..65535
MW
EW	Read/Write	32	0..65535
AW
PW	Read/Write	64	0..255
ZW
Double word
PW	Read/Write	64	0..255
DBW	Read/Write	32768	0..65535
MW	Read/Write	16384	0..65535
EW	Read/Write	32	0..65535
AW
ZW	Read/Write	64	0..255
TW

For the DBW data type, it is necessary to enter a DB number. Only DB1 to DB255 are accessible using this driver. The DB number property can be found in the Advanced tab.

The Information frame provides the active connection number and the Command frame allow you to set the active connection number. Using the Information and Command frames, you can manage the operation for redundant field devices:

A word format frame with the Information data type. This frame should be configured for cyclic read and linked to a single register variable. The address 0 contains the number of the active connection (0, 1, 2, or 3).
A word format frame with the Command data type. This frame should be configured for write only and linked to a register variable with the control attribute set. The value of the register variable at address 0 selects the active connection (0, 1, 2 or 3).

Memory organization in the PLC

The PLC variables in the SIMATIC S7 range (S7-400, S7-300) use a byte addressing mode.

The driver can be used to read a number of words, double or floating words with byte, word or double word alignments. These alignment modes enable you to obtain words or double words with even or odd addresses.

The following table gives an example for the word frame.

Byte address	Even start	Odd start
0	Word 1
1		Word 1
2	Word 2
3		Word 2
4	Word 3
5		Word 3
6	Word 4
7		Word 4
8

Driver status

The driver status provides driver-specific information to supplement the frame general status. For more information on status in general, refer to the topic General communication status.

Driver status	Description
002	Invalid memory area (error reported by equipment)
0003	Illegal data address in equipment
0102	Network error - Connection closed because of: Incorrect IP address Incorrect port number Equipment disconnected from network

SCADA Basic scripting

You can control communication with this driver in SCADA Basic scripts with the CIMWAY instruction.

See the topic Message exchange mechanisms in PcVue for more information about what to optimize and how you can send commands from scripts.

The driver also supports the following specific capabilities in SCADA Basic.

Changing a device address

IntVal = CIMWAY(CFG, CommObjName, Modif, Param, [, ResultVar]);

Argument	Meaning
CommObjName	Configuration element to modify: A device.
Modif	The property you want to modify:
	EQT_ADDRESS: Modification of the equipment address. CommObjName is the name of a device attached to the network. For example, Net1.Dev1.
Param	Param is a string with a typical syntax like Param1#Param2#Param3...#ParamN. Type STR. See below for the syntax specific to this driver.
ResultVar	Specifies the name of the variable where the status of the modification is stored.

Syntax for Siemens S7 Ip Fetch/Write:

Copy

1#ip1#ip2#ip3#ip4#port_fetch#ts_errorword#ts_errordb#connection_sharing#reconnection_period#redundant_connection_number#sharing_group_id

Where:

1 - Reserved
ip1 to ip4: The 4 segments of the Ip address
port_fetch: The Fetch Tcp port number
ts_errorword: The error address for source timestamping (word address in ts_errordb)
ts_errordb: The db number where the error address for source timestamping is located
connection_sharing: Connection sharing enabled (1) or disabled (0)
reconnection_period: The reconnection period
redundant_connection_number: The number of redundant connections (0 if no redundant connection)
sharing_group_id: The sharing group number

If redundant connections are in place, the syntax is as follow:

Copy

1#ip1#ip2#ip3#ip4#port_fetch#ts_erroraddress#ts_errorword#ts_errordb#connection_sharing#redundant_connection_nb#[redundant_connection_id_redn#ip1_redn#ip2_redn#ip3_redn#ip4_redn#port_fetch_redn#reserved(set 0)#]sharing_group_id

Where:

connection_sharing: Connection sharing enabled (1) or disabled (0)
redundant_connection_number: The number of redundant connections (1..4)
The part between square brackets [] is repeated for each redundant connection
- redundant_connection_id_redn: The id of the redundant connection (1..4)
- 0 - Reserved

Sending a control message to the driver

IntVal = CIMWAY (SENDMSG, CommObjectName, CommandString);

Return type: INTEGER.

Argument

Meaning

CommObjectName

Identifies the target object identifier:

All networks: Empty string.

A specific network: NetworkId.

A specific device: NetworkID.EquipmentId.

A specific frame: NetworkID.EquipmentId.FrameId.

Type STR.

CommandString

The command to send to the driver. Type STR.

See below for the list of messages supported by the driver.

Control messages for S7 Ip Fetch/Write:

Control message	Description
Switching the connection for a redundant PLC configuration	Command string syntax is "ConnectTo;num" SCADA Basic switching is slower that variable switching, as the command is not sent immediately to the driver (queues along with other requests), but it is flexible and doesn't require the configuration of an extra frame and variable.
Enable/Disable connection for a redundant PLC configuration	Command string syntax is "ConnectionDisable;num" to enable the connection number num. This connection is then unavailable for the driver to connect to the device. Command string syntax is "ConnectionEnable;num" to disable the connection number num. This connection is then available for the driver to connect to the device. ComObj must be the name of a device, for example NET.DEV1. If redundant data acquisition servers are in place, the change is only applied on the data acquisition server where the command is executed.
Switch all frames to polling mode	Command string syntax is "SwitchAllToPollingMode;num" to switch all frames to polling mode for the connection number num.
	ComObj must be the name of a device, for example NET.DEV1. num is the number of the connection to consider. Range [0..3]. For example, the following command forces a connection to the redundant connection 3 for the device NET1.EQT1: Copy `CIMWAY("SENDMSG", "NET.EQT1", "ConnectTo;3");`

Timestamped data - Data table and block structures

This section describes how to exchange timestamped data between the field device and PcVue. Switching between cyclic and event mode for the frame ticked as Refreshed using timestamp block is automatically triggered by a bit in the field device. The trigger is the bit (offset 0) of the word you specified when configuring the equipment.

When using S7, the trigger to cease timestamp operation is bit 0 of the word you specified in the device configuration, for example bit 0 of DB5.DBW8. The timestamped table is held in a dedicated DB. The DB number can be different to the one for the Error Address.

Timestamped data is exchanged between slave and master using the S7_CEI frame.

Master	Network	Slave
—>	Reading of the timestamped data table	—>
<—	Response to Read request	<—

If the number of blocks is greater than zero, the protocol reads all of the blocks available in the PLC and then does the following.

Master	Network	Slave
—>	Set the number of blocks to 0 and send the exchange number	—>
<—	Acknowledge the Write	<—

If the exchange number returned by the PC is wrong, the field device has to send the same exchange as before. The number could be wrong because the slave received an incorrect acknowledgment.

Timestamped data table structure

	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Word W	Exchange number								Number of blocks
Word W+1	First block (size 8)

Word W+1 +(N-1)*8	Nth block (size 8)

N = The number of blocks as specified by the timestamp frame's Quantity of data property.

W = The starting address as specified by the timestamp frame's Starting Address property.

Unlike Modbus Ip, there is no limit to the size of the frame with S7 Industrial Ethernet. However, in order for the frame to be contained within a single IP packet, it is recommended that the number of blocks does not exceed 30.

S7_CEI block structures

	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Word W+1	Data Type								DB Number
Word W+2	Address
Word W+3	Value1
Word W+4	Value0
Word W+5	Reserved								0	Year
Word W+6	0	0	0	0	Month				0	0	0	Day
Word W+7	0	0	0	Hour					0	0	Minute
Word W+8	Millisecond

Value0 is the least significant word when reading a 32 bit value (Real and Double Word). Value1 is the most significant word when reading a 32 bit value (Real and Double Word).

Coding of the data Type field

Type	Data Type	Type	Data type
1	Bit in DB	24	Real in DB
2	Bit in MW	25	Real in MW
3	Bit in EW	26	Real in EW
4	Bit in AW	27	Real in AW
8	Byte in DB	32	Double in DB
9	Byte in MW	33	Double in MW
10	Byte in EW	34	Double in EW
11	Byte in AW	35	Double in AW
16	Word in DB
17	Word in MW
18	Word in EW
19	Word in AW

Coding of the date and time fields

Field	Coding
Year	0..99 (The number of years since 1980)
Month	1..12
Day	1..31
Hour	0..23
Minute	0..59
Millisecond	0..59999

There is no field for seconds. Instead, the seconds are included with the milliseconds.