1. Siemens Plc Slot Numbering Chart
2. Siemens Plc Slot Numbering Software

PLC5: The PLC5 processor has it's own dedicated place in the 1771 chassis on the left, and is not called a 'slot' at all, the following module locations are 'slots' and are sequentially numbered, starting at 0, according to the rack-addressing mode.

S7comm (S7 Communication) is a Siemens proprietary protocol that runs between programmable logic controllers (PLCs) of the Siemens S7-300/400 family.

• A Siemens PLC: S7-300, -400, -1200, or -1500. → Connection between the Ewon Flexy and the Siemens PLC must be done through Ethernet protocol. For polling tags over MPI, see “Polling Data from Siemens PLC using MPI protocol” from Related Documents, p. → The device will have its registers read by the tags configured in the IO server of the.
• A type of integer used by a Siemens PLC that is 32 bits long. A signed double integer may have any decimal value between -2,147,483,648 to +2,147,483,647: signed integer: Int. A type of integer used by a Siemens PLC that is 16 bits long. A signed integer may have any decimal value between -32,768 and +32,767. Signed short integer: SInt.
• Slot PLC discontinued. He was a controller such as S7412 (416) is used as a PC card is inserted into the slot and PC. Processor was hard. Soft-plc Used peripheral boards that are inserted into the PC (naprimerCP 5611) to connect the station input - output. Siemens CPU emulated CPU PC. Now is part of WINAC rtx.

It is used for PLC programming, exchanging data between PLCs, accessing PLC data from SCADA (supervisory control and data acquisition) systems and diagnostic purposes.

The S7comm data comes as payload of COTP data packets. The first byte is always 0x32 as protocol identifier. Special communication processors for the S7-400 series (CP 443) may use this protocol without the TCP/IP layers.

To establish a connection to a S7 PLC there are 3 steps:

1. Connect to PLC on TCP port 102
2. Connect on ISO layer (COTP Connect Request)
3. Connect on S7comm layer (s7comm.param.func = 0xf0, Setup communication)

Step 1) uses the IP address of the PLC/CP.

Step 2) uses as a destination TSAP of two bytes length. The first byte of the destination TSAP codes the communication type (1=PG, 2=OP). The second byte of the destination TSAP codes the rack and slot number: This is the position of the PLC CPU. The slot number is coded in Bits 0-4, the rack number is coded in Bits 5-7.

Step 3) is for negotiation of S7comm specific details (like the PDU size).

History

The protocol is used by Siemens since the Simatic S7 product series was launched in 1994. The protocol is also used on top of other physical/network layers, like RS-485 with MPI (Multi-Point-Interface) or Profibus.

Protocol dependencies

S7 communication consists of (at least) the following protocols:

• COTP: ISO 8073 COTP Connection-Oriented Transport Protocol (spec. available as RFC905)

• TPKT: RFC1006 'ISO transport services on top of the TCP: Version 3', updated by RFC2126

• TCP: Typically, TPKT uses TCP as its transport protocol. The well known TCP port for TPKT traffic is 102.

Example traffic

Wireshark

The S7comm dissector is partially functional.

Preference Settings

(XXX add links to preference settings affecting how PROTO is dissected).

Example capture file

• SampleCaptures/s7comm_downloading_block_db1.pcap s7comm: connecting and downloading program block DB1 into PLC

• SampleCaptures/s7comm_program_blocklist_onlineview.pcap s7comm: connecting and getting a list of all available block in the PLC

• SampleCaptures/s7comm_reading_plc_status.pcap s7comm: connecting and viewing the PLC status

• SampleCaptures/s7comm_reading_setting_plc_time.pcap s7comm: connecting, reading and setting the time of the PLC

• SampleCaptures/s7comm_varservice_libnodavedemo.pcap s7comm: running libnodave demo with S7-300 PLC, using variable-services with several areas

• SampleCaptures/s7comm_varservice_libnodavedemo_bench.pcap s7comm: running libnodave demo benchmark with S7-300 PLC using variable-services to check the communication capabilities

Display Filter

A complete list of PROTO display filter fields can be found in the display filter reference

Show only the S7comm based traffic:

Capture Filter

You cannot directly filter S7comm protocols while capturing.

S7comm uses port 102, so it is possible to capture S7comm data by using the capture filter

External links

• RFC1006ISO Transport Service on top of the TCP Version: 3, based on ISO 8073

• RFC905ISO Transport Protocol Specification ISO DP 8073

• Siemens - Information about the properties of the S7 protocolWhat properties, advantages and special features does the S7 protocol offer - Siemens Industry Online Support

Discussion

A programmable logic controller (PLC), also referred to as a programmable controller, is the name given to a type of computer commonly used in commercial and industrial control applications.

PLCs differ from office computers in the types of tasks that they perform, and the hardware and software they require to perform these tasks. While the specific applications vary widely, all PLCs monitor inputs and other variable values, make decisions based on a stored program, and control outputs to automate a process or machine.

The basic elements of a PLC include input modules or points, a central processing unit (CPU), output modules or points, and a programming device. The type of the input modules or points used by a PLC depends upon the types of the input devices used. Some input modules or points respond to digital inputs, also called discrete inputs, which are either on or off. Other modules or inputs respond to analog signals.

These analog signals represent machine or process conditions as a range of voltage or current values. The primary function of a PLC’s input circuitry is to convert the signals provided by these various switches and sensors into logic signals that can be used by the CPU. The CPU evaluates the statuses of the inputs, outputs, and other variables as it executes a stored program. The CPU then sends signals to update the status of the outputs.

The output modules convert the control signals from the CPU into digital or analog values that can be used to control various output devices. The programming device is used to enter and change the PLC’s program, to monitor and change the stored values. Once entered, the program and associated variables are stored in the CPU. In addition to these basic elements, a PLC system may also incorporate an operator interface device of some sort to simplify monitoring of the machine or process.

Hard-Wired Control

Prior to PLCs, many control tasks were performed by contactors, control relays and other electromechanical devices. This is often referred to as hard-wired control.

Circuit diagrams had to be designed, electrical components specified and installed, and wiring lists created. Electricians would then wire the necessary components to perform a specific task. If an error was made, the wires had to be reconnected correctly. A change in function or system expansion required extensive component changes and rewiring. SIMATIC software is the universal configuring and programming environment for SIMATIC controllers, human machine interface systems and process control systems. SIMATIC software with STEP 7 and numerous engineering tools supports all phases of product deployment, from hardware configuration of the system and parameterization of modules to service of the installed system. PLC programming can be done also with the help of Simatic Manager, which provides the possibility to write programs in three programming languages:

Ladder logic (LAD) is one programming language used with PLCs. Ladder logic incorporates programming functions that are graphically displayed to resemble the symbols used in hard-wired control diagrams.

Statement List (STL) – list of instructions. This editor allows you to create a program by entering the mnemonic commands. In this editor you can create programs that can not be created in the LAD and FBD editor. Programming in STL is very similar to the assembler language, but it’s more specific.

Siemens Plc Slot Numbering Chart

Function Block Diagram (FBD) – functional block diagram. This editor displays the program in the form of conventional logic circuits. There are no contacts, but there are equivalent functional units. This editor doesn’t use the term “power flow”, as in the LAD, it expresses a similar concept of the control flow through the FBD logic blocks.

Motor Starter Example

This example will show the practical aspect of programming in Step 7 with a real, existing part of a system. A motor starter coil (M) is wired in series with a normally open, momentary Start push-button, a normally closed, momentary Stop push-button, and normally closed overload relay (OL) contacts.

Siemens Plc Slot Numbering Software

PLC Motor Control

The motor control application can also be accomplished with a PLC. In the following example, a normally open Start push-button is wired to the first input (I0.0), a normally closed Stop push-button is wired to the second input (I0.1), and a normally closed overload relay contacts (part of the motor starter) are connected to the third input (I0.2). These inputs are used to control normally open contacts in a line of ladder logic programmed into the PLC.

Initially, I0.1 status bit is a logic 1 because the normally closed (NC) Stop push-button is closed. I0.2 status bit is a logic 1 because the normally closed (NC) overload relay (OL) contacts are closed. I0.0 status bit is a logic 0, however, because the normally open Start push-button has not been pressed.

Normally the open output Q0.0 contact is also programmed on Network 1 as a sealing contact. With this simple network, energizing the output coil Q0.0 is required to turn on the motor. When the Start push-button is pressed, the CPU receives a logic 1 from input I0.0. This causes the I0.0 contact to close. All three inputs are now a logic 1. The CPU sends a logic 1 to the Q0.0 output. The motor starter is energized and the motor starts.

The output status bit for Q0.0 is now equal to 1. On the next scan, when the normally open contact Q0.0 is solved, the contact will close, and the output Q0.0 will stay on, even if the Start push-button is released.

When the Stop push-button is pressed, the input I0.1 turns off, the I0.1 contact opens, the output coil Q0.0 de-energizes and the motor turns off.

Advantages of PLCs

PLCs are not only capable of performing the same tasks as hard-wired control, but are also capable of covering a larger array of complex applications. In addition, the PLC program and electronic communication lines replace much of the interconnecting wires required by hardwired control.

Therefore, hard-wiring, though still required to connect the field devices, is less intensive, that’s why correcting the errors and modifying the application is much easier.

Here are the main advantages of the PLCs:

• Smaller physical size than the hard-wire solutions;
• Easier and faster to make changes;
• PLCs have integrated diagnostics and override functions;
• Diagnostics are centrally available;
• Applications can be immediately documented;
• Applications can be duplicated faster and less expensively.

Evghenii
PLC Engineer