TM

SMMaximum Value for OEMsMaximum Value for OEMs

Maximum Value for OEMsSM

From Rockwell Automation

NX Protocol TrainingNX Protocol TrainingFeb 27, 2007 ~ Mar 2 , 2007Feb 27, 2007 ~ Mar 2 , 2007

Ki Joon Kim

RAK OBB Strategic Marketing

Ki Joon Kim

RAK OBB Strategic Marketing

2

Simple Demo with PLC + HMI + OPC ServerSimple Demo with PLC + HMI + OPC Server

In H/W point, this Simple demo consists of PLC and PC.In S/W point, PC has Serial Port, OPC Server and HMI Software.

OPC : OLE for Process Control.HMI : You can use every HMI software such as RSView32, InTouch, iFix , WinCC and etc which support OPC.

Through this simple demo, we will show basic concept of communication with NX-Series PLC.

SerialPort

OPC ServerWinOPC orKepServer

HMIRSView32 or

iFIX orInTouch

Windows XP/2K

3

Setup OPC Server - WinOPCSetup OPC Server - WinOPC

WinOPC is a kind of OPC Server for NX-Series PLC but current is Version 1.0. So, it is inconvenient, yet.

You can use this one freely after download.

To define tag to read or write, user have to modify XML file.

In near future, GUI will be changed.

Configuration of Device.xml

Also, you can use help file to setup.

4

Setup OPC Server - KepServerSetup OPC Server - KepServer

This is came from KepWare. Also, you can download from www.kepware.com freely and you are able to use during 3 hours for each execution. (Ver.4 is able to use 2 hours.))

KepServer has 2 version. One is KepServer Enterprise for RA products such as RSView32, RS-SQL,etc and another is KepServerEX for general customer.

Let’s see procedure of setting up. (Application Note)

5

Simple Demo with PLC + HMI + OPC ServerSimple Demo with PLC + HMI + OPC Server

• We will show simple demo which are one of real applications.• One is an example of “Gas Engine Steam Supply and Power Generator”• The other is an example of controlling AC Drive with PLC.

6

PLC Communication ProtocolPLC Communication Protocol

RS232CRS485

CCU+ 통신Port(9Pin Female)

Items Description

Interface RS-232 / RS-485 1 Port

Baudrate 4800 / 9600 / 19200 / 34800

Synch/Asynch Half Duplex Asynchronous

Method Polling

Code Binary (HEX)

Communication Format Data Bits 8 bits

Stop Bits 1 bit

Parity Bit None

Error Check CRC-16

Data Transmit. Order Lower Byte First

Cable Twisted Pair Cable

Communication Specification

7

How to ConnectHow to Connect

Signal Pin

F.G 1

SD (TxD) 2

RD (RxD) 3

- 4

S.G (GND) 5

485- 6

485+ 7

- 8

Vcc 9

Pin Signal

1 F.G

2 RD(RxD)

3 SD(TxD)

4 DTR

5 S.G(GND)

6 DSR

7 RTS

8 CTS

9

PLC (9 Pin D-Sub Male) PC (9 Pin D-Sub Female)

RS-232C and RS-485 Cable

8

Function CodesFunction Codes

FunctionsQuery Function Code Response Function Code

Remark2 Step 4 Step 2 Step 4 Step

Read Bit $21 $01 $A1 $81

Write Bit $22 $02 $A2 $82

Read Word $23 $03 $A3 $83

Write Word $24 $04 $A4 $84

Read Mixed Bit/Word $25 $05 $A5 $85

Write Mixed Bit/Word $26 $06 $A6 $86

Read Program $27 $07 $A7 $87

Write Program $28 $08 $A8 $88

Read Instruction $29 $09 $A9 $89

Change Instruction $2A $0A $AA $8A

Change Operand $2B $0B $AB $8B

Insert Instruction $2C $0C $AC $8C

Delete Instruction $2D $0D $AD $8D

Find Instruction $2E $0E $AE $8E

Find Operand $2F $0F $AF $8F

Delete All/Partial Program $20 $10 $A0 $90

No Service $00 $00 $00 $00

9

Communication Frame (2-Steps)Communication Frame (2-Steps)

DA SAFunction

CodeLength Data CRC L CRC H

1~255 Byte (01~FF)0 : 256 Byte

See Function Code

Source Address

Destination Address

CRC-16 Code

Error Frame

DA SA $8x $01 Error Code CRC L CRC H

Data Size

Error #1 : Invalid FunctionError #2 : Overflow Error #3 : Invalid Frame StructureError #4 : Invalid CPU OperationError #5 : Too Long Frame

Source Address

Destination Address

CRC-16 Code

Function Code

10

Communication Frame (2-Steps)Communication Frame (2-Steps)

Communication Frame Example

Read Bit : Read 5 Bits from K0000.0 to K0000.4

Command

Answer

Write Bit : Write 3 Bits to M0000.0 to M0000.2

Command

Answer

Read Word : Read 3 Words from M0010 to M0012

Command

Answer

Write Word : Write 3 Word from M0000 to M0002

Command

Answer

FF FF 21 03 00 14 05 73 40

FF FF A1 05 FF FF 00 00 FF D4 DF

FF FF 22 05 00 00 FF 00 FF 71 77

FF FF A2 01 00 A0 72

FF FF 23 03 CA 00 03 A5 BC

FF FF A3 06 1B 00 BE 00 E6 00 41 CE

FF FF 24 08 C0 00 34 12 78 56 BC 9A 9F 43

FF FF A4 01 00 40 73

11

Calculate CRCCalculate CRC

DA SAFunction

CodeLength Data CRC L CRC H

CRC Calculation Scope 2 Byte CRC

CRC = 65535For i = 0 To PL - 1 CRC = Int(CRC / 256) Xor CRCTable((CRC Xor DATABLOCK(i)) And 255)Next i

12

Protocol (1/4) – Read BitProtocol (1/4) – Read Bit

Request Frame

Response Frame

Only for R, L, M, K, F, TC Register

Example Read Bit : Read 5 Bits from K0000.0 to K0000.4

Command

Answer

DA SA $21 $03 Base L Base H N CRC L CRC H

PLC ID PC ID Function Code Data Size

Absolute Register Address

The length of bits to read CRC

DA SA $A1 NBase+0

Bit ValueBase+1

Bit Value….

Base+N-1 Bit Value

CRC L CRC H

PC ID PLC ID Function Code Data Size

Data: ON=$FF,OFF=$00CRC

FF FF 21 03 00 14 05 73 40

FF FF A1 05 FF FF 00 00 FF D4 DF

$21 OR $80

* * * * *

13

Protocol (2/4) – Write BitProtocol (2/4) – Write Bit

Request Frame

Response Frame

Only for R, L, M, K, F, TC Register

Example Write Bit : Write 3 Bits to M0000.0 to M0000.2

Command

Answer

DA SA $22 N Base L Base HBase+0

Bit Value

Base+1

Bit Value…

Base+N-1

Bit ValueCRC L CRC H

PLC ID PC IDFunction

CodeAbsolute Register

AddressThe length of bits to write

CRC

DA SA $A2 $01 $00 CRC L CRC H

PC ID PLC ID Function Code Data SizeCRC

FF FF 22 05 00 00 FF 00 FF 71 77

FF FF A2 01 00 A0 72

$22 OR $80

* * * * *

14

Protocol (3/4) – Read WordProtocol (3/4) – Read Word

Request Frame

Response Frame

All Register

Example Read Word : Read 3 Words from M0010 to M0012

Command

Answer

DA SA $23 N Base L Base H N CRC L CRC H

PLC ID PC ID Function Code Data Size

Absolute Register Address

The length of bits to read CRC

DA SA $A3 LBase +0

Low Byte

Base +0

High Byte

Base +1

Low Byte

Base +1

High Byte….

Base +N-1

Low Byte

Base +N-1

High ByteCRC

LCRC

H

PC ID PLC ID

FunctionCode

Data Size L = N * 2

CRC

FF FF 23 03 CA 00 03 A5 BC

FF FF A3 06 1B 00 BE 00 E6 00 41 CE

$23 OR $80

15

Protocol (4/4) – Write WordProtocol (4/4) – Write Word

Request Frame

Response Frame

All Register

Example Write Word : Write 3 Word from M0000 to M0002

Command

Answer

DA SA $24 L Base L Base HBase +0

Low Byte

Base +0

High Byte

Base +1

Low Byte

Base +1

High Byte…

Base +1

Low Byte

Base+1

HighByteCRC L CRC H

PLCID

PC ID

Function Code

Absolute Register Address

CRCData Size L = N * 2+2

DA SA $A4 $01 $00 CRC L CRC H

PC ID PLC ID Function Code Data SizeCRC

FF FF 24 08 C0 00 34 12 78 56 BC 9A 9F 43

FF FF A4 01 00 40 73

$24 OR $80

16

Hand On LabHand On Lab

MaterialsHardware : PC, PLC (NX7 / 70), AC Drive or Servo Drive, Motor

Software : WinGPC, OPC Server, HMI Software

17

Modbus RTU – Inverter/Servo ControlModbus RTU – Inverter/Servo ControlEOI or HMI SW (OPC server)Speed and Status

COM1

COM2Modbus RTU

Master

Slave Slave

NX7 or NX70 or NX700 PLC

Inverter (AC Drive) or Servo

Speed/Torque Output Reference using Modbus RTU

Speed/Torque Input Feedback using 4-20mA Analog Inputs

EOI Monitors Feedback and Status

Yaskawa Servo

OEMax G5 AC Drive

18

Custom Protocol – Inverter/Servo ControlCustom Protocol – Inverter/Servo ControlEOI or HMI SW (OPC server)Speed and Status

COM1

COM2Modbus RTU Master and CSD* Protocol

Modbus RTU Slave CSD* Slave

NX7 or NX70 or NX700 PLC

Inverter (AC Drive) or Servo

Speed/Torque Output Reference using Modbus RTU

Speed/Torque Input Feedback using 4-20mA Analog Inputs

EOI Monitors Feedback and Status

OEMax CSD* Servo

OEMax G5 AC Drive

19

Success StoriesSuccess Stories

20

Tianjin SailingTianjin SailingOEMax protects China’s Environment!

Hengshui Haijiang Filter PressSludge Filtering under High PressureNX7-28ADR + NX7-28EDR digital I/O

30 Sets sold to CustomerAlso E-View EOI

Replaced LG Master-K PLCKeys to Win

Tianjin Relationship and ExperienceOffered Low Price similar to LG (but not lower)Tianjin Engineer programmed and integrated PLC

Next Targets are expected WinsShanghai Dazhang Filter Press

2 NX7 sets sold – Verbal commitment to use OEMax

Shanghai Coal Mining ApplicationNX70 – Verbal commitment to use OEMax

Dezhou Filter Press

21

Shanghai Hands (actually Wuxi Vanpoo Siemens branch)Shanghai Hands (actually Wuxi Vanpoo Siemens branch)

Wuxi BD Flocking (bdflocking.com)Textile – Pattern/Screen Printing on ClothNX70 Digital I/O and Analog 1-Axis Motion

1 set sold – Machine sold at Guangzhou Textile Exhibition100 sets projectedAlso Proface EOI + Siemens AC Microdrives

Replaced Siemens S7-200 or S7-300 PLCKeys to Win

Vanpoo DI Relationship and ExperienceVanpoo DI Makes Higher Margin selling OEMax PLC than Siemens

NX70 price is similar to S7-200 but functionally between S7-200 and S7-300

2-3 Vanpoo Engineers and OEMax Strategic Marketing programmed and integrated PLC

22

Shenzhen SandingShenzhen Sanding

MingSang Industrial (mingsang.com)Assembly – Ornament (Bracelet) Assembly MachinesNX7(S) Digital I/O and PTO 2-Axis Motion

20-30 sets sold so far to DI/SIAlso Eview EOI + Low Cost Steppers

Replaced Siemens S7-200Keys to Win

Shenzhen DI is Siemens System IntegratorProbably higher margin for System Integrator using OEMax PLC over Siemens S7-200 PLC

SOBB Engineering (BD Kim + JY Bae) modified NX7(S) FW to provide 32-bit PTO supportShenzhen Engineers programmed and integrated PLC

23

Question ?Question ?

24

TM

Maximum Value for OEMsSM