Using the 2572 / 2572-A Ethernet Modules and the CPU Ethernet Port

1
Using the 2572 / 2572-A Ethernet Modulesand the
CPU Ethernet Port
2
2572 features

• 10 Mbit support
• RJ-45 and AUI interface
• IP addressing from serial port or PLC
• Serial port for configuration and PLC programming
• Supports external power for transceiver
• 100 compatibility with 505-CP2572
• Server mode for supporting HMIs
• 2 Client modes for peer-peer
• Email capability
• S7 send/receive support

3
2572-A features

• 2572 compatibility
• Better performance (2x)
• 100Mb support
• New startup option to use DHCP for addressing
• Enhanced diagnostics stored in non-volatile RAM
• Web server for configuration and diagnostics
• Better security for configuration changes
• Password control
• Hardware lockout

4
2572 Front Panel - Status LEDs

• ACTIVE
• Solid module status good
• Slow blink fault
• Fast blink no IP address
• XMIT-1, XMIT-2, XMIT-E
• Lights when data is transmitted on the port
• RCV-1, RCV-2, RCV-3
• Lights when data is received on the port
• LB (link beat)
• Lights when there is a good connection to a hub
  or switch
• AUI
• Lights when the AUI port is selected
  (automatically selected if no link beat on RJ45
  port
• POL (polarity)
• Lights when polarity is reversed on the RJ45 port
  (automatically corrected)
• COL (collision)
• Lights when a collision is detected

5
2572 Front Panel - Serial ports

• Port 1 DB9 male RS232
• Port 2 DB9 female RS422
• Port parameters set by switches or PLC logic
• Used for module configuration and PLC programming
• Redirect feature sends serial port data to
  another 2572 on the network (useful for APT and
  TISOFT programming)

6
2572 Front Panel - Ethernet

• 10bT
• Connects to Ethernet UTP (unshielded twisted
  pair) using RJ45 connector
• AUI
• Connects to an Ethernet transceiver, allowing
  attachment to coaxial for fiber networks
• AUI power
• Allows user to optionally supply external power
  for the AUI (default is PLC powered)
• 10bT port is primary if no Link Beat then AUI
  port is used
• A status bit is sent to the PLC indicating which
  port is selected

7
2572-A Front Panel - Status LEDs

• MS (Module Status)
• Steady Green module hardware and software is
  operational
• Flashing green module is starting up
• Steady red or flashing red error conditions.
• NS (Network Status)
• Steady Green network server is operational (IP
  address has been set)
• Steady red or flashing red error conditions
• Off network server has not been started.
• LS (Link Status)
• Steady Green a link exists between the module
  and the Ethernet hub or switch
• Off no cable connected, or cable fault
• COL (Collision)
• Lights when a collision is detected

8
2572-A Front Panel - Status LEDs

• FDX (Full-Duplex)
• Steady green full duplex mode. 100 (100 Mb)
• Steady Green 100Mb
• Off 10Mb
• XMT-S, XMIT-E (Transmit)
• Lights when data is transmitted on serial or
  Ethernet ports
• RCV-S, RCV-E (Receive)
• Lights when data is received on serial or
  Ethernet ports

9
2572-A Front Panel

• Reset button
• Recessed to avoid accidental press
• Causes a hardware reset (like removing the module
  and reinstalling)
• Module ID switches
• Set the module ID for use with DHCP
  auto-addressing

10
2572-A Front Panel

• Serial port
• RS232
• Works with PLC programming cables
• For module configuration only
• Ethernet port
• Supports 10Mb or 100Mb
• Shielded or unshielded cable

11
Ethernet Module Functions

• PLC server allows external clients to read and
  write PLC memory (HMI)
• Client sends request to the module using NITP or
  CAMP command embedded in TCP/IP packet
• Module sends the command to the PLC over the
  backplane
• PLC responds over the backplane
• Module returns data or acknowledgement to the
  client
• Up to 8 requests (2572) or 16 requests (2572-A)
  allowed per PLC scan
• PLC client (peer-peer)
• Under control of PLC logic
• Sends messages to other nodes
• Processes messages from other nodes
• Can support multiple concurrent connections

12
PLC command interface

• A command interface is used to trigger the module
  to send and receive data
• Not required for simple HMI operation
• Module logs in as 2WX, 6WY
• Command process
• Place a command block in V-memory
• Put the starting address of the command block in
  WY5-8
• Trigger a bit in WY4
• Monitor command status in WX2
• Up to 4 commands can be processed simultaneously

13
PLC command interface

• Logs in as 2WX and 6WY words

14
WX / WY Map
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Module Status Word
WX1
Command Status Word
CMD 1
CMD 2
CMD 3
CMD 4
WX2
Status Bits
Status Bits
Status Bits
Status Bits
Module Control Word
WY3
Command Control Word
CMD 1
CMD 2
CMD 3
CMD 4
WY4
Control Bits
Control Bits
Control Bits
Control Bits
Command Slot 1 V Memory Address of Command Block
for CMD1
WY5
Command Slot 2 V Memory Address of Command Block
for CMD2
WY6
Command Slot 3 V Memory Address of Command Block
for CMD3
WY7
Command Slot 4 V Memory Address of Command Block
for CMD4
WY8
15
Module Status Word (WX1)

• 2572
• 2572-A

   
1
2
3
4
5
6
7
8
9 - 16
MOD FAIL
SER CFG
NET CFG
DIAG ERR
CFG ERR
AUI ACT
DS ACT
RSVD
TimerE Code
1
2
3
4
5
6
7
8 - 15
16
MOD STATUS
RSVD
NET CFG
RSVD
RSVD
LINK STATUS
RSVD
RSVD
HEART BEAT
16
Module Control Word (WY3)
1
2
3
4
5
6
7
8
9 - 16
MOD RESET
RSVD
RSVD
RSVD
RSVD
RSVD
RSVD
RSVD
RSVD

• To perform a module reset, set MOD RESET AND set
  all 4 abort triggers in the Command Control word
  (WY4).

17
Command Control Word (WY4)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
ERR Ack
CMD Mode
CMD Trig
Abort Trig
ERR Ack
CMD Mode
CMD Trig
Abort Trig
ERR Ack
CMD Mode
CMD Trig
Abort Trig
ERR Ack
CMD Mode
CMD Trig
Abort Trig
Command 1
Command 2
Command 3
Command 4

• CMD Mode
• 0 uncoupled mode (command runs continuously as
  long as CMD Trig is high)
• 1 coupled mode (command runs once, then CMD
  Trig must go low and high to run command again)

18
Command Status Word (WX2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
CMDERR
PLC Err
CMD Busy
Abort Busy
CMDERR
PLC Err
CMD Busy
Abort Busy
CMDERR
PLC Err
CMD Busy
Abort Busy
CMDERR
PLC Err
CMD Busy
Abort Busy
Command 1
Command 2
Command 3
Command 4

• CMD Err error in executing command
• Error code is written into first word of command
  block in V-memory
• PLC Err no valid command block at specified
  V-memory address
• No error code is written

19
Command Block in V-Memory
Offset
Contents

• Common Commands
• 4 start network server
• 3 create connection
• 2 close connection
• 513 write remote
• 514 read remote
• 515 memory exchange

Error Word
0
Command Code
1
Connection Number
2
Command Parameter 1
3
Additional parameters
4-15

• Command block is 16 contiguous words in V-Memory
• If error in processing, Error Word contains the
  code of the error
• Command code type of command
• Connection Number which protocol manager
  executes the command
• High byte of Connection Number must 4B

20
Sample Command BlockStart Network Server
 
Offset
Description
Hex Value
Decimal Value
Command Error Word
0
0
0
Command (Start Network Server)
1
4
4
Connection Number (19291 - 19299)
2
19298
4B62
Protocol Manager Number
3
35
23
Startup Option Bits
4
0
0
TCP Keep Alive Interval in Seconds (0default
60) (Set to 65000 or greater to disable Keep
Alive)
5
0
0
IP Address of this Module (High 16 bits)
6
51128
C7B8
IP Address of this Module (Low 16 bits)
7
45378
B142
TCP / UDP Port Number
8
1505
05E1
IP Address of Default Router (High 16 bits)
9
0
0
IP Address of Default Router (Low 16 bits)
10
0
0
Max Number of TCP Connections (0default) Mask
(High 16 bits)
11
0
0
Subnet Mask (High 16 bits)
12
65535
FFFF
Subnet Mask (Low 16 bits)
13
65280
FF00
Unused - reserved for future use (Set to 0)
14
0
0
Unused - reserved for future use (Set to 0)
15
0
0
21
Getting Started Using the 2572

• Determine IP address
• Choose network startup mode
• Set up switches
• Install 2572 and connect network cable
• Enter startup ladder logic if PLC-start
  selected or enter IP address into module if
  auto-start selected
• Verify PC address is on the same network as the
  2572
• Test connection using ping

22
Getting started using the 2572

• Choose network startup mode
• Automatically starting the network server
• Starts the network server from onboard EEPROM
• Requires IP address to be pre-assigned using
  serial port with CTIDiag program
• Requires no PLC logic
• Starting the network server from PLC logic
• Requires PLC logic to trigger start network
  server command block
• Ensures that any 2572 plugged into that slot will
  get the same IP address
• Easy replacement of modules
• Automatic start with DHCP server (2572-A only)
• Ensures a replacement module will get the same
  address as the old module
• Does not require any PLC logic
• Requires a DHCP server on the network which must
  be configured to support Module ID

23
Getting Started Using the 2572

• Set switches
• 2572
• Serial port protocol and baud rate
• Serial port handshaking
• Network startup mode
• EEPROM write protect
• AUI power
• 2572-A
• Serial port baud rate
• Diagnostic start
• Interface mode
• Password bypass
• Download lock
• Configuration lock
• Network startup mode

24
Setting Switches

• 2572

2572-A
SW1
SW1
SW2
25
Setting Switches (2572)
SW1

• SW1 controls serial port 1

26
Setting Switches (2572)
SW2

• SW2 controls serial port 2 and network startup

27
Setting Switches (2572-A)
SW1
1 2 3 4 5 6 7 8 9
10 11 12
OPEN
28
Automatically Starting the Network Server

• Select Auto-Start on switches
• SW2 position 4 on 2572
• SW1 position 4 on 2572-A
• Assign the IP address using the serial port
• Attach serial cable
• Run CTIDiag
• Open I/O data port
• Choose Module, Set network parameters
• Reset the module
• Verify communication with the module using ping

Start CTIDiag
29
Starting the Network Server from PLC Logic

• Select PLC-Start on switches
• SW2 position 4 on 2572
• SW1 position 4 on 2572-A
• Setup the Start Network Server command block in
  V-memory
• Enter the example logic for triggering the
  command block
• Start the program
• Verify communication with the module using ping

30
Start Network Server Command Block
 
Offset
Description
Hex Value
Decimal Value
Command Error Word
0
0
0
Command (Start Network Server)
1
4
4
Connection Number (19291 - 19299)
2
19298
4B62
Protocol Manager Number
3
35
23
Startup Option Bits
4
0
0
TCP Keep Alive Interval in Seconds (0default
60) (Set to 65000 or greater to disable Keep
Alive)
5
0
0
IP Address of this Module (High 16 bits)
6
51128
C7B8
IP Address of this Module (Low 16 bits)
7
45378
B142
TCP / UDP Port Number
8
1505
05E1
IP Address of Default Router (High 16 bits)
9
0
0
IP Address of Default Router (Low 16 bits)
10
0
0
Max Number of TCP Connections (0default) Mask
(High 16 bits)
11
0
0
Subnet Mask (High 16 bits)
12
65535
FFFF
Subnet Mask (Low 16 bits)
13
65280
FF00
Unused - reserved for future use (Set to 0)
14
0
0
Unused - reserved for future use (Set to 0)
15
0
0
31
Starting the Network Server from PLC Logic

• Example ladder logic

32
Open Socket Command Block(opens a connection to
another 2572)
 
33
Write Remote Command Block\ (writes a block of
v-memory to another 2572)
 
34
Read Remote Memory Block(reads a block of
v-memory from another 2572)
 
35
CTI 2572-DDS2 DDE I/O Server

• Software package that runs on a PC
• Can read / write data from the PLC and make it
  available to any application that supports DDE
  (Wonderware, MS-Excel, etc)

36
Making a Simple Display Using Excel

• Install 2572 and start network server
• Start DDE server
• Create topic in DDE server
• Select Configure / Topic
• Enter a topic name
• Enter the IP address of the 2572
• Start Excel
• Enter formulas using the syntax
• Application_nametopic_name!item_name
• Application_name is the name of the CTI I/O
  server
• Topic_name is the topic you created
• Item_name is a valid 505 memory reference
• Example cti2572testplc!wx1

37
CTI 2572-OPC Server

• OPC (OLE for Process and Control) servers provide
  a standardized method of allowing multiple
  industrial applications to share data in a quick
  and robust manner.
• Includes a main server program which provides all
  of the OPC and DDE connectivity and user
  interface functions, and a plug-in communications
  drivers for the CTI 2572 Ethernet Module.
• OPC technology reflects the move from closed
  proprietary solutions to open architectures that
  provide more cost-effective solutions based on
  established standards.

38
2572 Application notes

• IP Addressing and the 2572
• Getting Started with Networking and the 2572
• Using CTIDiag with the 2572
• Starting the 2572 Network Server from PLC Logic
• Reading Values into Excel Spreadsheets Using the
  2572
• Using the 2572 with Wonderware 7.0
• Creating a Client/Server Memory Transfer between
  Two 2572 Modules
• Using the 2572 UDP "Send To" Feature to Exchange
  Memory with Multiple PLCs

39
Ethernet ModulesSpecific Topics

• 2572
• Operation of the email feature
• Operation of the send/receive feature
• Operation of the DataShare feature
• 2572-A
• IP address assignment using DHCP
• Built-in web server
• Security features
• Re-flashing firmware
• Modbus TCP Server
• IP Mulitcast

40
2572 Email Feature

• Allows PLC logic to transmit an email message
• Sample command block

41
2572 Send / Receive Feature

• Allows data exchange between TI505 and Siemens
  S5/S7 PLCs
• Send commands and receive commands must match-up
  on both sides
• Data block read from / written to V-Memory
• Four command blocks are used
• Open active connection
• Open passive connection
• Send
• Receive
• Close connection
• Complete details in chapter 5 of the 2572 user
  manual

42
2572 Send / Receive Sample Command Block
43
2572 DataShare Feature

• Allows very high speed peer-peer connection
  between 2572s
• Useful where
• Speed is critical
• One PLC periodically need to update several
  others with the same set of data
• Multiple PLCs need to exchange data on a cyclic
  basis
• Activated using SW2-2
• When active, limits performance of module as a
  server
• Uses reserved bits in the Module Status Word and
  Module Command Word
• Command Blocks
• Start producer instance
• Trigger producer
• Start consumer instance
• Close datashare

44
2572 DataShare Sample Command Block
45
2572-A IP Address Assignment using DHCP

• Allows use of auto-start while still guaranteeing
  correct IP address in case of a module
  replacement
• How it works
• If auto-start is selected and settings of module
  ID switches are non-zero, the module ID value is
  sent to the DHCP server as a client identifier
• DHCP server is set up to assign IP addresses
  based on client identifier
• At CTI, we set up our server to assign the last
  part of the IP address based on the switch
  assignment
• Example
• Switch setting of 70 receives IP address of
  199.184.177.70
• Complete information on setting up DHCP server in
  Appendix E of 2572-A user manual

46
2572-A Built-In Web Server

• Web server features
• Module diagnostics
• Module configuration
• Firmware download
• Security services
• Product support
• Just point your browser at the IP address of the
  module

47
2572-A Security Features

• Password protection for
• Module configuration changes
• Module firmware download
• Bypass password protection using SW1-7
• Hardware lockout for
• Module configuration changes
• Module firmware download
• Set on SW1-5 and SW1-6

48
2572-A Firmware Upgrade

• Firmware updates can be re-flashed in-place using
  the web server interface
• Install a free TFTP server on your network
• Download and copy the upgrade file to the TFTP
  server
• Go to the firmware download section of the
  2572-A web server interface
• Enter the IP address of the TFTP server
• Complete information in Appendix F of the user
  manual

49
2572-A Modbus TCP Server

• Configuration
• The Modbus TCP server starts automatically. There
  is no configuration or startup logic required.
• Variable Mapping
• Modbus TCP uses a different nomenclature than the
  SIMATIC 505 to describe data elements. The
  following table provides a cross reference.

Modbus Variable 505 PLC Equivalent Variable
Coil Control Relay (C )
(Discrete) Input Discrete Input (X)
Holding Register User Variable Memory (V)
Input Register Word Input (WX)
50
2572-A Modbus TCP Server

• Supported Modbus Function Codes (FC)

FC (dec) FC (hex) Function Codes 505 Variable Comments
01 01 Read Coil Status C Max number of coils 2000
02 02 Read Input Status X Max number of inputs 2000
03 03 Read Holding Register V Max 125
04 04 Read Input Register WX Max 125
05 05 Write Single Coil C
06 06 Write Single Register V
07 07 Read Exception Status C TBD. This returns Y1-8 or C1-8 in 2573-MOD.
15 0F Write Multiple Coils C Max 800
16 10 Write Multiple Registers V Max 100
Supported Modbus Function Codes (FC)
Code Name Description
01 Illegal Function Unsupported Function code
02 Illegal Data Address Requested data address not included in the PLC configuration
03 Illegal Data Value Typically indicates a problem in the query structure
04 Slave Device Failure Unrecoverable error occurred while processing the request
51
2572-A IP Multicast

• There is no physical limit to the number of
  modules that can participate in a Multicast
  session.
• The number of words that may be transferred is 1
  - 256 words per module.
• The source, number of words ,and destination are
  defined in the Producers. This gives greater
  flexibility in determining the source data, the
  number of words that get written, and the
  destination that the data gets written to in the
  consumers in the Multicast session.
• Each station broadcasts its message
  asynchronously at the configured production
  intervals. This eliminates the need for each
  station to be polled to broadcast its data.
• The TCP/IP protocol reserves a block of IP
  addresses (224.0.0.3 through 239.255.255.255) for
  multicast use.

52
2572-A IP Multicast

• You can configure a 2572-A to receive on a
  multicast address using the same methods used to
  establish the other TCP/IP network parameters.
• 1. If you are using the PLC Start method, the
  multicast address can be specified in the Start
  Network Server command block.
• 2. If you are starting the module using IP
  parameters stored in EEPROM, you can use the Web
  Server interface to enter the multicast address.
• 3. If you are using DHCP, you can add the
  multicast address to the parameters that are
  provided by the DHCP server.

53
2572-A IP Multicast

• Start Network Server Example
• Only the values in offsets 6 and 7 would change
  to load that modules specific IP address.

54
2572-A IP Multicast

• Configuring IP Multicast
• After the network server has been started you
  need to do the following to send a multicast
  message
• 1. Execute a Create Socket command using a
  multicast address.
• 2. Use the Unacknowledged Write command to send a
  multicast message containing the data you wish to
  write.

55
2572-A IP Multicast

• Create Socket Command
• The Create Socket command provides a means for
  your PLC logic to refer to another network node
  when sending messages. You must complete the
  Create Socket command before you send messages to
  another node on the network.
• For IP Multicast, UDP must be specified as the
  Type of Service. The 2572-A saves the Multicast
  address and port number as the default remote
  socket. The IP Multicast address is specified in
  offsets 6 and 7 of the Create Socket command
  block. Once the Create Socket command completes
  successfully, your logic can use the Connection
  Number to refer to the remote socket.

56
2572-A IP Multicast

• Create Socket Command Example

57
2572-A IP Multicast

• Unacknowledged Write Command
• This command is designed to be used with
  multicast addresses, where one message can be
  used to update multiple modules. Like the
  standard write command, this command reads the
  contents of a designated area of V memory in the
  local PLC and writes the values to a specified
  area of memory in another PLC. However, because
  multiple modules could receive this message, CAMP
  servers that receive this command do not reply
  and the client does not verify that the message
  was received by any server.

58
2572-A IP Multicast

• Unacknowledged Write Command Example
• Note that offset 3 (V143) determines the
  starting V location of the write block in the
  local PLC. Offset 4 (V144) determines the number
  of words to be written. Offset 5 (V145)
  determines where this block of data gets written
  to in the remote PLC.

59
2500-CXXX CPU Ethernet Port

• Ethernet Communications
• The CTI 2500 controller provides a means to
  attach the controller to a plant network via an
  integrated 10/100Mb Ethernet port. The port
  offers auto-crossover capability, which allows
  you to connect a standard cable directly from
  your PC to the Ethernet port for local
  programming.
• The port uses the TCP/IP protocol, which is
  widely supported by programming software and HMI
  software. Before you can use the port, you must
  set the IP address and related parameters. To do
  this, you can use Workshop Version 4.11 or
  greater or the CTI standalone utility program
  IPSET (Demonstration).

60
2500-CXXX CPU Ethernet Port

• To prevent a possible bump in the process, the IP
  address can be set only while the PLC is in
  PROGRAM mode.
• IP addresses must be unique, even between the
  local Ethernet port and an Ethernet module in the
  same base. Duplicating IP addresses can cause
  unpredictable problems, including loss of
  communications with the Ethernet port.

61
2500-CXXX CPU Ethernet Port

• TCP/IP provides for multiple logical ports. Each
  port represents a particular service offered at
  the IP address. The CTI 2500 Controller supports
  the following logical ports
• Programming Port (TCP Port 4452)
• The programming port is intended for use with
  network-capable programming software, such as PLC
  WorkShop. To use the programming port, connect to
  TCP port 4452. This port supports all
  programming, data access, and control requests.
  Only one client may be connected to the
  programming port at a time. The CTI 2500 gives
  priority to all requests to the programming port.
  UDP connections are not supported.
• When programming via local Ethernet port using
  TCP port 4452, you can prevent anyone else from
  concurrently modifying the program via another
  port or SF module by initiating port lockout
  using your programming software. Port lockout
  blocks requests to modify the User Program that
  originate from other physical ports, such as the
  serial port or a port on a special function
  module.

62
2500-CXXX CPU Ethernet Port

• Data Access Port (TCP Port 4450/1505)
• To use the Data Access port, it is preferable to
  connect to TCP port 4450. To provide
  compatibility with installations using the CTI
  2572 and 2572-A, you may also connect to the Data
  Access port using TCP port 1505. A total of three
  concurrent TCP connections to port 4450 or 1505
  are allowed. For example, you could have two
  connections to port 4450 and one connection to
  port 1505. UDP connections are not supported.
• The Data Access port is intended for use with HMI
  and SCADA software. Since the Data Access Port
  uses the same CAMP protocol used by CTI 2572 and
  2572-A modules, drivers are available for most
  popular SCADA software packages.

63
2500-CXXX CPU Ethernet Port

• Data Access Port (TCP Port 4450/1505) Cont.
• It can also be used with network-capable
  programming software where you want to allow the
  User Program to be displayed but not modified. By
  default, the Data Access port will reject
  commands that attempt to alter the User Program,
  returning a port lockout error.
• Some legacy network programming interfaces, such
  as APTNET, support only Port 1505. If you need to
  use TCP Port 1505 as a full function programming
  port (allowing programs to be modified), you can
  set the Programming Port switch as described in
  Section 2.4.
• Caution
• When you choose to use Port 1505 as a full
  function programming port, there is no means to
  prevent two users from concurrently modifying the
  User Program, since more than one programming
  connection to the Ethernet port is allowed.

64
2500-CXXX CPU Ethernet Port

• Web Server Port
• The Web Server port allows a standard Web browser
  to connect to the CTI 2500 to access the Event
  Log.
• The event log maintains a time stamped record of
  significant software events. All fatal and
  non-fatal errors result in an entry into the
  event log. The event log is stored in battery
  backed memory. It can be accessed using a
  standard web browser, such as Internet Explorer.
  You can access the Event Log by typing the
  controller IP address in the URL box in the
  browser. If you are experiencing problems, the
  event log will usually provide details relating
  to the problem.