murdoch university engineering thesis appendix vi

85
Murdoch University Engineering Thesis 250 | Page WinCC SCADA System via Profibus & OPC by Hao Xu Appendix VI EASY719 & EASY204-DP Configuration Instructions Author: Hao Xu Page: p250 - p334 Last modified: 10/11/2013 This is part of the Engineering Thesis “WinCC SCADA System via Profibus & OPC” by Hao Xu.

Upload: others

Post on 07-Jan-2022

2 views

Category:

Documents


0 download

TRANSCRIPT

Murdoch University Engineering Thesis

250 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Appendix VI

EASY719 & EASY204-DP

Configuration Instructions

Author: Hao Xu

Page: p250 - p334

Last modified: 10/11/2013

This is part of the Engineering Thesis “WinCC SCADA System via Profibus & OPC” by Hao Xu.

Murdoch University Engineering Thesis

251 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Preface This configuration instruction provides a comprehensive description about the functions and operations of

EASY719 and EASY204-DP. The contents are summarized as follows:

EASY719 system description

EASY719 function relay instruction

EASY719 operation instruction

EASY719 diagnostic

EASY204-DP operation description

EASY204-DP slave module description

EASY204-DP telegram structure

EASY204-DP communication diagnostic

EASY204-DP slave module data exchange sample code

EASYSOFT configuration

TIA Portal communication configuration

Prerequisite Background knowledge of PLC operations

Background knowledge of ladder logic diagram

Background knowledge of basic electric circuit

Background knowledge of Profibus communication

Completion of Appendix V “S7-300 PLC & RS485 Repeater configuration instructions”

Resources EASY719-DC-RC relay controller

EASY204-DP gateway

EASY-PC-PCB RS232 communication cable (Optional)

EASYSOFT configuration software (Optional)

S7-300 PLC with DP interface

CP5611 Profibus interface PCI card

TIA Portal configuration software

Profibus cable

Profibus DP connector

MPI adaptor (Optional)

Murdoch University Engineering Thesis

252 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

EASY719 (Refer to EASY719 section in the thesis report for an overview of the functions and some background information)

EASY719 has 12 inputs and 6 outputs. Table 45 and Table 46 show the specifications of them.

Terminals Function ON signal Off signal Input current I1 to I6 Digital inputs 15 – 28.8V

0 – 5V

3.3mA I7, I8 Analog inputs Greater than 8V 2.2mA I9, I10 Digital inputs 15 – 28.8V 3.3mA I11, I12 Analog inputs Greater than 8V 2.2mA

Table 45: Input terminals specification of EASY719 [41]

Terminals Function Maximum voltage Maximum current Q1 to Q6 Relays 24V DC/230V AC 8A

Table 46: Output terminals specification of EASY719 [41]

Power LED Continuously lit: EASY719 is in STOP mode.

Flashing: EASY719 is in RUN mode.

Not lit: No power supply present.

Operating Buttons EASY719 is equipped with 8 operating buttons on its control panel which are used for manual configuration

and circuit diagram creation. The configuration software is not necessary as all the configuration can be done

on EASY719 using those operating buttons. Below are some descriptions about those buttons:

DEL: Delete functions or objects in the circuit diagram.

ALT: Toggle status displays and special functions in circuit diagram.

ESC: Jump to the previous menu level or cancel.

OK: Next menu level or confirm.

Cursor buttons: Move cursor or select items and set parameters.

Murdoch University Engineering Thesis

253 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Status Display The LCD screen of EASY719 displays a lot of important information such as I/O status, date and time, operating

mode, etc (Figure 204 and Figure 205). Press ALT/OK button can toggle the displays. Below are some

descriptions about the text display on the screen.

Figure 204: EASY719 status display part 1 [41]

Figure 205: EASY719 status display part 2 [41]

RS: Expansion operating correctly.

RE: Retention is switched on.

I: Debounce is switched on.

AC: AC expansion operating correctly.

DC: DC expansion operating correctly.

GW: Bus coupling module is detected.

ST: Start behaviour. [41]

Murdoch University Engineering Thesis

254 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Operations

Access Program On EASY719, if it is currently at the display screen, press OK button twice to show the top menu, then

PROGRAM PROGRAM. The program can only be modified at STOP mode. The procedures are shown in

Figure 206.

Figure 206: Procedures to access program on EASY719 [41]

Press OK button to create or enter the function. Highlight the function name and function number to change the

function type and number respectively using cursor buttons. Press ALT key to enable the line tool to draw the

line follow the cursor.

Change Mode In the top menu, select STOP/RUN and press OK button to toggle the controller operate state. The procedure is

shown in Figure 207.

Figure 207: Procedures to change mode on EASY719 [41]

Access Function Block Parameters In the top menu, select PARAMETER then press OK button to show all the currently used function blocks.

Select the desired one then press OK button to show all the parameters. The procedures are shown in Figure

208.

Figure 208: Procedures to access function block parameters on EASY719 [41]

Murdoch University Engineering Thesis

255 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Cycle EASY719 allows user to set a fixed cycle time between 0ms to 60ms. A cycle time of 0ms will execute the

program as fast as possible which also means that the cycle time for each scan might be different. EASY719 will

only try to achieve the setpoint cycle time and the cycle time will be adjusted by EASY719 dynamically if

EASY719 has some difficulties executing the program within the setpoint cycle time. A cycle time of 35ms is the

minimum time that EASY719 needs to execute the maximum rungs of the program. [41]

To modify the cycle time, on EASY719, hold DEL key and press ALT key to call the system menu. SYSTEM

CYCLE TIME, press OK key and enter the desired cycle time. The procedures are shown in Figure 209.

Figure 209: Procedures to change the cycle time on EASY719 [41]

Scan Sequence The way EASY719 scans the program is different to the ordinary line-by-line scan. Figure 210 illustrates this

special sequence.

Figure 210: EASY719 scan sequence [41]

EASY719 checks the first 3 segments and also determines whether the contacts are in series or parallel.

EASY719 stores the contact information in the memory and assign the new switching states to all the outputs in

one shot. The fifth hidden segment is used by EASY719 to establish contact to the world outside. [41]

Murdoch University Engineering Thesis

256 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Password Protection A password can be set up to block unauthorised access with the range of the password from 0001dec to 9999dec.

0000dec is used to delete a password. When a password is activated, the system menu is always protected from

unauthorised access and the following functionalities can also be customized for protection:

Change operating mode.

Download program to EASY719.

Modify program.

Modify function block parameters.

Real time clock settings.

Modify system parameters.

Communicate with individual device.

Disable the password delete function. [41]

To activate the password protection from EASY719, hold DEL key then press ALT key to call the system menu.

Then SECURITY PASSWORD. The procedures are shown in Figure 211.

Figure 211: Procedures to set the password protection on EASY719 [41]

Retention EASY719 has the capability of retaining important functions to save operating states or values. It retains the

value after the loss of the supply power until the next time the value is overwritten. The limitation is that not all

the functions have retention ability and below shows all the retention compatible functions:

Markers: M9 to M16 and N9 to N16.

Up/down counters: C5 to C8 and C13 to C16.

Text function relays: D1 to D8.

Timing relays: T7, T8, and T13 to T16.

The retentive values will be wiped off under following conditions (STOP mode only):

Downloading of program to EASY719.

Selected retentive function relays, markers or text display are deactivated.

Program is deleted. [41]

To enable retention function on EASY719, hold DEL key and press ALT key to call the system menu. Select

RETENTION and press OK to enable the desired retention functions. The procedures are shown in Figure 212.

Figure 212: Procedures to set retention function on EASY719 [41]

Murdoch University Engineering Thesis

257 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Coils Coil is the fundamental relay actuating mechanism and it switches on/off according to the input trigger. In

EASY719, there are several different types of coils.

Contactor: The signal of the output is identical to the input signal (Figure 213).

Figure 213: Signal response of the contractor coil [41]

Negated: The output signal is opposite to the input signal (Figure 214).

Figure 214: Signal response of the negated coil [41]

Falling edge: The output signal switches to on state when there is a falling edge from the input. The

output signal stays one for only 1 cycle (Figure 215).

Figure 215: Signal response of the falling edge coil [41]

Murdoch University Engineering Thesis

258 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Rising edge: The output signal switches to on state when there is a rising edge from the input. The

output signal stays on for only 1 cycle (Figure 216).

Figure 216: Signal response of the rising edge coil [41]

Impulse relay: The output signal only changes state when there is a rising edge from the input (Figure

217).

Figure 217: Signal response of the impulse relay coil [41]

Latching relay: The latch and unlatch functions should be used in pairs. The latch is used to set the

output signal whereas the unlatch function is used to reset the output signal (Figure 218).

Figure 218: Signal response of the latching relay coil [41]

Murdoch University Engineering Thesis

259 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Functions

I – Input Basic Unit The inputs are designed for connecting up external contacts.

R – Input Expansion Device The expansion inputs are used to connect up contacts from the expansion devices.

Q – Output Basic Unit The outputs are used to connect various loads such as contactors, motors and lights.

Coil Function

Contactor

Impulse relay

Set

Reset

Negated contactor

Falling edge

Rising edge

S – Output Expansion Device The S relays are generally used as the outputs of an expansion unit. Unlike Q outputs, the S outputs do not have

physical terminals. They could be used as marker if they are not used for expansion units. [42]

Coil Function

Contactor

Impulse relay

Set

Reset

Negated contactor

Falling edge

Rising edge

M – Marker M marker is used as a flag.

Coil Function

Contactor

Impulse relay

Set

Reset

Negated contactor

Falling edge

Rising edge

Murdoch University Engineering Thesis

260 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

N – Marker N marker is used as a flag.

Coil Function

Contactor

Impulse relay

Set

Reset

Negated contactor

Falling edge

Rising edge

P - P Buttons P buttons can be treated as additional 4 manual inputs which are associated with 4 cursor buttons on EASY719.

The P button function is not activated by default to prevent unauthorised usage. P buttons can be activated

from EASY719 manually. On EASY719, hold DEL key and press ALT key to call the system menu. Select

SYSTEM from the list and tick the P BUTTON function. The procedures are shown in Figure 219. [42]

Figure 219: Procedures to enable P buttons on EASY719 [41]

: - Jump Jump is a common function used to optimize the structure of a ladder program or to implement a selector

switch function. The rungs after Jump function will not be processed if Jump is triggered. The states of those

skipped functions will not change unless they are overwritten by the functions that were not skipped by Jump.

[41]

Murdoch University Engineering Thesis

261 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

A - Analog Value Comparator/Threshold Value Switch This function block enables user to perform a comparison between the analog input values with a setpoint,

another analog input or even a value from another function relay. The analog value comparator has an internal

value range from -2147483648 to +2147483647, but it can only display 4 digits. If the value of a counter relay

exceeds 9999, the value shown on the analog value comparator will be that value minuses 10000. For example,

if the value of a counter relay is 11493, then the display on the analog value comparator will be 1493. [41]

All the values of analog inputs (I7, I8, I11 and I12) from 0 to 10V are converted to a 10-bit digital value from 0

to 1023. A digital value of 512 represents an analog input of 5V. [41]

Setpoints

Figure 220: Setpoints configuration menu of A in EASYSOFT

I1/I2

Comparison value I1 and I2

NU – Constant: Constant value.

C – Counter relay: Actual value of C1 to C16.

I – Analog input: Positive value I7, I8, I11 and I12.

T – Timing relay: Actual value of T1 to T16. [41]

No./Value Take the value of a constant, value of the particular counter relay from C1 to C16, value of the digital value of

the analog input from I7, I8, I11 and I12 or the value of the particular timing relay from T1 to T16. [41]

F1/F2

Gain factor for I1 and I2. Value is positive value from 0 to 9999. For example, I1 = F1 × actual I1 value. [41]

OS

Offset for the value of I1. Offset value is a positive value from 0 to 9999. For example, I1 = OS + actual value at

I1. [41]

HY

Switching hysteresis for I2 value, or the tolerance of I2 value. HY applies to both positive and negative

hysteresis.

I2 = actual value at I2 ± HY

HY = positive value from 0 to 9999 [41]

Mode

LT: Less than (I1 < I2).

LE: Less than/equal to (I1 <= I2).

EQ: Equal to (I1 = I2).

GT: Greater than (I1 > I2).

GE: Greater than/equal to (I1 >= I2). [41]

Murdoch University Engineering Thesis

262 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

C - Counters The counter relay enables user to count events. EASY719 has 4 high-speed counters from C13 to C16. The

specific function is defined by the mode selected. The input of the counter should be directly connected to a

digital high-speed input from I1 to I4. Typical applications include counting of events, components and

frequency measurements. If the minimum (0dec) or maximum (32000dec) number of the counter is reached, this

value will be retained until the count direction is changed. [41]

Mode

C1 to C12 (type N): Up/down counters.

C13 and C14 (type N or H): Up/down counters or high-speed up counters with the highest frequency

of 1 kHz. The inputs of the high-speed counter are permanently connected to I1 and I2 respectively. The

high-speed counter does not rely on the system cycle time, but the value is only transferred every cycle.

C15, C16 (type N or F): Up/down counters or frequency counters with minimum frequency of 4Hz and

maximum frequency of 1 kHz. The inputs of the high-speed counter are permanently connected to I3

and I4 respectively. The high-speed counter does not rely on the system cycle time, but the value is only

transferred every cycle. [41]

Coil Function

Count pulse, CC: Counter input, rising edge counts.

Count direction, DC: Up counting when the coil is not triggered and down counting when the coil is

triggered.

Reset, RC: Reset the count number to 00000dec when triggered. [41]

Setpoints

NU – Constant: Constant value.

C – Counter relay: Actual value of C1 to C16.

I – Analog input: Positive value I7, I8, I11 and I12.

T – Timing relay: Actual value of T1 to T16. [41]

Murdoch University Engineering Thesis

263 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

D - Text Display EASY719 can display up to 16 user defined texts (Figure 221). The display of the text can be triggered by the

value of the function relays such as counters, analog value comparators and timing relays. If multiple texts are

triggered, each text will be displayed for 4 seconds. [41]

Each text display function block can only contain 2 values such as analog input values and setpoint values and

the position of the values are fixed at line 2 and line 3 (Figure 222).

Coil Function

Contactor

Impulse relay

Set

Reset

Negated

Falling edge

Rising edge

Setpoints

C – Counter relay: Display the particular counter relay value or setpoint value.

DH – Time display: Display EASY719 system time.

DD – Date display: Display EASY719 system data.

I – Analog input: The actual analog input voltage from 0 – 10V based on the “Scale Value Range” (±9.9,

±999 and 9999). For example, if analog input is 5V and the range is set to be ±9.9, then it will display 0.

O – Operating hours counter: Display the operating hours counter value.

T – Timing relay: Display the particular timing relay actual value or setpoint value.

Editable: Enable modification of setpoint values from EASY719. [41]

Text Entry

Figure 221: Text configuration window of D in EASYSOFT

Murdoch University Engineering Thesis

264 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Scale Value Range

Figure 222: Scale value configuration window of D in EASYSOFT

±9.9

±999

9999 [41]

Murdoch University Engineering Thesis

265 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

H - 7-day time switch The 7-day time switch function block is used to switch on/off the control relays at a pre-define time during the

week. Each of the 7-day time switch contains 4 channels which allow user to set up 4 pairs of on and off time.

As the timer uses the backup battery, it will continue to run even when the power supply has failed. [41]

Channel

DY1: Define the starting day.

DY2: Define the ending day.

ON: Define the starting time on the starting day.

OFF: Define the ending time on the ending day. [41]

O - Operating Hours Counter The operating hours counter is designed to record the system operating hours. With the benefit of this function

block, the maintenance time can be easily logged and reported. The values are retained even when EASY719 is

switched off. The value range of this function block is enormous from 0 hours to way over 100 years. [41]

The resolution of operating hours counter is 1s, which means it can only loss up to 999ms while EASY719 is

switched off. The accumulated time is saved in the memory until user resets it intentionally. [41]

Coil Function

Contactor: Count coil of the operating hours counter.

Reset: Reset coil of the operating hours counter. [41]

Setpoint

S: Setpoint in hours. [41]

Murdoch University Engineering Thesis

266 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

T - Timing Relays The basic function of a timing relay is to trigger a timing event or change the switching duration. A number of

different timing functions with fully customized time ranges are available to satisfy the requirements of a

flexible control system. [41]

Coil Function

Trigger, TT: Enable, timing relay trigger.

Reset, RT: Reset coil of the timing relay.

Stop, HT: Pause the timing of the timing relay. [41]

Setpoint

I1/I2

Time setpoint 1 and 2.

NU – Constant: Constant value.

Variable:

o C – Counter relay: Actual value of C1 to C16.

o I – Analog input: Positive value of I7, I8, I11 and I12.

o T – Timing relay: Actual value of T1 to T16. [41]

With a Time Range of S – 00.00 10ms resolution, time setpoint = (value × 10) in ms. The conversion is shown

in Table 47.

Value Time setpoint in S 0 00.000 100 01.000 300 03.000 500 05.000 1023 10.230

Table 47: Time setpoint to value conversion with 10ms resolution [41]

With a Time Range of M:S – 00:00 1s resolution, time setpoint = value divided by 60, integer result = number

of minutes, remainder is the number of seconds. The conversion is shown in Table 48.

Value Time setpoint in M:S 0 00:00 100 01:40 300 05:00 500 08:20 1023 17:03

Table 48: Time setpoint to value conversion with 1s resolution [41]

With a Time Range of H:M – 00:01 1min.resolution, time setpoint = value divided by 60, integer result =

number of hours, remainder is the number of minutes. The conversion is shown in Table 49.

Value Time setpoint in H:M 0 00:00 100 01:40 300 05:00 500 08:20 1023 17:03

Table 49: Time setpoint to value conversion with 1min resolution [41]

Murdoch University Engineering Thesis

267 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

No.

Take the value of the particular counter relay from C1 to C16, value of the digital value of the analog input from

I7, I8, I11 and I12 or the value of the particular timing relay from T1 to T16. [41]

Constant

Constant is used to define the timing range between 10ms and 99 hours and 59 minutes. The minimum and

maximum timing value depends on the Time Range. [41]

Mode

On-delayed: The contact of timing relay switches on after a setpoint time.

On-delayed with random time: The contact of timing relay switches on randomly within the setpoint

time range.

Off-delayed: After the timing relay switches from on to off, the contact of the timing relay remains on

for a setpoint time then switches off.

Off-delayed with random time: After the timing relay switches from on to off, the contact of the timing

relay remains on for a random time within the setpoint time range then switches off.

On/off-delayed: After the timing relay switches from off to on. The contact of the timing relay remains

off for a setpoint time then switches on. After the timing relay switches from on to off, the contact of the

timing relay remains on for a setpoint time then switches off.

On/off-delayed with random time: After the timing relay switches from off to on, the contact of the

timing relay remains off for a random time within the setpoint time range then switches on. After the

timing relay switches from on to off, the contact of the timing relay remains on for a random time

within the setpoint time range then switches off.

Single pulse: A rising edge will latch the contact for a setpoint time.

Flashing: The timing relay will toggle states based on the time setpoint I1 and I2. [41]

Time Range

S – 00.00 10ms resolution: Cover a time range between 10ms and 99s and 990ms.

M:S – 00:00 1s resolution: Cover a time range between 1s and 99min and 59s.

H:M – 00:01 1min.resolution: Cover a time range between 99s and 59min. [41]

Murdoch University Engineering Thesis

268 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Y - Year Time Switch The year time switch is typically used to implement special on/off switching during public holidays, company

holidays and special events. Each year time switch has 4 channels to set 4 pairs of on/off dates. The year time

switch continues to run using the backup battery to protect from power failure. The range of the date is from

01/01/2000 to 31/12/2099. [41]

Channel

ON: Define the starting day of the year.

OFF: Define the ending day of the year. [41]

Z - Master Reset The master reset function relay has the ability to set all the markers and outputs with a state of “0”. [41]

Mode

Z1: Reset outputs Q1 to Q6 and S1 to S8.

Z2: Reset marker M1 to M16 and N1 to N16.

Z3: Reset Q1 to Q6, S1 to S8, M1 to M16 and N1 to N16. [41]

Murdoch University Engineering Thesis

269 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

EASYSOFT Configuration (Refer to Configuration Software section in the thesis report for an overview of EASYSOFT)

Project Settings In EASYSOFT, select the correct model from Basic Units list and drag it to the blank window on the right

(Figure 223). The available model is EASY719-DC-RC.

Figure 223: Project view in EASYSOFT

Under System Settings tab, Cycle Time can be set up and P buttons and Retention can be activated (Figure

224).

Figure 224: System setting panel in EASYSOFT

Murdoch University Engineering Thesis

270 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Double click on the device in the window to enter the circuit diagram interface. User can develop the ladder

diagram here with instructions and functions from the list on the left (Figure 225).

Figure 225: Programming interface in EASYSOFT

Murdoch University Engineering Thesis

271 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Communication Once the program has been completed, click Communication button under the instruction list, under the

Connection tab, set the correct Interface and click Online to establish the communication with PC (Figure

226).

Figure 226: Connection setting panel in EASYSOFT

Under Program/Configuration tab, there are a few options (Figure 227).

Figure 227: Program transfer panel in EASYSOFT

PC => Device: Download the program to EASY719.

Device => PC: Upload the program from EASY719 to EASYSOFT.

PC = Device?: Check if the program in EASYSOFT is identical to the program in EASY719.

Delete: Delete the program and configuration in the device.

Device => Card: Download the program to the memory card.

NET Config.: Set the Ethernet configuration.

LINK Config.: Set the fieldbus address.

RUN: Switch EASY719 to RUN mode.

STOP: Switch EASY719 to STOP mode.

Murdoch University Engineering Thesis

272 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Simulation Click Simulation button under the instruction list, in the I/R function tab, user can select switch types for I

and R inputs (Figure 228).

Figure 228: Contact input type assignment panel for simulation in EASYSOFT

Click Start Simulation button from the toolbar to start the simulation. During simulation, switches under I

inputs and R inputs tabs can be controlled and the analog inputs can be adjusted via sliders under the Analog

inputs tab (Figure 229).

Figure 229: Input control panel for simulation in EASYSOFT

Murdoch University Engineering Thesis

273 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Under Simulation cycle tab, user can define the simulation cycle time. The Execute button allows user to

execute a single cycle each time (Figure 230).

Figure 230: Simulation cycle time setting in EASYSOFT

The Display tab is used to monitor the variables of each function (Figure 231).

Figure 231: Display panel in EASYSOFT

Murdoch University Engineering Thesis

274 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Oscilloscope To use the Oscilloscope function, click the Oscilloscope button from the toolbar. Set the functions with

channels that need to be monitored. After simulation starts, click Oscilloscope Recording On button from the

toolbar to display the function values. The oscilloscope process screen is shown in Figure 232.

Figure 232: Oscilloscope monitor panel in EASYSOFT

Set Profibus Address After the communication between PC and EASY719 has been established, in the communication window, under Program/Configuration tab, click LINK Config. In the window opened, write the desired Profibus address then click Write Parameters button as shown in Figure 233.

Figure 233: Set Profibus address of EASY204-DP in EASYSOFT

Murdoch University Engineering Thesis

275 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

EASY204-DP Gateway (Refer to EASY204-DP Gateway section in the thesis report for an overview of the functions and some background

information)

EASY204-DP needs to be connected with EASY719 via the EASY-LINK connector and powered by 24V DC.

POW LED Continuously lit: EASY204-DP is powered.

Flashing: The communication between EASY719 and EASY204-DP is established.

Not lit: No power supply present. [42]

BUS LED Continuously lit: Profibus-DP communication present.

Not lit: No Profibus-DP communication present. [42]

Set Profibus Address On EASY719, hold DEL key and press ALT key to call the system menu, then use cursor buttons to select CONFIGURATOR then press OK button. Use cursor buttons to set up the DP address then press OK button. The procedures are shown in Figure 234.

Figure 234: Procedures to set Profibus address on EASY719 [42]

Murdoch University Engineering Thesis

276 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Gateway Profibus Communication First of all, connect PLC and EASY204-DP with Profibus connectors and also make sure the Profibus signal is

properly terminated on each end of the network.

Make sure GSD file Moe4d10.gsd is installed in TIA Portal, then locate the gateway station in Hardware

Catalog as shown in Figure 235.

Figure 235: EASY204-DP station in Hardware Catalog in TIA Portal

If the master Profibus network has been established earlier, drag the gateway station into the Network view

and join gateway into the Profibus subnet (Figure 236). Assign a Profibus address to gateway based on the

device setting. (Refer to Set Profibus Address section for Profibus address setting for EASY204-DP)

Figure 236: Assign EASY204-DP to the master PLC in TIA Portal

Place the slave modules onto the module rack from Catalog as shown in Figure 237. At least one of the slave

module needs to be placed on the rack. (Refer to Input/output Level section for the slave module compatibility

rules)

Figure 237: EASY 700/800 control commands slave module in module rack in TIA Portal

Murdoch University Engineering Thesis

277 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Perform a download to the PLC and as soon as EASY719 is recognized in the Profibus network, EASY204-DP automatically detects the supported baud rate from 9.6kBaud to 12MBaud. The BUS LED will become solid and GW message will display statically. The cycle time of EASY719 can increase by 40ms due to the EASY-LINK communication. The online Network view in TIA Portal should be as Figure 238.

Figure 238: Online network view of EASY204-DP in TIA Portal

Murdoch University Engineering Thesis

278 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Gateway Slave Modules (Refer to Slave Modules section in the thesis report for some background and the slave module structure)

Input/Output Level The Input 1 Byte and Input 3 Byte slave modules cannot be put on the module rack at the same time as well as

Output 1 Byte and Output 3 Byte slave modules. (Refer to Sample Code section for some data exchange

examples)

Input 1 Byte Slave Module Table 50 shows the assignments of the Input 1 Byte slave module.

Byte Description Assignments

0 Scan status of EASY719 outputs S1 to S8.

Bit 0: S1 Bit 1: S2 Bit 2: S3 Bit 3: S4 Bit 4: S5 Bit 5: S6 Bit 6: S7 Bit 7: S8

Table 50: Input 1 byte module data structure [42]

Output 1 Byte Slave Module Table 51 shows the assignments of the Output 1 Byte slave module.

Byte Description Assignments

0 Set/reset EASY719 inputs R1 to R8.

Bit 0: R1 Bit 1: R2 Bit 2: R3 Bit 3: R4 Bit 4: R5 Bit 5: R6 Bit 6: R7 Bit 7: R8

Table 51: Output 1 byte module data structure [42]

Input 3 Byte Slave Module Table 52 shows the assignments of the Input 3 Byte slave module.

Byte Description Assignments

0 Scan EASY719 operating mode. Bit 0: Run/Stop Bit 4: With debounce Bit 5: Without debounce

1 Scan status of EASY719 output S1 to S8.

Bit 0: S1 Bit 1: S2 Bit 2: S3 Bit 3: S4 Bit 4: S5 Bit 5: S6 Bit 6: S7 Bit 7: S8

2 Reserved. N/A Table 52: Input 3 byte module data structure [42]

Murdoch University Engineering Thesis

279 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Output 3 Byte Slave Module Table 53 shows the assignments of the Output 3 Byte slave module.

Byte Description Assignments

0 Set EASY719 operating mode. 34hex: RUN command 44hex: STOP command

1 Set/reset EASY719 inputs R9 to R16.

Bit 0: R9 Bit 1: R10 Bit 2: R11 Bit 3: R12 Bit 4: R13 Bit 5: R14 Bit 6: R15 Bit 7: R16

2 Set/reset EASY719 inputs R1 to R8.

Bit 0: R1 Bit 1: R2 Bit 2: R3 Bit 3: R4 Bit 4: R5 Bit 5: R6 Bit 6: R7 Bit 7: R8

Table 53: Output 3 byte module data structure [42]

Murdoch University Engineering Thesis

280 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Control Level

EASY 700/800 Control Commands Slave Module The EASY 700/800 control commands telegram is sent to EASY719 from the Profibus master via Profibus

communication for each data exchange service. Byte 0 of the 9 bytes is so called a toggle byte and the state of

bit 7 of the toggle byte needs to be toggled to trigger each data exchange service. The structure of toggle byte

is shown in Table 54.

Toggle Byte Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 State 0/1 0 (fixed) 0 (fixed) 0 (fixed) 0 (fixed) 0 (fixed) 0 (fixed) 1 (fixed)

Table 54: Toggle byte data structure [42]

Since all the other bits are fixed, therefore, only need to send 0000_0001bin and 1000_0001bin or 01hex and 81hex

to Byte 0 to trigger the data exchange service.

During the execution of EASY 700/800 control commands slave module, the input/output level slave

modules will remain the state before the control command was executed. After EASY 700/800 control

commands slave module service finished, the input/output level slave modules will update. [42]

Murdoch University Engineering Thesis

281 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Control Commands Slave Module Function State Telegram Structure

The function state telegram structure is used to read/write the state or the input of the function such as on/off

state and analog input. The telegram structure of function state data exchange is shown in Table 55, Table 56

and Table 57.

Byte Meaning A1-A16 C1-C16 D1-D16 I1-I16 IA1-IA4 M1-M16 0 Toggle Byte 01/81 01/81 01/81 01/81 01/81 01/81

1 Command R/W 88

(Read) 88

(Read) 88

(Read) 88

(Read) 88

(Read) 88

(Read) 2 Length 01 01 01 02 02 01 3 Type 8B EE 94 84 8C 86 4 Index 00 00 00 00 00-03 00 5 Data 1 00-FF 00-FF 00-FF 00-FF 00-FF 00-FF 6 Data 2 00-FF 00-FF 00-FF 00-FF 00-FF 00-FF 7 Data 3 N/A N/A N/A N/A N/A N/A 8 Data 4 N/A N/A N/A N/A N/A N/A

Table 55: EASY 700/800 control commands module function state data structure part 1 [42]

Byte Meaning M1-M16 N1-N16 N1-N16 O1-O4 P1-P4 Q1-Q8 0 Toggle Byte 01/81 01/81 01/81 01/81 01/81 01/81

1 Command R/W 8C

(Write) 88

(Read) 8C

(Write) 88

(Read) 88

(Read) 88

(Read) 2 Length 01 01 01 01 01 01 3 Type 86 87 87 EF 8A 85 4 Index 00-0F 00 00-0F 00 00 00 5 Data 1 00-01 00-FF 00-01 00-0F 00-0F 00-FF 6 Data 2 N/A 00-FF N/A N/A N/A N/A 7 Data 3 N/A N/A N/A N/A N/A N/A 8 Data 4 N/A N/A N/A N/A N/A N/A

Table 56: EASY 700/800 control commands module function state data structure part 2 [42]

Byte Meaning R1-R16 S1-S8 T1-T16 Y1-Y8 Z1-Z3 H1-H8 0 Toggle Byte 01/81 01/81 01/81 01/81 01/81 01/81

1 Command R/W 88

(Read) 88

(Read) 88

(Read) 88

(Read) 88

(Read) 88

(Read) 2 Length 01 01 01 01 01 01 3 Type 88 89 ED 91 93 90 4 Index 00 00 00 00 00 00 5 Data 1 00-FF 00-FF 00-FF 00-FF 00-07 00-0F 6 Data 2 00-FF N/A 00-FF N/A N/A N/A 7 Data 3 N/A N/A N/A N/A N/A N/A 8 Data 4 N/A N/A N/A N/A N/A N/A

Table 57: EASY 700/800 control commands module function state data structure part 3 [42]

IA1-IA4: Index 00hex is analog input I7, 01hex is analog input I8, 02hex is analog input I11, and 03hex is

analog input I12. Combine Byte 6 (high byte) and Byte 5 (low byte) to obtain a 16-bit value. Then use

Equation 2 to calculate the actual voltage.

𝐴𝑐𝑡𝑢𝑎𝑙 𝑣𝑜𝑙𝑡𝑎𝑔𝑒 = 10𝑉

1023× 16 𝑏𝑖𝑡 𝑣𝑎𝑙𝑢𝑒

Equation 2: 16 bit digital to analog value conversion equation [42]

M1-M16 write: Index 01hex is M1, Index 0Ahex is M11.

N1-N16 write: Index 01hex is N1, Index 0Ahex is N11.

(Refer to Sample Code section for some data exchange examples)

Murdoch University Engineering Thesis

282 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Control Commands Slave Module Function Parameter Telegram Structure

The function parameter telegram structure is used to access the parameters of the function blocks. The only

value that can be written is the one which is assigned to a constant in the program such as setpoints. The

telegram structure of function parameter data exchange is shown in Table 58.

Byte Meaning A1-A16 C1-C16 O1-O4 T1-T16 Y1-Y8 H1-H8 0 Toggle Byte 01/81 01/81 01/81 01/81 01/81 01/81 1 Command R/W 89/8D 89/8D 89/8D 89/8D 89/8D 89/8D 2 Type 8D 8F 92 8E A2 A1 3 Instance 00-0F 00-0F 00-03 00-0F 00-07 00-07 4 Index 00-07 00-03 00-03 00-04 Table 71 Table 74 5 Data 1 00-FF 00-FF 00-FF 00-FF 00-FF 00-FF 6 Data 2 00-FF N/A N/A 00-FF 00-FF 00-FF 7 Data 3 N/A N/A N/A N/A 00-FF N/A 8 Data 4 N/A N/A N/A N/A N/A N/A

Table 58: EASY 700/800 control commands module function parameter data structure [42]

Murdoch University Engineering Thesis

283 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

A – Analog Comparator/Threshold Value Switch Function Block

Index Operand 00 Parameters (See Table 60) 01 Control byte (See Table 61) 02 I1 03 I2 04 F1 05 F2 06 OS 07 HY

Table 59: Analog comparator/threshold value switch function block index data structure [42]

Parameters bit Assignments

0 0: Not appear in the parameters menu 1: Appear in the parameters menu

1 – 3

000: FB not used 001: EQ (=) 010: GE (>=) 011: LE (<=) 100: GT (>) 101: LT(<)

4 0: I1 ≠ Constant 1: I1 = Constant

5 0: F1 ≠ Constant 1: F1 = Constant

6 0: I2 ≠ Constant 1: I2 = Constant

7 0: F2 ≠ Constant 1: F2 = Constant

8 0: OS ≠ Constant 1: OS = Constant

9 0: HY ≠ Constant 1: HY = Constant

10 – 15 Not used Table 60: Analog comparator/threshold value switch function block parameters data structure [42]

Control byte bit Assignments

0 0: Comparison condition is not fulfilled 1: Comparison condition is fulfilled

1 – 7 Not used Table 61: Analog comparator/threshold value switch function block control byte data structure [42]

Murdoch University Engineering Thesis

284 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

C – Counter Function Block

Index Operand 00 Parameters (See Table 63) 01 Control byte (See Table 64) 02 Actual value 03 Counter setpoint

Table 62: Counter function block index data structure [42]

Parameters bit Assignments

0 0: Not appear in the parameters menu 1: Appear in the parameters menu

1 – 2

00: FB not used 01: Up/down counter 10: High-speed up/down counter 11: Frequency counter

3 0: Counter setpoint is not used 1: Counter setpoint is used

4 – 7 Not used Table 63: Counter function block parameters data structure [42]

Control byte bit Assignments

0 0: On 1: Off

1 0: Up counting 1: Down counting

2 0: No reset 1: Reset coil

3 0: None 1: Count on rising edge

Table 64: Counter function block control byte data structure [42]

Murdoch University Engineering Thesis

285 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

T – Timing Relay Function Block

Index Operand 00 Parameters (See Table 66) 01 Control byte (See Table 67) 02 Actual value 03 Time setpoint 1 04 Time setpoint 2

Table 65: Timing relay function block index data structure [42]

Parameters bit Assignments

0 0: Not appear in the parameters menu 1: Appear in the parameters menu

1 – 3

000: On-delay 001: Off-delay 010: On-delay with random setpoint 011: Off-delay with random setpoint 100: On and off delay 101: On and off delay with random setpoint 110: Single pulse 111: Flashing

4 – 5

00: FB not used 01: Millisecond: MS 10: Second: S 11: Minute: M:S

6 0: Time setpoint 1 is not constant 1: Time setpoint 1 is constant

7 0: Time setpoint 2 is not constant 1: Time setpoint 2 is constant

Table 66: Timing relay function block parameters data structure [42]

Control byte bit Assignments 0 0: On

1: Off 1 0: None

1: Trigger coil 2 0: None

1: Reset coil 3 0: None

1: Stop coil 4 - 7 Not used

Table 67: Timing relay function block control byte data structure [42]

Murdoch University Engineering Thesis

286 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

O – Operating Hours Counter Function Block

Index Operand 00 Parameters (See Table 69) 01 Control byte (See Table 70) 02 Actual value 03 Counter setpoint

Table 68: Operating hours counter function block index data structure [42]

Parameters bit Assignments

0 0: Not appear in the parameters menu 1: Appear in the parameters menu

1 0: Setpoint is not a constant 1: Setpoint is a constant

2 – 7 Not used Table 69: Operating hours counter function block parameters data structure [42]

Control byte bit Assignments

0 0: On 1: Off

1 0: None 1: Trigger coil

2 0: None 1: Reset coil

3 – 7 Not used Table 70: Operating hours counter function block control byte data structure [42]

Murdoch University Engineering Thesis

287 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Y – Year Time Switch Function Block

Index Operand 00 Parameters (See Table 72) 01 Control byte (See Table 73) 11 Channel A time point ON 12 Channel A time point OFF 21 Channel B time point ON 22 Channel B time point OFF 31 Channel C time point ON 32 Channel C time point OFF 41 Channel D time point ON 42 Channel D time point OFF

Table 71: Year time switch function block index data structure [42]

Parameters bit Assignments

0 0: Channel A does not appear in the parameters menu 1: Channel A appears in the parameters menu

1 0: Channel B does not appear in the parameters menu 1: Channel B appears in the parameters menu

2 0: Channel C does not appear in the parameters menu 1: Channel C appears in the parameters menu

3 0: Channel D does not appear in the parameters menu 1: Channel D appears in the parameters menu

4 – 7 Not used Table 72: Year time switch function block parameters data structure [42]

Control byte bit Assignments

0 0: On 1: Off

1 – 7 Not used Table 73: Year time switch function block control byte data structure [42]

Murdoch University Engineering Thesis

288 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

H – 7-day Time Switch Function Block

Index Operand 00 Parameters (See Table 75) 01 Control byte (See Table 76) 11 Channel A Day on/off 12 Channel A On time 13 Channel A Off time 21 Channel B Day on/off 22 Channel B On time 23 Channel B Off time 31 Channel C Day on/off 32 Channel C On time 33 Channel C Off time 41 Channel D Day on/off 42 Channel D On time 43 Channel D Off time

Table 74: 7-day time switch function block index data structure [42]

Parameters bit Assignments

0 0: Channel A does not appear in the parameters menu 1: Channel A appears in the parameters menu

1 0: Channel B does not appear in the parameters menu 1: Channel B appears in the parameters menu

2 0: Channel C does not appear in the parameters menu 1: Channel C appears in the parameters menu

3 0: Channel D does not appear in the parameters menu 1: Channel D appears in the parameters menu

4 – 7 Not used Table 75: 7-day time switch function block parameter data structure [42]

Control byte bit Assignments

0 0: On 1: Off

1 – 7 Not used Table 76: 7-day time switch function block control byte data structure [42]

(Refer to Sample Code section for some data exchange examples)

Error Code

In case of command reject, byte 5, data 1 will contain the error code for troubleshooting purpose. Table 77

shows the description of the error code.

Error code Description 01 Unknown telegram transmitted. 02 Unknown object transmitted. 03 Unknown command transmitted. 04 Invalid instance transmitted. 05 Invalid parameter set transmitted. 06 An attempt was made to write to a variable that is not a constant. 0C The device is in an invalid device mode. STOP RUN or RUN STOP.

0D Invalid display access. Exit the menu level so that the status display is showing in the display. The clock cannot be written to.

F0 Attempt made to control an unknown parameter. F1 Impermissible value.

Table 77: Telegram rejection error code description [42]

Murdoch University Engineering Thesis

289 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Diagnostic Table 78 is the description of the diagnostic messages on EASY719 LCD.

LCD messages Description

No display Supply power interrupted. LCD fault.

TEST: AC

Self-test aborted. TEST: EEPROM TEST: DISPLAY TEST: CLOCK

ERROR: I2C

Memory card does not exist before saving.

Memory card fault.

EASY719 is fault.

ERROR: EEPROM Memory for retentive values/program fault. ERROR: CLOCK Clock error. ERROR: LCD LCD fault.

ERROR: ACLOW AC voltage inappropriate. EASY719 fault.

Table 78: LCD diagnostic messages description [42]

Murdoch University Engineering Thesis

290 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code

Toggle Byte Sample Code

Figure 239: Online sample code of toggle byte of Easy 700/800 control commands slave module data exchange

Murdoch University Engineering Thesis

291 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Input 1 Byte Sample Code

Figure 240: Online sample code of Input 1 byte slave module data exchange

Read 41hex = 0100_0001bin from Byte 0 S1 and S7 are on.

Output 1 Byte Sample Code

Figure 241: Online sample code of Output 1 byte slave module data exchange

Write 09bin = 0000_1001dec to Byte 0 Write 1 to R1 and R4.

Input 3 Bytes Sample Code

Figure 242: Online sample code of Input 3 bytes slave module data exchange

Read 11hex = 0001_0001bin from Byte 0 RUN mode with debounce.

Read 41hex = 0100_0001bin from Byte 1 S1 and S7 are on.

Output 3 Bytes Sample Code

Figure 243: Online sample code of Output 3 bytes slave module data exchange

Write 34hex = 0011_0100bin to Byte 0 RUN mode.

Write 08hex = 0000_1000bin to Byte 1 Write 1 to R12.

Write 10hex = 0001_0000bin to Byte 2 Write 1 to R5.

Murdoch University Engineering Thesis

292 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Function State

I – Input Basic Unit

Sample Code to Read

Figure 244: Online sample code read I state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 02hex to Length Length of 2.

Send 84hex to Type Read from I - Input basic unit.

Send 00hex to Index Default.

Read 03hex = 0000_0011bin from Data 1 I1 and I2 are on.

Read 01hex = 0000_0001bin from Data 2 I9 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

293 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

R – Input Expansion Device

Sample Code to Read

Figure 245: Online sample code read R state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 88hex to Type Read from R - Input expansion device.

Send 00hex to Index Default.

Read 10hex = 0001_0000bin from Data 1 R5 is on.

Read 08hex = 0000_1000bin from Data 2 R12 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

294 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Q – Output Basic Unit

Sample Code to Read

Figure 246: Online sample code read Q state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 85hex to Type Read from Q - Output basic unit.

Send 00hex to Index Default.

Read 23hex = 0010_0011bin from Data 1 Q1, Q2 and Q6 are on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

295 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

S – Output Expansion Device

Sample Code to Read

Figure 247: Online sample code read S state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 89hex to Type Read from S - Output expansion device.

Send 00hex to Index Default.

Read 84hex = 1000_0100bin from Data 1 S3 and S8 are on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

296 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

M – Marker

Sample Code to Read

Figure 248: Online sample code read M state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 86hex to Type Read from M - Marker.

Send 00hex to Index Default.

Read 80hex = 1000_0000bin from Data 1 M8 is on.

Read 20hex = 0010_0000bin from Data 2 M14 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

297 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Write

Figure 249: Online sample code write M state of Easy 700/800 control commands slave module data exchange

Send 8Chex to Command R/W Write state to EASY719.

Send 01hex to Length Length of 1.

Send 86hex to Type Write to M - Marker.

Send 01hex to Index Write to M2.

Write 01hex to Data 1 Write 1 to M2.

Read C1hex from Response Write successful.

Murdoch University Engineering Thesis

298 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

N – Marker

Sample Code to Read

Figure 250: Online sample code read N state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 87hex to Type Read from N - Marker.

Send 00hex to Index Default.

Read 08hex = 0000_1000bin from Data 1 N4 is on.

Read 02hex = 0000_0010bin from Data 2 N10 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

299 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Write

Figure 251: Online sample code write N state of Easy 700/800 control commands slave module data exchange

Send 8Chex to Command R/W Write state to EASY719.

Send 01hex to Length Length of 1.

Send 87hex to Type Write to N - Marker.

Send 0Bhex Index Write to N12.

Write 01hex to Data 1 Write 1 to N12.

Read C1hex from Response Write successful.

Murdoch University Engineering Thesis

300 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

P - P Buttons

Sample Code to Read

Figure 252: Online sample code read P state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 8Ahex to Type Read from P - P buttons.

Send 00hex to Index Default.

Read 08hex = 0000_1000bin from Data 1 P4 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

301 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

A - Analog Value Comparator/Threshold Value Switch

Sample Code to Read

Figure 253: Online sample code read A state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 8Bhex to Type Read from A - Analog comparator/threshold value switch.

Send 00hex Index Default.

Read 10hex = 0001_0000bin from Data 1 A5 is on.

Read 10hex = 0001_0000bin from Data 2 A13 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

302 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read

Figure 254: Online sample code read AI value of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read digital value from EASY719.

Send 02hex to Length Length of 2.

Send 8Chex to Type Read from AI - Analog input.

Send 01hex to Index Read AI2 from I8.

Read A1hex = 1010_0001bin from Data 1.

Read 03hex = 0000_0011bin from Data 2.

Read C2hex from Response Read successful.

The 16 bit value of AI2 is 0000_0011_1010_0001, therefore, 10𝑉

1023× 929 = 9𝑉.

Murdoch University Engineering Thesis

303 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

C - Counters

Sample Code to Read

Figure 255: Online sample code read C state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send EEhex to Type Read from C - Counters.

Send 00hex to Index Default.

Read 04hex = 0000_0100bin from Data 1 C3 is on.

Read 08hex = 0000_1000bin from Data 2 C12 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

304 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

D - Text Display

Sample Code to Read

Figure 256: Online sample code read D state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 94hex to Type Read from D - Text display.

Send 00hex to Index Default.

Read 20hex = 0010_0000bin from Data 1 D6 is on.

Read 40hex = 0100_0000bin from Data 2 D15 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

305 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

H - 7-day Time Switch

Sample Code to Read

Figure 257: Online sample code read H state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 90hex to Type Read from H - 7-day time switch.

Send 00hex to Index Default.

Read 84hex = 1000_0100bin from Data 1 H3 and H8 are on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

306 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

O - Operating Hours Counter

Sample Code to Read

Figure 258: Online sample code read O state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send EFhex to Type Read from O - Operating hours counter.

Send 00hex to Index Default.

Read 0Dhex = 0000_1101bin from Data 1 O1, O3 and O4 are on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

307 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

T - Timing Relays

Sample Code to Read

Figure 259: Online sample code read T state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send EDhex to Type Read from T - Timing relay.

Send 00hex to Index Default.

Read 10hex = 0001_0000bin from Data 1 T5 is on.

Read 10hex = 0001_0000bin from Data 2 T13 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

308 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Y - Year Time Switch

Sample Code to Read

Figure 260: Online sample code read Y state of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 91hex to Type Read from Y - Year time switch.

Send 00hex to Index Default.

Read 12hex = 0001_0010bin from Data 1 Y2 and Y5 are on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

309 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Z - Master Reset

Sample Code to Read

Figure 261: Online sample code read Z of Easy 700/800 control commands slave module data exchange

Send 88hex to Command R/W Read state from EASY719.

Send 01hex to Length Length of 1.

Send 93hex to Type Read from Z – Master reset.

Send 00hex to Index Default.

Read 03hex = 0000_0011bin from Data 1 Z1 and Z2 are on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

310 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Function Block Parameter

A – Analog Comparator/Threshold Value Switch Function Block

Sample Code to Read Parameters

Figure 262: Online sample code read A parameters of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Dhex to Type Read from A - Analog comparator/threshold value switch.

Send 04hex to Instance Read from A5.

Send 00hex to Index Read Parameters.

Read 78hex = 0111_1000bin from Data 1 and 03hex = 0000_0011bin from Data 2. Combine Data 1 and Data

2 gives 0000_0011_0111_1000bin which indicates I1, F1, I2, OS, HY are assigned to constants, whereas

F2 is assigned to a variable such as counter relay, analog input or timing relay. The data also indicates

that the Mode is GT (>) and appears in the parameter menu.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

311 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Control Byte

Figure 263: Online sample code read A control byte of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Dhex to Type Read from A - Analog comparator/threshold value switch.

Send 04hex to Instance Read from A5.

Send 01hex to Index Read Control byte.

Read 01hex = 0000_0001bin from Data 1 A5 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

312 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Actual Value

Figure 264: Online sample code read A actual value of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Dhex to Type Read from A - Analog comparator/threshold value switch.

Send 04hex to Instance Read from A5.

Send 02hex to Index Read I1 value.

Read 14hex = 20dec from Data 1 I1 is 20.

Read C2hex Response Read successful.

Murdoch University Engineering Thesis

313 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Write Constant Value

Figure 265: Online sample code write C constant of Easy 700/800 control commands slave module data exchange

Send 8Dhex Command R/W Write function block parameters to EASY719.

Send 8Dhex to Type Write to A - Analog comparator/threshold value switch.

Send 04hex to Instance Write to A5.

Send 02hex to Index Write value to I1.

Write 0Ahex = 10dec to Data 1 Write 10dec to I1.

Read C1hex from Response Write successful.

Murdoch University Engineering Thesis

314 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

C – Counter Function Block

Sample Code to Read Parameters

Figure 266: Online sample code read C parameters of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Fhex to Type Read from C - Counters.

Send 06hex to Instance Read from C7.

Send 00hex to Index Read Parameters.

Read 0Ahex = 0000_1010bin from Data 1 C7 is an up/down counter and has a constant setpoint, and

also does not appear in the parameter menu.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

315 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Control Byte

Figure 267: Online sample code read C control byte of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Fhex to Type Read from C - Counters.

Send 06hex to Instance Read from C7.

Send 01hex to Index Read Control byte.

Read 09hex = 0000_1001bin from Data 1 C7 is a rising edge counter and the current state is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

316 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Actual Value

Figure 268: Online sample code read C actual value of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Fhex to Type Read from C - Counters.

Send 06hex to Instance Read from C7.

Send 02hex to Index Read Actual value of the counter.

Read 2Ehex = 46dec from Data 1 C7 currently has a value of 46.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

317 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Write Constant Value

Figure 269: Online sample code write T constant of Easy 700/800 control commands slave module data exchange

Send 8Dhex to Command R/W Write function block parameters to EASY719.

Send 8Fhex to Type Write to C - Counters.

Send 06hex Instance Write to C7.

Send 03hex Index Writes value to Counter setpoint.

Write 05hex = 05dec to Data 1 Write 05dec to setpoint of C7.

Read C1hex Response Writes successful.

Murdoch University Engineering Thesis

318 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

T – Timing Relay Function Block

Sample Code to Read Parameters

Figure 270: Online sample code read T parameters of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Ehex to Type Read from T - Timing relay.

Send 04hex to Instance Read from T5.

Send 00hex to Index Read Parameters.

Read DEhex = 1101_1110bin from Data 1 T5 is a flashing timing relay with 2 timing setpoints and

resolution of millisecond. It also indicates that it does appear in the parameter menu.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

319 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Control Byte

Figure 271: Online sample code read T control byte of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Ehex to Type Read from T - Timing relay.

Send 04hex to Instance Read from T5.

Send 01hex to Index Read Control byte.

Read 03hex = 0000_0011bin from Data 1 Timing relay is a trigger coil and is currently on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

320 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Actual Values

Figure 272: Online sample code read T actual value of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 8Ehex to Type Read from T - Timing relay.

Send 04hex to Instance Read from T5.

Send 02hex to Index Read Actual value.

Read 4Bhex = 0100_1011bin from Data 1 and 01hex = 0000_0001bin from Data 2. Combine Data 1 and Data

2 gives 0000_0001_0100_1011bin = 331dec. Since it is in 10ms resolution, the actual time is 3310ms =

3.31s. (If it is in 1s resolution, it will be 331s. If it is in minute resolution, it will be 331 minutes.)

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

321 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Write Constant Value

Figure 273: Online sample code write T constant of Easy 700/800 control commands slave module data exchange

Send 8Dhex to Command R/W Write function block parameters to EASY719.

Send 8Ehex to Type Write to T - Timing relay.

Send 04hex to Instance Write to T5.

Send 03hex to Index Write value to Time setpoint 1.

Write F4hex to Data 1 and 01hex to Data 2 Write 01F4hex = 500dec to time setpoint 1 of T5, which is 5s

(500 × 10ms, under 10ms resolution).

Read C1hex from Response Write successful.

Murdoch University Engineering Thesis

322 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

O – Operating Hours Counter Function Block

Sample Code to Read Parameters

Figure 274: Online sample code read O parameters of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 92hex to Type Read from O - Operating hours counter.

Send 00hex to Instance Read from O1.

Send 00hex to Index Read Parameters.

Read 02hex = 0000_0010bin from Data 1 There is a constant setpoint. It also indicates that it does

appear in the parameter menu.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

323 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Control Byte

Figure 275: Online sample code read O control byte of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send 92hex to Type Read from O - Operating hours counter.

Send 00hex to Instance Read from O1.

Send 01hex Index Read Control byte.

Read 03hex = 0000_0011bin from Data 1 It is a contactor coil and is currently on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

324 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Write Constant Value

Figure 276: Online sample code write O constant of Easy 700/800 control commands slave module data exchange

Send 8Dhex to Command R/W Write function block parameters to EASY719.

Send 92hex to Type Write to O - Operating hours counter.

Send 00hex to Instance Write to O1.

Send 03hex to Index Write value to Counter setpoint.

Write 02hex to Data 1 Write 02dec to setpoint of O1

Read C1hex from Response Write successful.

Murdoch University Engineering Thesis

325 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Y – Year Time Switch Function Block

Sample Code to Read Parameters

Figure 277: Online sample code read Y parameters of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send A2hex to Type Read from Y - Year time switch.

Send 03hex to Instance Read from Y4.

Send 00hex to Index Read Parameters.

Read 1Fhex = 0001_1111bin from Data 1 Channel A, B, C and D are on and it appears in the parameter

menu.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

326 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Control Byte

Figure 278: Online sample code read Y control byte of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send A2hex to Type Read from Y - Year time switch.

Send 03hex to Instance Read from Y4.

Send 01hex to Index Read Control byte.

Read 01hex = 0000_0001bin from Data 1 Y4 is on.

Read C2hex Response Read successful.

Murdoch University Engineering Thesis

327 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Actual Value

Figure 279: Online sample code read Y actual value of Easy 700/800 control commands slave module data exchange

Send 89hex from Command R/W Read function block parameters from EASY719.

Send A2hex to Type Read from Y - Year time switch.

Send 03hex to Instance Read from Y4.

Send 21hex to Index Read Channel B time point ON.

Read 04hex = 04dec from Data 1, 01hex = 01dec from Data 2 and 0Dhex = 13dec from Data 3 DD/MM/YY.

Therefore the date is 04/01/2013.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

328 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Write Constant Value

Figure 280: Online sample code write Y constant of Easy 700/800 control commands slave module data exchange

Send 8Dhex to Command R/W Write function block parameters to EASY719.

Send A2hex to Type Write to Y - Year time switch.

Send 03hex to Instance Write to Y4.

Send 21hex to Index Write value to Channel B time point ON.

Write 0Ahex = 10dec to Data 1, 0Bhex = 11dec to Data 2 and 0Dhex = 13dec to Data 3 Write 10/11/2013 to

Channel B time point ON of Y4

Read C1hex from Response Write successful.

Murdoch University Engineering Thesis

329 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

H – 7-day Time Switch Function Block

Sample Code to Read Parameters

Figure 281: Online sample code read H parameters of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send A1hex to Type Read from H - 7-day time switch.

Send 05hex to Instance Read from H6.

Send 00hex to Index Read Parameters.

Read 10hex = 0001_0000bin from Data 1 Channel D is on and it does not appear in the parameter

menu.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

330 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Control Byte

Figure 282: Online sample code read H control byte of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send A1hex to Type Read from H - 7-day time switch.

Send 05hex to Instance Read from H6.

Send 01hex to Index Read Control byte.

Read 01hex = 0000_0001bin from Data 1 H6 is on.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

331 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Weekdays

Figure 283: Online sample code read H weekdays of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send A1hex to Type Read from H - 7-day time switch.

Send 05hex to Instance Read from H6.

Send 41hex to Index Read Channel D Day on/off.

Read 02hex = Monday from Data 1 and 01hex = Sunday from Data 2 H6 will be on from Monday to

Sunday.

Read C2hex to Response Read successful.

Murdoch University Engineering Thesis

332 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Read Time

Figure 284: Online sample code read H time of Easy 700/800 control commands slave module data exchange

Send 89hex to Command R/W Read function block parameters from EASY719.

Send A1hex to Type Read from H - 7-day time switch.

Send 05hex to Instance Read from H6.

Send 42hex to Index Read Channel D on time.

Read 01hex = 01dec from Data 1 and 0Bhex = 11dec from Data 2 01:11 a.m.

Read C2hex from Response Read successful.

Murdoch University Engineering Thesis

333 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

Sample Code to Write H Constant Value

Figure 285: Online sample code write H of Easy 700/800 control commands slave module data exchange

Send 8Dhex to Command R/W Write function block parameters to EASY719.

Send A1hex to Type Write to H - 7-day time switch.

Send 05hex to Instance Write to H6.

Send 41hex to Index Write value to Channel D starting day.

Write 03hex to Data 1 Write Tuesday to Channel D starting day of H6.

Read C1hex to Response Write successful.

Murdoch University Engineering Thesis

334 | P a g e WinCC SCADA System via Profibus & OPC by Hao Xu

This is the end of Appendix VI.