Transcript NX Protocol

TM
SM
Maximum Value for OEMs
From Rockwell Automation
NX Protocol Training
Feb 27, 2007 ~ Mar 2 , 2007
Ki Joon Kim
RAK OBB Strategic Marketing
Maximum Value for OEMs
SM
Simple Demo with PLC + HMI + OPC Server
Serial
Port
OPC Server
WinOPC or
KepServer
HMI
RSView32 or
iFIX or
InTouch
Windows XP/2K
In H/W point, this Simple demo consists of PLC and PC.
In S/W point, PC has Serial Port, OPC Server and HMI Software.
OPC : OLE for Process Control.
HMI : You can use every HMI software such as RSView32, InTouch,
iFix , WinCC and etc which support OPC.
Through this simple demo, we will show basic concept of
communication with NX-Series PLC.
2
Setup OPC Server - WinOPC
WinOPC is a kind of OPC Server for NX-Series PLC but current is
Version 1.0. So, it is inconvenient, yet.
You can use this one freely after download.
To define tag to read or write, user have to modify XML file.
In near future, GUI will be changed.
Configuration of Device.xml
Also, you can use help file to setup.
3
Setup OPC Server - KepServer
This is came from KepWare. Also, you can download from
www.kepware.com freely and you are able to use during 3 hours for
each execution. (Ver.4 is able to use 2 hours.))
KepServer has 2 version. One is KepServer Enterprise for RA products
such as RSView32, RS-SQL,etc and another is KepServerEX for
general customer.
Let’s see procedure of setting up. (Application Note)
4
Simple Demo with PLC + HMI + OPC Server
• We will show simple demo which
are one of real applications.
• One is an example of “Gas Engine
Steam Supply and Power
Generator”
• The other is an example of
controlling AC Drive with PLC.
5
PLC Communication Protocol
Communication Specification
Items
Description
Interface
RS-232 / RS-485 1 Port
Baudrate
4800 / 9600 / 19200 / 34800
Synch/Asynch
Method
Code
Communication Format
Half Duplex Asynchronous
Polling
Binary (HEX)
RS232C
RS485
Data Bits 8 bits
Stop Bits 1 bit
Parity Bit None
Error Check
Data Transmit. Order
Cable
CRC-16
CCU + 통신Po rt
(9P in Fe male)
Lower Byte First
Twisted Pair Cable
6
How to Connect
PLC (9 Pin D-Sub Male)
PC (9 Pin D-Sub Female)
Signal
Pin
Pin
Signal
F.G
1
1
F.G
SD (TxD)
2
2
RD(RxD)
RD (RxD)
3
3
SD(TxD)
-
4
4
DTR
S.G (GND)
5
5
S.G(GND)
485-
6
6
DSR
485+
7
7
RTS
-
8
8
CTS
Vcc
9
9
RS-232C and RS-485 Cable
7
Function Codes
Functions
Query Function Code
Response Function Code
2 Step
4 Step
2 Step
4 Step
Read Bit
$21
$01
$A1
$81
Write Bit
$22
$02
$A2
$82
Read Word
$23
$03
$A3
$83
Write Word
$24
$04
$A4
$84
Read Mixed Bit/Word
$25
$05
$A5
$85
Write Mixed Bit/Word
$26
$06
$A6
$86
Read Program
$27
$07
$A7
$87
Write Program
$28
$08
$A8
$88
Read Instruction
$29
$09
$A9
$89
Change Instruction
$2A
$0A
$AA
$8A
Change Operand
$2B
$0B
$AB
$8B
Insert Instruction
$2C
$0C
$AC
$8C
Delete Instruction
$2D
$0D
$AD
$8D
Find Instruction
$2E
$0E
$AE
$8E
Find Operand
$2F
$0F
$AF
$8F
Delete All/Partial Program
$20
$10
$A0
$90
No Service
$00
$00
$00
$00
Remark
8
Communication Frame (2-Steps)
DA
Function
Code
SA
Length
Data
CRC L
1~255 Byte (01~FF)
0 : 256 Byte
Source Address
Destination Address
CRC H
CRC-16 Code
See Function Code
Error Frame
DA
SA
$8x
Source Address
$01
Error Code
CRC L
CRC H
Data Size
CRC-16 Code
Destination Address
Function Code
Error #1 : Invalid Function
Error #2 : Overflow
Error #3 : Invalid Frame Structure
Error #4 : Invalid CPU Operation
Error #5 : Too Long Frame
9
Communication Frame (2-Steps)
Communication Frame Example
Read Bit : Read 5 Bits from K0000.0 to K0000.4
Command
FF
FF
21
03
00
14
05
73
40
Answer
FF
FF
A1
05
FF
FF
00
00
FF
D4
DF
Write Bit : Write 3 Bits to M0000.0 to M0000.2
Command
FF
FF
22
05
00
00
FF
Answer
FF
FF
A2
01
00
A0
72
00
FF
71
77
Read Word : Read 3 Words from M0010 to M0012
Command
FF
FF
23
03
CA
00
03
A5
BC
Answer
FF
FF
A3
06
1B
00
BE
00
E6
00
41
CE
Write Word : Write 3 Word from M0000 to M0002
Command
FF
Answer
FF
FF
FF
24
A4
08
C0
01
00
00
34
40
12
78
56
BC
9A
9F
43
73
10
Calculate CRC
DA
SA
Function
Code
Length
CRC Calculation Scope
Data
CRC L
CRC H
2 Byte CRC
CRC = 65535
For i = 0 To PL - 1
CRC = Int(CRC / 256) Xor CRCTable((CRC Xor DATABLOCK(i)) And 255)
Next i
11
Protocol (1/4) – Read Bit
Request Frame
DA
PLC ID
SA
$21
$03
Base L
PC ID
Function Code
Data Size
Base H
N
CRC L
The length of
bits to read
Absolute Register Address
CRC H
CRC
$21 OR $80
Response Frame
DA
PC ID
SA
PLC ID
$A1
Base+0
Bit Value
N
Function Code
Base+1
Bit Value
CRC L
CRC H
FF
A1
05
CRC
Data: ON=$FF,OFF=$00
Read Bit : Read 5 Bits from K0000.0 to K0000.4
Command
FF
FF
21
03
00
14
05
FF
Base+N-1
Bit Value
Data Size
Only for R, L, M, K, F, TC Register
Example
Answer
….
73
40
FF
FF
00
00
FF
*
*
*
*
*
D4
DF
12
Protocol (2/4) – Write Bit
Request Frame
DA
PLC ID
SA
$22
PC ID
Function
Code
N
$22 OR $80
Base L
Base+0
Bit Value
Base H
Base+1
Bit Value
Base+N-1
Bit Value
…
Absolute Register
Address
The length of
bits to write
CRC L
CRC H
CRC
Response Frame
DA
PC ID
SA
PLC ID
$A2
Function Code
$01
$00
CRC L
Data Size
CRC H
CRC
Only for R, L, M, K, F, TC Register
Example
Write Bit : Write 3 Bits to M0000.0 to M0000.2
*
*
*
*
*
Command
FF
FF
22
05
00
00
FF
00
FF
Answer
FF
FF
A2
01
00
A0
72
71
77
13
Protocol (3/4) – Read Word
Request Frame
DA
PLC ID
SA
$23
N
Base L
PC ID
Function Code
Data Size
Base H
N
Absolute Register Address
CRC L
The length of
bits to read
CRC H
CRC
$23 OR $80
Response Frame
DA
SA
PC ID
PLC ID
$A3
L
Base +0
Low Byte
Base +0
High Byte
Base +1
Low Byte
Base +1
High Byte
….
Base +N-1
Low Byte
Base +N-1
High Byte
Data Size
L=N*2
CRC
L
CRC
H
CRC
Function
Code
All Register
Example
Read Word : Read 3 Words from M0010 to M0012
Command FF FF 23 03 CA 00 03
Answer
FF
FF
A3
06
1B
00
BE
A5
BC
00
E6
00
41
CE
14
Protocol (4/4) – Write Word
Request Frame
DA
PLC
ID
SA
PC
ID
$24
L
Base L
Function
Code
Base +0
Low Byte
Base H
Base +0
High Byte
Base +1
Low Byte
Base +1
High Byte
Base +1
Low Byte
…
Base+1
HighByte
CRC L
CRC H
Absolute Register
Address
$24 OR $80
CRC
Data Size
L = N * 2+2
Response Frame
DA
PC ID
SA
PLC ID
$A4
Function Code
$01
$00
CRC L
Data Size
CRC H
CRC
All Register
Example
Write Word : Write 3 Word from M0000 to M0002
Command
FF
FF
24
08
C0
00
34
Answer
FF
FF
A4
01
00
40
12
78
56
BC
9A
9F
43
73
15
Hand On Lab
Materials
Hardware : PC, PLC (NX7 / 70), AC Drive or Servo Drive, Motor
Software : WinGPC, OPC Server, HMI Software
16
Modbus RTU – Inverter/Servo Control
EOI or HMI SW (OPC server)
Speed and Status
NX7 or NX70 or NX700 PLC
COM1
COM2
Modbus RTU
Master
Slave
Slave
Inverter (AC Drive) or
Servo
OEMax
G5 AC
Drive
Speed/Torque Output
Reference using Modbus
RTU
Speed/Torque Input
Feedback using 4-20mA
Analog Inputs
EOI Monitors Feedback and
Status
Yaskawa
Servo
17
Custom Protocol – Inverter/Servo Control
EOI or HMI SW (OPC server)
Speed and Status
NX7 or NX70 or NX700 PLC
COM1
COM2
Modbus RTU Master
and CSD* Protocol
Modbus RTU Slave
OEMax
G5 AC
Drive
Inverter (AC Drive) or
Servo
Speed/Torque Output
Reference using Modbus
RTU
Speed/Torque Input
Feedback using 4-20mA
Analog Inputs
EOI Monitors Feedback and
Status
CSD* Slave
OEMax
CSD*
Servo
18
Success Stories
19
Tianjin Sailing
OEMax protects China’s Environment!
Hengshui Haijiang Filter Press
Sludge Filtering under High Pressure
NX7-28ADR + NX7-28EDR digital I/O
30 Sets sold to Customer
Also E-View EOI
Replaced LG Master-K PLC
Keys to Win
Tianjin Relationship and Experience
Offered Low Price similar to LG (but not lower)
Tianjin Engineer programmed and integrated PLC
Next Targets are expected Wins
Shanghai Dazhang Filter Press
2 NX7 sets sold – Verbal commitment to use OEMax
Shanghai Coal Mining Application
NX70 – Verbal commitment to use OEMax
Dezhou Filter Press
20
Shanghai Hands (actually Wuxi Vanpoo Siemens branch)
Wuxi BD Flocking (bdflocking.com)
Textile – Pattern/Screen Printing on Cloth
NX70 Digital I/O and Analog 1-Axis Motion
1 set sold – Machine sold at Guangzhou
Textile Exhibition
100 sets projected
Also Proface EOI + Siemens AC Microdrives
Replaced Siemens S7-200 or S7-300 PLC
Keys to Win
Vanpoo DI Relationship and Experience
Vanpoo DI Makes Higher Margin selling
OEMax PLC than Siemens
NX70 price is similar to S7-200 but
functionally between S7-200 and S7-300
2-3 Vanpoo Engineers and OEMax Strategic
Marketing programmed and integrated PLC
21
Shenzhen Sanding
MingSang Industrial (mingsang.com)
Assembly – Ornament (Bracelet) Assembly
Machines
NX7(S) Digital I/O and PTO 2-Axis Motion
20-30 sets sold so far to DI/SI
Also Eview EOI + Low Cost Steppers
Replaced Siemens S7-200
Keys to Win
Shenzhen DI is Siemens System Integrator
Probably higher margin for System
Integrator using OEMax PLC over Siemens
S7-200 PLC
SOBB Engineering (BD Kim + JY Bae)
modified NX7(S) FW to provide 32-bit PTO
support
Shenzhen Engineers programmed and
integrated PLC
22
Question ?
23
TM
Maximum Value for OEMs
SM
24