LLC "Techpromin" and "energy"

Communication controller for

Siemens Smai Line panels
Ethernet networks based on Siemens S7-200 Smart

User's manual

09/2015 v.07-10-46-A
1. Description

The device is an S7-200 Smart controller.

The software part is implemented in the Step-7 Micro / WIN Smart 2.0 programming environment.

2. Purpose of the device

The S7-200 Smart controller with a communication program is designed to connect Siemens Ѕ7-300,
S7-400, S7-1200, S7-1500 controllers with Siemens operator panels of the Simatic SMART LINE
series, by default designed to work only with S7-200 and S7 controllers -200 Smart. This limitation
applies to both the Smart 700 and Smart 1000 panel models and the 700IE and 1000IE models with
an Ethernet port.

3. Main functions

Communication PflK:
- receives data from the main PflK for display on the operator panel
- transfers to the main PfIK the data changed via the operator panel

The main PflK only responds to the requests of the communication PLC, the main PLC program does not
contain instructions for transferring data to the communication PflK.

The communication PLC only responds to requests from the operator panel, without independently
generating requests to it.

The communication PflK connects to the main PflK via Ethernet, exchanging data using the Profinet protocol.

Communication PflK connects to operator panels via PPI and / or Ethernet interface. The maximum
number of connected operator panels is determined by the model of the controller acting as a
communication controller.

4. Main PLC program

All data involved in the transfer between controllers are stored in the data block DB1. The data block
must have non-optimized access to data (indicating memory addresses), which is set in the TIA Portal
by unchecking the Optimized Data Access item in the data block properties (item "Attributes› ").

Structure of data block DB1

DBB 0 .. DBW18 Parameter table (see below)

DBX 20.0 .. DBX 51.7 DQ
DBB 52 Control byte for receiving settings data and disk. outputs
(Flags + Settings + DQ) = 16 # FF
DBB 53 Control byte for IN / OUT BOX
DBX 60.0 .. DBX91.7 DI
DBB 92 Control byte for data transfer of discrete inputs (DI)
DBB 100 .. A1 INBOX
A1 .. A2 OUTBOX
A2 .. AZ IN / OUT BOX
Parameter table

Address Zn. by
begging
DBX 0.0 false Allow data reception / transmission
DBX 0.1 false Allow DQ reception
DBX 0.2 false Allow sending DI
DBX 0.3 false Allow sending INBOX
DBX 0.4 false Allow receiving OUTBOX
DBX 0.5 false Allow receiving / transmitting IN / OUT BOX
DBB 2 ten Reconnection time on communication error [s]
DBB 3 ten Break time between receiving parameters [ms]
DBB 4 ten Timeout between DI sends [ms]
DBB 5 ten Timeout between INBOX sending [ms]
DBB 6 ten Break time between receptions OUTBOX [ms]
DBB 7 ten Timeout between reception / transmission IN / OUT BOX [ms]
DBB8 0 Number of used blocks for INBOX
DBB9 0 Number of used blocks for OUTBOX
DBB10 0 Number of used blocks for IN / OUT BOX
DBB11 0 The number of bytes in the last INBOX
DBB12 0 The number of bytes in the last OUTBOX block
DBB13 0 The number of bytes in the last IN / OUT BOX
DBW14 0 Amount of DWORD data in IN / OUT BOX
DBW16 0 Amount of WORD data in IN / OUT BOX
DBW18 0 Amount of BYTE data in IN / OUT BOX

All data is divided into 5 categories:

- sent data of discrete inputs of communication PflK (DI)
- received data of discrete outputs of communication PflK (DQ)
- sent data (INBOX)
- received data (OUTBOX)
- updatable data (IN / OUT BOX)

Since the purpose of data is to display and edit them on the operator panel, the terms INBOX and
OUTBOX are defined based on this.

Output (OUTBOX) data to the operator panel is transmitted from the main PflK to the operator
panel. From the side of the communication module, this is received data, since it is received
from the main PLC. The change in the values of these data occurs in the main PflK cycle. An
attempt to change them from the panel will not lead to any result, these data will not be sent to
the main PflK.

The data entered (input - INBOX) from the operator panel is transmitted from the operator panel to
the main PflK. From the side of the communication module, this is the data being sent, since it is
sent to the main PflK. Changing the values of these early takes place through the operator panel.
The old ones are replaced by the new ones received from the operator panel, regardless of what
values they had in the memory of the main controller earlier and whether their programs were
updated in the cigle.
The data that is both displayed on the operator panel and edited from it refer to the updated
data (IN / OUT BOX). Block DB1 does not store the actual IN / OUT BOX values, but only the
data that is needed for data transmission and reception. The actual values must be stored in
other data blocks. For correct operation, the data in the IN / OUT BOX must be updated on the
main PLC only at certain points in time, so that there is no conflict with changing values
through the operator panel and through the PLC. The update time is determined by the value
of the control byte for IN / OUT BOX.

The communication controller contains its own discrete inputs (DI) and outputs (DQ), and can also
contain its own expansion modules. For these DI and DQ, 32 bytes of memory are allocated for K0MM \
HICA.
It is necessary to obtain information about the DI state through the DBX 60.0 .. DBX 91.7 bits (corresponds
to I0.0 .. 131.7 of the communication PflK).
It is necessary to transfer information to DQ through the DBX 20.0 .. DBX 51.7 bits (corresponds to
Q0.0 ..
031.7 communication PflK).

Reception and transmission is carried out in accordance with the parameter table, which occupies the first 18
bytes of the DB1 block.

Description of the parameter table

Data exchange only takes place if the DBX bit 0.0 is set. Subsequent bits DBX 0.1 .. DBX 0.5 enable the
reception and transmission of data of specific categories.

Byte DBB2 sets the time after which the reconnection to the device will be made. The default is 10 seconds.

Bytes DBB3 .. DBB7 set the data update time.

The default is 0.1 seconds. The parameter is set in milliseconds, i.e. the default is 10.

Bytes DBB8 .. DBB10 specify the number of memory blocks allocated for INBOX, OUTBOX and IN /
OUT BOX. The maximum number of such blocks for each data category is 4. One block takes up to
200 bytes inclusive.

All blocks go sequentially starting from DBB100.

Example of a sequence of memory blocks in DB1

352
DBB100DBB300DBB432DBB612 DB812DBB1012

In the picture below:

- 2 memory blocks are allocated for INBOX DBB100 .. DBB299 and DBB300 .. DBB431,
- 1 memory block is allocated for OUTBOX DBB432 .. DBB611,
- 3 memory blocks are allocated for IN / OUT BOX: DBB612 .. DBB811, DBB812 .. DBB1011 and
DBB1012 .. DBB1051.
So for this example DBB8 = 2, DBB9 = 1, DBB10 = 3
The words DBW11 .. DBW13 specify the number of bytes for the last memory blocks of each category,
i.e. those blocks than the size can be less than 200 bytes.

Applied to the example above:

- DBW11 = 132 (432 - 300),
- DBW12 = 180 (612 - 432),
- DBW13 = 40 (1052 - 1012).
The size of intermediate blocks is always 200 bytes, therefore it is not specified.

Variables (mzgs) of different types can be located in INBOX and OUTBOX in any order, in IN / OUT
BOX the variables go sequentially depending on the bit depth (DWORD, WORD, BYTE, BIT).
DBW14 .. DBW18 set the number of data types DWORD, WORD and BYTE, respectively, in the
IN / OUT BOX. This information is necessary for the communication PfIK so that it can track
changes in the values of pregnant women (tags). Any remaining bytes of memory are treated as
bits.

Example of data sequence in IN / OUT BOX for the above example. Suppose the IN / OUT BOX
contains 30 DINTs, 28 REAL tags, 44 INT tags, 10 WORD tags, 84 BYTE variables, 128 BOOL
variables.

For this sequence:

- DBW14 = 58
- DBW16 = 54
- DBW18 = 84

The number of bytes allocated for bits is calculated in software:

[200 * (DBB10 - 1) + DBW13] - [DBW14 * 4 + DBW16 * 2 + DBW18]

[200 * (3 - 1) + 40] - [58 * 4 + 54 * 2 + 84] = 440 - 424 = 16

(i.e. in this case, the memory stores 16 * 8 = 128 bits).

Buret memory is distributed as follows:

DBD612— DBD840 — 4 byte maternity adpeca (DWORD, DINT, REAL) DBW844—
DBW950 — 2 byte maternity adpeca (WORD, INT, UINT) DBB952 — DBB1035 — 1
byte pregnant appeca (BYTE)
DBX1036.0— DВХ1051.7 — addresses of pregnant women with a size of 1 bit (BOOL)
Main controller program code

For IN / OUT BOX, the program must implement the following mechanism, called in each cycle:

IF ("DB 1" .INOUTBOX CHECKBYTE = 16 # AA)

THEN "DB 1" .INOUTBOX real 1 "DB 2"
.real 1; "DB 1" .INOUTBOX real2 "DB 2"
.real 2;

"DB 1" .INOUTBOX int 1 "DB 2" .int

1; "DB 1" .INOUTBOXint_2 "DB 2"
.int_2;

"DB 1" .INOUTBOX byte 1 "DB 2" .byte

1; "DB 1"
.INOUTBOX byte2 "DB 2" .byte 2;

"DB 1" .INOUTBOX bit 1: = "DB 2" .bit

1; "DB 1" .INOUTBOX bit 2: = "DB 2"
.bit 2;
ELSIF ("DB 1" .INOUTBOX CHECKBYTE = 16 # FF)
THEN "DB 2" .real 1 : = "DB 1" .INOUTBOX
real 1; "DB 2" .real 2: = "DB 1" .INOUTBOX
real 2;

"DB 2" .int 1: = "DB 1" .INOUTBOX int

1; "DB 2" .int 2: = "DB 1" .INOUTBOX
int_2;

"DB 2" .byte 1 "DB 1 ".INOUTBOX byte

1;" DB 2 ".byte 2 "DB 1 ".INOUTBOX
byte 2;

"DB 2" .bit 1 "DB 1" .INOUTBOX bit

1; "DB 2" .bit2 "DB 1" .INOUTBOX bit
2;

"DB 1" .INOUTBOX CHECKBYTE: = 16 #

AA; END IF;

5. Communication PLC program

All parameters required for data transfer are located in the parameter table, which is stored in data
block DB1 of the main PflK. Other parameters are stored in tables for which the VB55xx and VB56xx
communication PflK address spaces are allocated. The VB6xxx address space is allocated for service
pregnant women participating in the work.
The only parameter that must be set in the communication PflK is the IP address of the main PflK. This is
what the function is intended for
IP Config (byte, byte, byte, byte),
IN whichYu ip-adrefrom transmittedI am in viewe 4 chisel the formt b yt e (eg, adrefrom 192.168.0.1
transmitted kato parameters1 92, 1 68, 0 and I). The IP_Config function is called in the MAIN () function
in the first cycle of the communication PflK.
6. Table of correspondence of storage addresses in the main and
communication PLC

Command / S7-200 table address / DB1 Size (bytes) Description

address 57-200 address S7-1200 *
GET VB5500 53 Flags + Settings * D OUT 200 (get)
VB0 VB0
PUT VB5520 33 D_IN_200
VB60 VB60
PUT VB5540 32 D_0UT_200 (put)
V1060 VB20
GET VB5560 32 D_0UT_1200 (get)
VB2000 QB0
PUT VB5580 32 D_0UT_1200 (put)
VB4000 QB0
GET VB5600 32 D IN 1200
VB5900 IB0
GET VB5620 1 IN / OUT BOX
PUT control byte
VB6030 VB53
PUT VB5000 AND INBOX
VB100 VB100
GET VB5020 IN OUTBOX
VB1100 VB100 + Z (A)
GET VB5040 from IN / OUT BOX (get)
VB2100 VB100 + Z (A) + Z (B)
PUT VB5060 from IN / OUT BOX (put)
VB4100 VB100 + Z (A) + Z (B)

* addressing 8 controller 57-200 b0oі8eіsіvеі 8nuіrenny addresses in the data block DB1 controller 57-
1200, re., For example, 380 0оіveісі8уеі address DB1.DBB0

000 ‹TechPromEngineering" 170001

Tver, Spartak street, 43-b
(4822) 630278, tpi1Ayandex.ru tech-prom.net