murdoch university engineering thesis appendix...

Murdoch University Engineering Thesis

213 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Appendix V

S7-300 PLC & RS485 Repeater

Configuration Instructions

Author: Hao Xu

Page: p213 - p249

Last modified: 10/11/2013

This is part of the Engineering Thesis “WinCC SCADA System via Profibus & OPC” by Hao Xu.



Preface This configuration instruction provides a comprehensive description about the functions and operations of S7-

300 PLC and RS485 repeater. The contents are summarized as follows:

S7-300 PLC hardware modules description

S7-300 PLC operation instruction

S7-300 PLC diagnostic

S7-300 PLC communication configuration

S7-300 PLC MS communication configuration

S7-300 MS communication sample code

S7-300 Organization Blocks description

TIA Portal configuration

Prerequisite Background knowledge of PLC operations

Background knowledge of ladder logic diagram

Background knowledge of basic electric circuit

Background knowledge of Profibus communication

Resources S7-300 PLC with DP interface

CP5611 Profibus interface PCI card

RS485 repeater

TIA Portal configuration software

Profibus cable

Profibus DP connector

MPI adaptor



S7-300 PLC (Refer to PLC section in the thesis report for an overview of the functions and some background information)

Specifications Table 18 shows the specification of the available PLC.

Specification Integrated work memory 48KB Load memory Pluggable MMC Bit processing time 0.1μs (minimum) Word processing time 0.2μs (minimum) Fixed-point mathematics processing time 2μs (minimum) Floating-point mathematics processing time 20μs (minimum) Number of counters 256 Counting range 0 – 999 Number of timers 256 Timing range 0 – 9990s Bit memory 256 bytes Clock memory 8 (1 byte) Number of FC, FB and DB 127 Size of FC, FB and DB 16KB (maximum) Number of DP slaves per station 32 Integrated digital input channels 24 Integrated digital output channels 16 Integrated analog input channels 4 + 1 Integrated analog output channels 2 Number of hardware counter channels 4 Number of frequency measurement channels 4 channels up to 60kHz Power supply 20.4 – 28.8V

Table 18: CPU 314C-2DP specification [30]



I/O Modules Table 19 and Table 20 describe the function of the terminals of the integrated I/O modules on the PLC.

Module 1 Terminal Function Description 1

Digital inputs

Digital input power supply for IB124, IB125 and IB126, 24V DC. 2 – 9 Digital inputs, IB124 (default), 24V DC. 12 – 19 Digital inputs, IB125 (default), 24V DC. 20 GND for pin IB124 and IB125. 21

Digital outputs

Digital output power supply for QB124, 24V DC. 22 – 29 Digital outputs QB124 (default), 24V DC. 30 GND for QB124. 31 Digital output power supply for QB125, 24V DC. 32 – 39 Digital outputs, QB125 (default), 24V DC. 40 GND for QB125.

Table 19: Module 1 description of CPU 314C-2DP [30]

Module 2 Terminal Function Description 2

Analog inputs

Analog voltage input channel 0, PIW752 (default), ±10V. 3 Analog current input channel 0, PIW753 (default), ±20mA. 4 GND for PIW752 and PIW753. 5 Analog voltage input channel 1, PIW754 (default), ±10V. 6 Analog current input channel 1, PIW755 (default), ±20mA. 7 GND for PIW754 and PIW755. 8 Analog voltage input channel 2, PIW756 (default), ±10V. 9 Analog current input channel 2, PIW757 (default), ±20mA. 10 GND for IW756 and PIW757. 11 Analog voltage input channel 3, PIW758 (default), ±10V. 12 Analog current input channel 3, PIW759 (default), ±20mA. 13 GND for PIW758 and PIW759. 14 – 15 Resistor input Resistor input, 600Ω. 16

Analog outputs

Analog voltage output channel 0, PQW752 (default), ±10V. 17 Analog current output channel 0, PQW753 (default), ±20mA. 18 Analog voltage output channel 1, PQW754 (default), ±10V. 19 Analog current output channel 1, PQW755 (default), ±20mA. 20 GND for PQW752, PQW753, PQW754 and PQW755. 22 – 29

Digital inputs Digital inputs, IB126 (default), 24V DC.

30 GND for IB126. Table 20: Module 2 description of CPU 314C-2DP [30]



CPU Status LEDs The CPU LED indicates the current operation status of the PLC.

SF (red): Hardware or software fault.

BF (red): Bus fault.

DC5V (green): 5V power supply to CPU is ok.

FRCE (yellow): Force job is active.

RUN (green): CPU is in RUN mode.

STOP (yellow): CPU is in STOP, HOLD mode. [30]

Mode Selection Switch The mode switch allows user to select the PLC operating mode.

RUN: Switch CPU to RUN mode and CPU scans the program.

STOP: Switch CPU to STOP mode and CPU stops scanning the program.

MRES: Switch CPU to RESET mode with a push button function to reset CPU memory. [30]

Micro Memory Card (MMC) Since the current PLC model does not have an integrated memory card. The Micro Memory Card (MMC) is used

to store data for the CPU such as user program, archives and recipes, configuration data, OS update and backup

data. It must be inserted into the MMC slot to operate the CPU. [30]

Retentive Behaviour of Memory Objects Table 21 shows the retentive behaviour of memory objects on certain operation transitions. [30]

Memory object Power On/Off Stop Run Memory reset User program and data Retentive Retentive Retentive Data block values Retentive Retentive Not retentive Retentive memory bits, timers and counters Retentive Retentive Not retentive Diagnostic buffer, operating hour counter Retentive Retentive Retentive Address and transmission rate Retentive Retentive Retentive

Table 21: Retentive behaviour of memory objects [30]



TIA Portal Configuration (Refer to Configuration Software section in the thesis report for an overview of TIA Portal)

Add PLC Double click Add new device in the project tree and click PLC tab in the Add new device window. Choose the

available PLC from the list and click OK as shown in Figure 166.

Figure 166: Add PLC station in TIA Portal

The PLC program can be developed in Main [OB1] under Program blocks in the project tree. The program can

also be developed in other blocks for special purpose.



Add blocks In the project tree, PLC Program blocks, double click Add new block to create certain blocks as shown in

Figure 167.

Figure 167: Add block for PLC in TIA Portal

Organization block: Hold the PLC program to execute when conditions are met.

Function block: Similar to Function, but has its own associated data block to store static data.

Function: Create user defined functions.

Data block: Block to store data.



Programming Languages In TIA Portal, there are basically 5 programming languages to select and each one of them has its own strength

and weakness.

LAD

Figure 168: LAD programming in TIA Portal

Ladder logic (Figure 168) is the most popular programming languages for PLC programming in the industrial

control applications. It is a standard programming language known as Ladder Diagram (LD) in IEC 61131-3. A

Ladder Diagram typically incorporates a combination of control circuits. The basic elements of the code include

inputs and outputs, where logic of inputs needs to be true in directive to trigger one or more outputs. Ladder

diagram language has been widely used in the industry around the world as it is easily understandable. The

language has been designed in a simple electrical format so that it can be understood even by a person with just

electrical background and minimal programming experience. And basic program can be written easily with a

simple knowledge of inputs and outputs. Timers, counters and some mathematical functions are also available

to perform complex applications. [30] [33]

STL

Figure 169: STL programming in TIA Portal

STL (Figure 169) is a textual language similar to machine code and is also a standard programming language in

IEC 61131-3 known as Instruction List (IL). It is a low level programming language. This language is similar to

other text based languages used to program microcontrollers. The language occupies less space in PLC memory

and can also execute faster compared to other graphical languages. It is also quicker to program and makes the

entry of mathematical functions easier as it only needs simple one line text entry. The program written in the

language are also easily adaptable using a handheld programming unit without a need for the software or a

computer. [30] [33]



FBD

Figure 170: FBD programming in TIA Portal

FBD (Figure 170) is similar to ladder diagram nonetheless it resembles an electrical circuit even more

compared to ladder diagram. Similar to ladder diagram the blocks are wired in a sequence structured for easy

understanding. The language is suitable to replace any ladder logic application but is ideal for simple programs

consisting of digital inputs and outputs. Writing function block program involves more advance preparation in

the means of structuring the program as there could be difficulties experienced with modification of the code.

The program also requires a large amount of screen space which can give it a clumsy appearance. [30] [33]

GRAPH

Figure 171: GRAPH programming in TIA Portal

GRAPH (Figure 171) is a state machine design based language which conforms SFC in IEC 61131-3 standard. GRAPH resembles computer flowcharts and consists of two main components called steps or actions and

transitions. An initial step is followed by a series of steps and transitions. Transitions determine which action

box to execute. The action box stays in the active state until the next transition is triggered. This programming

language is the most appropriate application for repeatable multi-step processes. The programming language is

easy to implement and easy to understand for maintenance personnel due to its code segmentation. [30] [33]



SCL

Figure 172: SCL programming in TIA Portal

SCL (Figure 172) is a high-level textual language which follows the IEC 61131-3 standard. SCL is similar to

languages such as PASCAL or C as similar functions such as IF…THEN loops, CASE statements and semicolons to

end a line. This language can be used to perform process control tasks involved in industries and therefore

demonstrate the increasing complexity of PLC programming. As compared to ladder logic or STL, complex

mathematical functions can be easily performed using SCL. [30] [33]



Hardware Configuration Double click Device configuration under PLC in the project tree and select PLC in the Device view. The

hardware can be configured in the under the Properties tab as shown in Figure 173.

Figure 173: PLC hardware configuration window in TIA Portal

Create Profibus Subnet If a PLC is already added, in its properties, DP interface [X2] PROFIBUS address, click Add new subnet to

create a Profibus subnet as shown in Figure 174.

Figure 174: Create Profibus subnet in TIA Portal

To assign DP master/slave, in the Properties tab, DP interface [X2] Operating mode (Figure 175).

Figure 175: Assign PLC Profibus operating mode in TIA Portal



Add Slave In the project tree, under project, double click Devices & networks to open up Network view. From the

Catalog window on the right (Figure 176), drag the desired slave station into the Network view.

Figure 176: Hardware Catalog in TIA portal

If there is already a master in the network, click Not assigned on the slave station in the Network view and

select the master to establish the master-slave connection.

If the data exchange between the master and slave is expected, a slave module needs to be added on to the rack

of the slave. Double click slave station in the Network view to show slave modules on in the Catalog window

as shown in Figure 177.

Figure 177: Slave modules in slave station in TIA Portal

Drag the desired slave modules into the slave rack for the communication as shown in Figure 178.

Figure 178: Slave modules in the module rack in TIA Portal



Click slave modules in the rack and assign the expected I/O address under the Properties tab as shown in

Figure 179.

Figure 179: Slave module peripheral address in TIA Portal



Download Program After the program has been finished, right click PLC in anywhere, Download to device All. This download

method will automatically download to the PLC with the last available connection. If need to download via a

particular connection. Select PLC and from the menu bar, Online Extended download to device as shown

in Figure 180.

Figure 180: Extended download window in TIA Portal



Click Show all accessible devices to display all the recognized devices on the network as shown in Figure 181.

Figure 181: Accessible devices on the Profibus network in TIA Portal



Online/Offline Select the PLC and click Go online button from the toolbar to go online. Each program block can also go line by

clicking individual Monitoring on/off button from the block toolbar. After the PLC goes online, all the variables

can be monitored in realtime. The PLC operation can be controlled via CPU operator panel as shown in Figure

182.

Figure 182: CPU operator panel in TIA Portal

Watching Table To add a watching table, in the project tree, PLC Watch and force tables Add new watch table. Double

click the created watch table to open it. The watch table only works when the PLC is online. The current values

display in the Monitor value column and Modify value column can be used to change the value online as

shown in Figure 183.

Figure 183: Watching table in TIA Portal



Tag Table Tag table can be created to provide actual meaning of the address (Figure 184). To create a tag table, in the

project tree, PLC PLC tags Add new tag table.

Figure 184: Tag table in TIA Portal

Install GSD File From the menu bar, Options Install general station description station file (GSD). In the pop up window,

browse the GSD file and click Install button as shown in Figure 185.

Figure 185: GSD file installation window in TIA Portal

After all the required GSD files have been installed, TIA Portal needs to restart. The new device station will be

available in Hardware Catalog list in TIA Portal after restarting TIA Portal.



Master and Slave PLC Communication

Communication Configuration Make sure no Profibus cable is plugged into any PLC at the beginning. Firstly, Add 2 PLCs into the network as

shown in Figure 186.

Figure 186: 2 PLCs in the Network view in TIA Portal

Under the properties of both PLCs, DP interface [X2] PROFIBUS address (Figure 187), set them to

different addresses. Do not use 0, 1 or address above 126.

Figure 187: Set PLC Profibus address in TIA Portal

In the properties of the master PLC, DP interface [X2] PROFIBUS address, click Add new subnet button to

create a Profibus network as shown in Figure 188.

Figure 188: Create master Profibus subnet in TIA Portal

In the properties of the slave PLC, DP interface [X2] Operating mode, select DP slave and choose the DP

master interface as shown in Figure 189.

Figure 189: Set slave PLC Profibus operation mode in TIA Portal

Now in the Network view, the 2 PLCs should be linked as Figure 190.

Figure 190: Connection of master and slave PLCs in TIA Portal



In the properties of the slave PLC, DP interface [X2] Operating mode I-slave communication, create 2

Transfer areas as shown in Figure 191 (At least one needs to be created). [21]

Figure 191: Transfer area of slave PLC in TIA Portal

In the project tree, under Online access (Figure 192), right click CP5611 [PROFIBUS] and choose Properties.

Figure 192: CP5611 Profibus card in TIA Portal

In the pop up window, under Configurations, make sure all types of configurations have the same Own

address. This is the address assigned to the configuration software and should be always set to 0 as shown in

Figure 193.

Figure 193: Set configuration software address in TIA Portal



Under General section, select the created Profibus network for Connection with subnet as shown in Figure

194.

Figure 194: Subnet selection for CP5611 Profibus card

Create OB100 and OB82 for both master and slave PLC (Figure 195), no code are required in them.

Figure 195: Create OB100 in TIA Portal



Now plug the MPI adapter into the master PLC and perform a download (Figure 196). Repeat this for the slave

PLC.

Figure 196: Download to the master PLC through MPI in TIA Portal



After loading the program, there is no need to tick the Start all box because both PLC will need to reboot to

initialize the communication (Figure 197).

Figure 197: Slave PLC download completion window in TIA Portal



Now unplug the MPI adapter from all the PLCs and plug the Profibus connector into both PLCs then perform a

download for the slave PLC first, then the master PLC, but with the Profibus interface as shown in Figure 198.

Figure 198: Download to master PLC through Profibus in TIA Portal

After downloads finished, there will be some bus fault displayed on the PLC. Both PLC need to switch to STOP

mode and switch back to RUN mode to function. Now let both PLCs go online, a green tick icon should be

displayed to indicate the master-slave communication is established as shown in Figure 199.

Figure 199: Online status of the master and slave PLCs



In the parameter of the slave PLC, DP interface [X2] Operating mode I-slave communication. Click the

transfer area created earlier and set up the data exchange settings as shown in Figure 200 and Figure 201. [21]

Figure 200: Bind slave input to master output in TIA Portal

Figure 201: Bind slave output to master input in TIA Portal

Now can develop some code to transfer data between the master and slave PLCs. During the MS communication,

always download to the slave first, then master. After downloading, switch the PLC to STOP mode then back to

RUN mode to function.

(Refer to Sample Code section for some data exchange examples)



Sample Code

Master Program

Figure 202: Online sample code read/write data to the slave PLC in the master PLC [25]

Slave Program

Figure 203: Online sample code read/write data to the master PLC in the slave PLC [25]



Organization Blocks Organization blocks (OB) are the interface between PLC operating system and the user program.

Program Cycle Organization Block (OB1) OB1 is the designated block which contains the main program and executes cyclically after the startup has been

completed. The description of the block internal data are shown in Table 22.

Variable Type Description OB1_EV_CLASS Byte 11hex: OB1 is active

OB1_SCAN_1 Byte

1hex: Completinon of a warm restart 2hex: Completion of a hot restart 3hex: Completion of the main cycle 4hex: Completion of a cold restart

OB1_PRIORITY Byte Priority of OB execution. OB1_OB_NUMBER Byte OB number. OB1_RESERVED_1 Byte Reserved. OB1_RESERVED_2 Byte Reserved. OB1_PREV_CYCLE Int Cycle time of previous scan. OB1_MIN_CYCLE Int Minimum OB1 cycle time in ms. OB1_MAX_CYCLE Int Maximum OB1 cycle time in ms. OB1_DATE_TIME Data_And_Time Date and time OB1 started. Table 22: Program cycle organization block (OB1) internal data description [35]

Time-of-Day Interrupt Organization Block (OB10) OB10 is used to execute the program with a larger time scale compared to OB35. It can also be executed once at

the starting time. The following options are available:

Once

Every minute

Every hour

Every day

Every week

Every month

The end of every month

The description of the block internal data is shown in Table 23.

Variable Type Description OB10_EV_CLASS Byte 11hex: Interrupt is active OB10_SCAN_1 Byte 11hex: OB10 has started OB10_PRIORITY Byte Priority of OB execution. OB10_OB_NUMBER Byte OB number. OB10_RESERVED_1 Byte Reserved. OB10_RESERVED_2 Byte Reserved. OB10_PERIOD_EXE Word Period of execution. OB10_MIN_CYCLE Int Reserved. OB10_MAX_CYCLE Int Reserved. OB10_DATE_TIME Data_And_Time Date and time OB10 started.

Table 23: Time-of-Day interrupt organization block (OB10) internal data description [35]



Time-Delay Interrupt Organization Blocks (OB20) OB20 is executed after a specified delay and started by calling the SRT_DINT instruction where delay time. OB

number and identifier are the inputs of the instruction. The description of the block internal data is shown in

Table 24.

Variable Type Description OB20_EV_CLASS Byte 11hex: Interrupt is active OB20_STRT_INF Byte 21hex: OB20 has started OB20_PRIORITY Byte Priority of OB execution. OB20_OB_NUMBER Byte OB number. OB20_RESERVED_1 Byte Reserved. OB20_RESERVED_2 Byte Reserved. OB20_SIGN Word Identifier input (SIGN) attached to SRT_DINT. OB20_DTIME Time Configured delay time in ms. OB20_DATE_TIME Data_And_Time Date and time OB20 started.

Table 24: Time-delay interrupt organization block (OB20) Internal data description [35]

Cyclic Interrupt Organization Block (OB35) OB35 is executed at a pre-defined fixed rate. The description of the block internal data is shown in Table 25.

Variable Type Description OB35_EV_CLASS Byte 11hex: Interrupt is active OB35_STRT_INF Byte 16hex: OB35 has started OB35_PRIORITY Byte Priority of OB execution. OB35_OB_NUMBER Byte OB number. OB35_RESERVED_1 Byte Reserved. OB35_RESERVED_2 Byte Reserved. OB35_PHASE_OFFSET Word Phase offset in ms. OB35_RESERVED_3 Int Reserved. OB35_EXC_FREQ Int Frequency of execution in ms. OB35_DATE_TIME Data_And_Time Date and time OB35 started.

Table 25: Cyclic interrupt organization block (OB35) internal data description [35]

Hardware Interrupt Organization Block (OB40) The hardware interrupt is used to catch the event which requires responses that are quicker than the current

program cycle or to identify the events which do not last long enough in the current program cycle. The

hardware interrupt processing is together with analog, digital and function modules. The description of the

block internal data is shown in Table 26.

Variable Type Description OB40_EV_CLASS Byte 11hex: Interrupt is active OB40_STRT_INF Byte 41hex: OB40 has started OB40_PRIORITY Byte Priority of OB execution. OB40_OB_NUMBER Byte OB number. OB40_RESERVED_1 Byte Reserved.

OB40_IO_FLAG Byte 54hex: Input module 55hex: Output module

OB40_MDL_ADDR Word Base address of module initiating interrupt. OB40_POINT_ADDR DWord Interrupt status of the module. OB40_DATE_TIME Data_And_Time Date and time OB40 started. Table 26: Hardware interrupt organization block (OB40) internal data description [35]



Status Interrupt Organization Block (OB55) If a status interrupt is triggered by the slot of a DP V1 slave, OB55 will be executed. The description of the block

internal data is shown in Table 27.

Variable Type Description OB55_EV_CLASS Byte 11hex: Incoming event OB55_STRT_INF Byte 55hex: OB55 has started OB55_PRIORITY Byte Priority of OB execution. OB55_OB_NUMBER Byte OB number. OB55_RESERVED_1 Byte Reserved.


OB55_MDL_ADDR Word Base address of module initiating interrupt. OB55_LEN Byte Reserved. OB55_TYPE Byte Frequency of execution in ms. OB55_SLOT Byte Slot. OB55_SPEC Byte Specifier. OB55_DATE_TIME Data_And_Time Date and time OB55 started.

Table 27: Status interrupt organization block (OB55) internal data description [35]

Update Interrupt Organization Block (OB56) If an update interrupt was triggered from the slot of a DP V1 slave, OB56 will be executed. The description of

the block internal data are shown in Table 28.




Table 28: Update interrupt organization block (OB56) internal data description [35]



Manufacturer-specific Alarms Organization Block (OB57) If a manufacturer-specific interrupt is triggered by the slot of a DP V1 slave, OB57 will be executed. The

description of the block internal data is shown in Table 29.




Table 29: Manufacturer-specific alarms organization block (OB57) internal data description [35]

Time Error Organization Block (OB80) OB80 will be called if there is an error occurred while executing an Organization block. The description of the

block internal data is shown in Table 30.

Variable Type Description OB80_EV_CLASS Byte Event class and identifier: 35hex OB80_FLT_ID Byte XXhex, fault identification code. OB80_PRIORITY Byte Priority of OB execution. OB80_OB_NUMBER Byte OB number. OB80_RESERVED_1 Byte Reserved. OB80_RESERVED_2 Byte Reserved. OB80_ERROR_INFO Word Error information on event (See Table 31). OB80_ERR_EV_CLASS Byte Class of event causing error. OB80_ERR_EV_NUM Byte Number of event causing error. OB80_OB_PRIORITY Byte Priority of OB causing error. OB80_OB_NUM Byte Number of OB causing error. OB80_DATE_TIME Data_And_Time Date and time OB80 started.

Table 30: Time error organization block (OB80) internal data description [35]

OB80_ERROR_INFO Description 01 Cycle time is exceeded. 02 The requested OB is still processing. 05 Expired time-of-day interrupt through time jump. 06 Expired time-of-day interrupt by reentering RUN after STOP. 07 Overflow of the OB request buffer for the current priority class. 08 Isochronous mode interrupt time error. 09 Loss of interrupt due to high interrupt load. 0A Resume RUN after CiR. 0B Technology synchronization interruput time error.

Table 31: Error information of OB80 [35]



Diagnostic Interrupt Organization Block (OB82) The operating system calls OB82 if the module with diagnostic function detects a change in its diagnostic state.

2 types of diagnostic error interrupt requests can be send to the CPU:

Incoming event: A problem or a component requires maintenance.

Outgoing event: No problem and no component requires maintenance.

The description of the block internal data is shown in Table 32.

Variable Type Description

OB82_EV_CLASS Byte 38hex: Outgoing event 39hex: Incoming event

OB82_STRT_INF Byte XXhex, fault identification code. OB82_PRIORITY Byte Priority of OB execution. OB82_OB_NUMBER Byte OB number. OB82_RESERVED_1 Byte Reserved. OB82_IO_FLAG Byte Input (01010100), output (01010101) OB82_MDL_ADDR Word Base address of moduel with fault. OB82_MDL_DEFECT Bool Module defective. OB82_INT_FAULT Bool Internal fault. OB82_EXT_FAULT Bool External fault. OB82_PNT_INFO Bool Point information. OB82_EXT_VOLTAGE Bool External voltage low. OB82_FLD_CONNCTR Bool Field wiring connector missing. OB82_NO_CONFIG Bool Module has no configuration error. OB82_CONFIG_ERR Bool Module has configuration error. OB82_MDL_TYPE Byte Type of module. OB82_SUB_MDL_ERR Bool Sub module is missing or has error. OB82_COMM_FAULT Bool Communication fault. OB82_MDL_STOP Bool Module is stopped. OB82_WTCH_DOG_FLT Bool Watch dog timer stopped module. OB82_INT_PS_FLT Bool Internal power supply fault. OB82_PRIM_BATT_FLT Bool Primary battery fault. OB82_BCKUP_BATT_FLT Bool Backup battery fault. OB82_RESERVED_2 Bool Reserved. OB82_RACK_FLT Bool Rack fault. OB82_PROC_FLT Bool Processor fault. OB82_EPROM_FLT Bool EPROM fault. OB82_RAM_FLT Bool RAM fault. OB82_ADU_FLT Bool ADU fault. OB82_FUSE_FLT Bool Fuse fault. OB82_HW_INTR_FLT Bool Hardware interrupt input fault. OB82_RESEVED_3 Bool Reserved. OB82_DATE_TIME Data_And_Time Date and time OB82 started. Table 32: Diagnostic interrupt organization block (OB82) internal data description [35]



Priority Class Error Organization Block (OB85) OB85 will be called under the following 3 situations:

Start event for a non-load OB (except OB80, OB82 and OB86).

An error occurs while operating system accessing a block.

I/O access error while updating process image.

The description of the block internal data are shown in Table 33.

Variable Type Description OB85_EV_CLASS Byte See Table 34. OB85_FLT_ID Byte See Table 34. OB85_PRIORITY Byte Priority of OB execution. OB85_OB_NUMBER Byte OB number. OB85_RESERVED_1 Byte Reserved. OB85_RESERVED_2 Byte Reserved. OB85_RESERVED_3 Int Reserved. OB85_ERR_EV_CLASS Word Class of event causing error. OB85_ERR_EV_NUM Byte Number of event causing error. OB85_OB_PRIOR Byte Priority of OB causing error. OB85_OB_NUM Byte Number of OB causing error. OB85_DATE_TIME Data_And_Time Date and time OB85 started.

Table 33: Priority class error organization block (OB85) internal data description [35]

OB85_EV_CLASS OB85_FLT_ID Description 35 A1 The start event created for an OB by the operating system or program was

not loaded to the CPU. 35 A2 35 A3 The operating system having problem accessing a block. 35 A4 Profinet interface DB cannot be addressed. 34 A4 Profinet interface DB cannot be addressed again. 39 B1 Cannot access I/O while updating the inputs process image.

39 B2 Cannot access I/O while transferring the process image output to output modules.

38/39 B3 Cannot access I/O while updating image input, incoming/outgoing.

38/39 B4 Cannot access I/O while updating outputs incoming/outgoing process image. Table 34: Error information of OB85 [35]



Rack Failure Organization Block (OB86) The operating system calls OB86 when any of the following cases are met:

Failure of a central expansion unit is detected.

Failure of a DP master system is detected.

Failure of a distributed I/O device is detected.

A distributed I/O device is deactivated with D_ACT_DP instruction using MODE = 4.

A distributed I/O device is activated with D_ACT_D instruction using MODE = 3.

Failure of a Profinet I/O system, station or some of the submodules of Profibuet I-device is detected.

The description of the block internal data are shown in Table 35.

Variable Type Description

OB86_EV_CLASS Byte

32hex: Using mode 3 of “D_ACT_DP” instruction to activate a slave (See Table 36).

33hex: Using mode 4 of “D_ACT_DP” instruction to deactivate a slave (See Table 36).

38hex: Outgoing event (See Table 36). 39hex: Incoming event (See Table 36).

OB86_FLT_ID Byte C1hex/C4 hex/C5 hex, fault identification code (See Table 36). OB86_PRIORITY Byte Priority of OB execution. OB86_OB_NUMBER Byte OB number. OB86_RESERVED_1 Byte Reserved. OB86_RESERVED_2 Byte Reserved. OB86_MDL_ADDR Word Base address of IM module in rach with fault. OB86_RACKS_FLTD Array of Bool [0 - 31] Rack fault. OB86_DATE_TIME Data_And_Time Date and time OB86 started.

Table 35: Rack failure organization block (OB86) internal data description [35]

OB86_EV_CLASS OB86_FLT_ID Description 39 C1 Expansion rack failed. 38 C1 Expansion rack operational again.

38 C2 Expansion rack operational again with the previous failure of discrepancy between configured and actual configurations.

39 C3 The DP master system failed. 38/39 C4 A DP slave failed. 38/39 C5 Return of a DP slave, but with device fault. 38 C6 Return of expansion unit, but with module parameter assignment error. 38 C7 Return of a DP slave, but with module assignment error.

38 C8 Return of a DP slave, but with discrepancy between configured and actual configurations.

32/33 C9 Using Mode 3 or 4 in “D_ACT_DP” instruction to activate/deactivate DP slave.

39 CA Profinet I/O system failed. 38/39 CB Profinet I/O slave failed/returned. 38 CC Return of Profinet I/O station with problem or maintenance.

38 CD Return of Profinet slave I/O with discrepancy between configured and actual configurations.

38 CE Return of Profinet station with error in module parameter assignment.

32/33 CF Using Mode 3 or 4 in “D_ACT_DP” instruction to activate/deactivate Profinet slave.

38/39 F8 Failure/return of some of the submodules of a Profinet I-device.

38 F9 Failure/return of some of the submodules of a Profinet I-device with different configuration. Table 36: Error information of OB86 [35]



Communication Error Organization Block (OB87) OB87 will be called if an event occurs which is triggered by a communication error. The description of the block

internal data are shown in Table 37.

Variable Type Description OB87_EV_CLASS Byte Event class and identifier: 35hex OB87_FLT_ID Byte See Table 38. OB87_PRIORITY Byte Priority of OB execution. OB87_OB_NUMBER Byte OB number. OB87_RESERVED_1 Byte Reserved. OB87_RESERVED_2 Byte Reserved. OB87_RESERVED_3 Word Reserved. OB87_RESERVED_4 DWord Reserved. OB87_DATE_TIME Data_And_Time Date and time OB87 started.

Table 37: Communication error organization block (OB87) internal data description [35]

OB87_FLT_ID Description D2 Cannot send the diagnostics entries. D3 The master cannot send the synchronization message frames. D4 Illegal time jump through time synchronization. D5 Error in adopting the synchronization time in slave. E1 Global data has incorrect message frame identifier. E2 Cannot enter global data package status. E3 Global data has error in message frame length. E4 Received Illegal global data package. E5 Cannot access DB while exchanging data via communication function blocks. E6 The global data package status cannot be entered in DB.


Startup Organization Block (OB100) The CPU executes OB100 on a warm restart after power on or after a request by a communication function. The

description of the block internal data are shown in Table 39.

Variable Type Description OB100_EV_CLASS Byte 13hex: OB100 is active

OB100_FLT_ID Byte

81hex: Manual warm restart request 82hex: Automatic warm restart request 83hex: Request for manual hot restart 84hex: Request for automatic hot restart

OB100_PRIORITY Byte Priority of OB execution. OB100_OB_NUMBER Byte OB number. OB100_RESERVED_1 Byte Reserved. OB100_RESERVED_2 Byte Reserved. OB100_STOP Word Event that caused CPU to stop OB100_STRT_INFO DWord Information on how system was started. OB100_DATE_TIME Data_And_Time Date and time OB100 started.

Table 39: Startup organization block (OB100) internal data description [35]



Programming Error Organization Block (OB121) The operating system calls OB121 whenever an event is occurred that is caused by an error related to the

program processing. The description of the block internal data is shown in Table 40.

Variable Type Description OB121_EV_CLASS Byte Event class and identifier: 25hex OB121_SW_FLT Byte See Table 41. OB121_PRIORITY Byte Priority of OB execution. OB121_OB_NUMBER Byte OB number. OB121_BLK_TYPE Byte 88hex/8Ahex/8Bhex/8Chex/8Ehex type of block fault occur in. OB121_RESERVED_1 Byte Reserved. OB121_FLT_REG Word Error source depends on the error code. OB121_BLK_NUM Word Number of block that programming fault occurred in. OB121_PRG_ADDR Word Address in block where programming fault occurred. OB121_DATE_TIME Data_And_Time Date and time OB121 started.

Table 40: Programming error organization block (OB121) internal data description [35]

OB121_SW_FLT Description 21 Error in BCD conversion. 22 Error in area length while reading. 23 Error in area length while writing. 24 Area error while reading. 25 Area error while writing. 26 Error in timer number. 27 Error in counter number. 28

Read access to a byte, word or Dword with a pointer, the bit address of which is not 0. 29 30 Write access to a write-protected global DB. 31 Write access to a write-protected instance DB. 32 Error in DB number while accessing a global DB. 33 Error in DB number while accessing an instance DB. 34 Error in number while calling FC. 35 Error in FB number while calling FC. 3A Accessing a non-loaded DB. 3C Accessing a non-loaded FC. 3D Accessing an unavailable instruction. 3E Accessing a non-loaded FB. 3F Accessing an unavailable SFB.




I/O Access Error Organization Block (OB122) OB122 is called whenever an error occurs while accessing data on a module. The description of the block

internal data is shown in Table 42.

Variable Type Description OB122_EV_CLASS Byte Event class and identifier: 29hex

OB122_SW_FLT Byte 42hex: I/O read access error. 43hex: I/O write access error.

OB122_PRIORITY Byte Priority of OB execution. OB122_OB_NUMBER Byte OB number. OB122_BLK_TYPE Byte 88hex/8Chex/8Ehex type of block fault occur in. OB122_MEM_AREA Byte Memory area where access error occurred. OB122_MEM_ADDR Word Memory address where access error occurred. OB122_BLK_NUM Word Number of block that programming fault occurred in. OB121_PRG_ADDR Word Address in block where programming fault occurred. OB121_DATE_TIME Data_And_Time Date and time OB122 started.

Table 42: I/O access error organization block (OB122) internal data description [35]



RS485 Repeater (Refer to RS485 Repeater section in the thesis report for an overview of the functions and some background

information)

The specification of RS485 repeater and the functions of terminals are shown in Table 43 and Table 44.

Specification Supply voltage 20.4 – 28.8V Input current 100mA Transmission rate 9.6kbit/s – 12Mbit/s Table 43: Specification of RS485 repeater [40]

Terminal Description L+ 24V DC. M GND PE Bridge PE and M for grounded operation. M5.2 Ground reference when measuring voltage difference between A2 and B2. A1 DP+ for bus segment 1 input. B1 DP- for bus segment 1 input. A1’ DP+ for bus segment 1 output. B1’ DP- for bus segment 1 output. A2 DP+ for bus segment 2 input. B2 DP- for bus segment 2 input. A2’ DP+ for bus segment 2 output. B2’ DP- for bus segment 2 output. S1 Termination switch for bus segment 1. S2 Termination switch for bus segment 2. Mode Isolate all bus segments from each other. PG/OP PG/OP interface.

Table 44: Terminals description of RS485 repeater [40]

In order to connect networks through the repeater, plug input Profibus cable into A1 and B1 and output

Profibus cable into A1’ and B1’ for the first segment. Same principle applies to the second segment. S1 controls

the termination of the first segment and S2 controls the termination of the second segment. (Refer to RS485

Repeater section in the thesis report for the wiring diagram)

The repeater does not need to be powered by 24V DC to perform the bus termination, but needs 24V DC to

amplify the fieldbus signal. The DP1/DP2 LED will be on if the bus signal is detected provided the 24V DC is

present.



This is the end of Appendix V.

murdoch university engineering thesis appendix...

Documents