Profibus comm sS7 to Seimens Ti

[consys]

We have an existing system where we are using profibus to communicate between S7 and Ti. I have found the "get" and "put" instructions in the S7 and can see how data from a particular data block in the S7 is either "gotten" or "put" into the Ti . But I cannot find where the address location in the Ti is specified. Surely somewhere there must be some mapping that describes this.

 

[JesperMP]

Is that really possible ?
I mean, is it really possible to have S7 type master-to-master communication between a TI 505 and a Siemens S7 ?
The PUT and GET instructions imply that an S7 connection type is used, and that is normally limited to S7 CPUs and master-to-master.

I would guess (whithout knowing the TI 505) that either the TI is master and the S7 is slave, or vice-versa.

How does the hardware configuration of the S7 look like ?

edit: And how does it look in NetPro of the S7 project ?

You can post a few screenshots.

 

[consys]

The Ti PLC is a SIMATIC 555. There is a CPU configured in the hardware called "Commons" but it doen't actaully exist. From what I have been told it was added to the config as a "place holder" to assist with setting up comms in the S7.

The ONLY code that have been able to find is in the S7. It uses GET and PUT. I can verify that the S7 locations (DB203) is transferred by profibus to the Ti V memory area. My problem is according to the GET/PUT instructions the location in the "partner" CPU is DB256.DBX8000.0 onwards. What I cannot find is how DB256 is mapped to V memory. I suspect that this originally may have been configured in the Ti profibus interface card but we cannot find an offline copy. It is not a problem as we are removing teh profibus link and replacing withethernet series PLC's.

 

[JesperMP]

Hi again consys.

Form your screenshot it can be seen that the connection type is FMS, not S7.
What I do not understand is that the CP343-5 modules in the S7-300 racks can only be servers for the S7 type comms (according to the specifications of the modules). This means that the S7-300's cannot initiate a PUT or GET comms job. Strange - as you have a PUT block in the PLC that seems to be working !

edit: After looking at it a little more, it seems that you can insert an FMS type connection and use PUT and GET with that. What I do not understand then is your connection ID of W#16#4. According to my testing the ID shall be a doubleword and formatted so that the first word is the normal ID number, and the second word is the LADDR number.
An example is ID = DW#16#00010100 for.

If you open NetPro again, you can try to select the CPU, so that the list of connections should appear automatically. I would like to see the connections for the "Commons" and "RPS" CPUs.

FMS was a variant of Profibus that never really catched on. I for example have no real-life experience with it.

I think it is a good idea to switch to ethernet.

 

[JesperMP]

I have found out of this.

For FMS connections the blocks FB3 READ and FB6 WRITE must be used, not PUT or GET. And READ and WRITE uses indeed the ID format with a doubleword.
Whoever renamed FB3 "READ" to "SIMATIC - GET" should be appropriately punished.

 

[consys]

Hello Jesper.

Here is (hopefully what you wanted to see. I have checked the PLC program the FB called "SIMATIC - PUT" is FB15. The "GET" is FB14.

 

[JesperMP]

It definitely says "Type" = "S7 connection" in the screenshot.
And FB14 and FB15 are consistent with the original GET and PUT blocks.
And the CP modules are CP342-5 (not CP343-5 as I thought I could make out on your 1st screenshot).
This is all consistent with regular normal Profibus DP, not Profibus FMS.

So, the error was really that someone had named the network PROFIBUS-FMS, despite FMS having nothing to do with it.

Now, for your original problem of trying to establish the adressing of the data transfer in the TI and the S7 PLCs, then I have searched and found absolutely nothing for this variant ! That is, TI-S7 profibus master-master comms in the shape of S7 connections. I think it is very much out of the ordinary.

If I were you I would try to monitor data tables in both PLCs, and then if possible manipulate individual bits to see if a pattern can be found.

 

[consys]

I have the pattern and I also know the data-ranges involved. My problem is that I want to change the range . basically the comms is moving several hundred words between Ti and s7. I want to reduce this to say twenty words. So that I can free up the reamining unused comms words. It is not an urgent matter but I would like to know how it was done. I think that the S7 part is OK. in that S7 "thinks" it is talking to another S7. I "think" that there must some sort of mapping from S7 memory(DB256.DBX8000.0) to Ti memory(V4001) done in the Ti profibus module. But I have no information on this. I will keep looking if I find any details I will keep you posted

Actually most of this plant is "very much out of the ordinary."

But if it was easy then everyone would want to do it....