TCP/IP access to Siemens S7 from RT (no OPC)

[Blokk]

Thanks for the hints. Yep, I told the project leader already about the other approaches, but they wanted first to try this very simple TCP/IP approach. What is strange in our system is that, when it starts to work, it just runs for (a) day(s) now (we keep it running recently for a few days for testing). But totally randomly, after a PXI or PLC reboot the thing is just not working anymore (data comes from PLC ok, but garbage data arrives to the PLC). It is also not deterministic after how many reboots needed to get the network "come alive" 🙂

I have already downloaded the Data Ahead SP7 toolkit, the package and documentation look pro, and the pricing is also not bad (beside, they are NI Silver Alliance partners). We decided to test it (30 days evaluation) for some days at a later point, and if this approach proves total stability (which we do not have now!) even through many reboots, we might purchase it.

edit: what we see when the "malfunctioning communication" starts is that the TCP connection is lost, and our code tries to reconnect using some 2-3 seconds of timeout (TCP Create listener). After a couple of tries it establish connection again, but after 1-2 TCP Read and Write sequences the connection is again lost. And so on, this is repeated on, and all data arriving to the PLC is garbage...

[Blokk]

The people behind the SP7 toolkit were very helpful, and we tested the tool. Unfortunately, our PLC configuration is not as usual like people have, I cannot give exact details about this since I am not a PLC expert (something to do that we have a separate Ethernet card on the PLC rack, so different connection to the main PLC processor, etc...). Anyway, the toolkit does not work for our Siemens S7-400 (i was in a mistake about model 300) setup, at least the recent version of it.

However, we have a plan B to solve our PLC-PXI interface problem: we have a Profibus card in the Master PXI unit, and also a Profibus interface at the PLC rack. So we might just abandon TCP/IP, and use Profibus communication between the PXI and the PLC unit...

[rolfk]

Hmmm, could that be that the slot and rack numbers are then different in this setup? The SP7 Toolkit hides that detail away by giving you only the selection to define the type of PLC that you try to connect too. If they would allow a way to set those two values explicitedly then I think it would work even with your non standard network card.

[Blokk]

"Hmmm, could that be that the slot and rack numbers are then different in this setup?"

I am not the PLC guy in our project, but I can ask this tomorrow. Could you elaborate this further? How can I check the rack and slot numbers? (I think we have only one rack with several slots...?) I attach a photo, but no idea if that can help you 🙂

Thanks for info! 🙂

[rolfk]

It's a bit obscure but I found this screenshot on the Siemens website which shows how the rack and slot can be found.

[Blokk]

Thanks Rolf for the useful hints! I think I will play again a bit with the S7 PLC package from the community ( https://decibel.ni.com/content/docs/DOC-5467 ), and trying different slot numbers. There are lots of comments under the example how to do this (including a guy managed to make it work with a S7-400 PLC by changing the 18th element of a header array). I will write back here if I get success, and share my code with future readers...

By the way: i have seen a reply post under the above communit page. It describes some settings you need to make at the PLC side. I wonder if this is needed, since we got the info from the people behind the commercial toolkit, that we do not need to do any special settings at the PLC side, obviously except setting up the DBs?

Here is the post: "

"Permit acces with PUT/GET communication from remote partner (PLC, HMI, OPC,...)" in the TIA Portal (the setting can be found under Properties > Protection > Connection mechanisms). Until this option was set, i couldnt write or read the sps."

I will check this option too at the PLC side...

edit: and what is "sps" ? 🙂

edit2: hmm, maybe sps means PLC in German? 🙂

[rolfk · Accepted solution]

Well I took a look at the community example and while it probably works, I'm cringing at seeing binary byte arrays blopped all over the diagram to make up the bytestream of the messages. The S7 protocol is a properly structured data protocol and sending just complete binary byte arrays really feels like using a sledge hammer to drive in screws. It is bound to break at the slightest reconfiguration of the hardware while if you construct the protocol properly you can actually go and see what element has to be changed. Byte at index 18 of a large binary byte array sounds so unprofessional while saying something like you need to change the lower byte of the target address of the connection request packet is a lot clearer, especially since the protocol can contain variable sized elements so the index 18 could change at some point.

While the community sample really looks a lot like what they also do in libnodave, there is a much better version of C code to look at if you really want to understand the TCP-ISO based S7 protocol. The Snap7 library has a pretty clear and almost complete protocol implementation and it even comes with a ready to use LabVIEW wrapper already. Personally I don't like the style of the LabVIEW wrapper as it imposes to much knowledge about the underlaying C code implementation to use it properly (such as having to preallocated array buffers before calling the library VIs, etc.) but it is another data point in the S7 communication world.

I'm currently working on a fully LabVIEW only library that implements the S7 communication protocol over TCP and MPI, but it is both not ready for outside consumptions nor something I could just post for use by others.

And yes SPS stands for "Speicher Programmierbare Steuerung", pretty much the same as what PLC stands for.

[Blokk]

Dear Rolf,

Thanks again very much for the lots of info! Today I gave another try to the community example VIs, but could not make it work. Our PLC programmer says the problem probably is that we do not have the Ethernet port on the processor card at slot 3. We have a dedicated Ethernet card in slot 6...

Actually I will mark your latest post as a solution, not because we have found one, but because you cleared up the things with lots info, so I could come to the final decision which is we give up the TCP/IP route 🙂

I have also seen the above mentioned "Snap7" library after some search a couple of months ago, but we cannot use its wrapper since we need to run our code on LV RT, not under Windows. And since I am noob for C/C++, I do not want to waste our project time trying to implement the C libraries into LV...

We decided that we will go via the Profibus route (between Master PXI and S7 PLC), unless we get a working software with TCP/IP comm. from a company (but so far we did not see a working software).

Edit: " I'm currently working on a fully LabVIEW only library that implements the S7 communication protocol over TCP and MPI, but it is both not ready for outside consumptions nor something I could just post for use by others."

We migh be interested in the future if your work becomes available for sell... 🙂

[Blokk]

To report back the end of the story for future readers.

So we just abandoned this dreaded TCP route, and decided to use PROFIBUS (there was no company able to provide an out-of-box software solution for TCP/IP). We have a comsoft profibus interface in the master PXI, and also a profibus interface at the Siemens PLC side. It is just so simple and reliable to use it! No more headache 🙂 The thing is just so simple: you setup baud rate, address and the incoming/outgoing data array sizes. The data (in/out) is always represented as array of bytes (U8). But it is easy to convert between data types, so no problem (we send Words as 2 U8, and SGL values as 4 U8 value inside the arrays).

This is a solution which just works, no more headache with TCP/IP 🙂

[Skoda3]

Can You please share lv_snap7.dll with? I cannot find it on the internet so I cannot use this example..