Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

Quiz / challenge of the week: How to read/write any S7PLC address using just one external tag

Created by: Dec at: 9/28/2006 9:31 PM (13 Replies)

Rating (3)

Thanks 0

Result pages:: |; 1 | 2; |

14 Entries

Entries per page: 10 | all

9/28/2006 9:31 PM	Rate (0)
Dec Gold Expert Joined: 5/19/2006 Last visit: 8/5/2023 Posts: 547 Rating: (107)	Hi guys, Reading a previous post (Reading whichever PLC Address changing TAG properties dynamically) I propose to everyone this quiz: How to read / writeS7 PLCtags using just one external tag (S7 Channel). There should be no PLC code to handle the indirect addressing etc. Everything should be performed with WinCC standard functionality / scope (No OPC etc). No additional ODK dll functions will be called / used. This is not an easy question and requires deep WinCC S7Channel knowledge. To help a little bit the external tag will be a raw-tag type. The answer next week same day [8)] Dec

Suggestion To thank Quote Answer

9/29/2006 1:30 PM	Rate (0)
Reuben Posts: 70 Rating: (13)	This sounds interesting! I assume you mean ANY address from the PLC (ie: D/M/I/Q) Reubenhunts for undocumented features...[;)]
Reuben Posts: 70 Rating: (13)
Suggestion To thank Quote Answer

9/29/2006 1:52 PM	Rate (0)
Ates Posts: 198 Rating: (17)	i never used raw data type and i hate waiting [:)]
Ates Posts: 198 Rating: (17)
Suggestion To thank Quote Answer

9/29/2006 7:48 PM	Rate (0)
Dec Gold Expert Joined: 5/19/2006 Last visit: 8/5/2023 Posts: 547 Rating: (107)	[quote user="Reuben"] I assume you mean ANY address from the PLC (ie: D/M/I/Q) Yes, Any address fromS7 PLC in "ANY Format [;)]" Also you can read CPU SZLs and status infowith the same raw tag. Take a look on the header file S7CHN.H from <WinCC Setup CD> under folder \Options\ODK\Include. Again there will be no ODK functions involved in here but this header file gives lots of info about different RDFT_ functions (RAW DATA FUNCTION TYPE) you can use with the raw tags. In particular RDFT_VAR_READ & RDFT_VAR_WRITE definitions will be used in S7RDHDS (raw-data header struct). Also looking into Channel Diagnosis trace file helps a lot. Some S7 Protocol knowledge helps too. Dec
	Last edited by: Dec at: 9/29/2006 8:09 PM
Suggestion To thank Quote Answer

10/4/2006 12:23 PM	Rate (0)
Reuben Posts: 70 Rating: (13)	OK, the channel driver can already address any data in the PLC so I assume there is no need to do anything in the PLC. The implication is that there is some way to perform an "undocumented" read/write via raw tag that tells the driver what the address is? It is simple enough to encode/decode the 10-byte ANY pointer, but I'm stumped at how to use it without doing anything in the PLC, or without using low-level API calls on the S7 interface. I'm leaning towards RAW_ARCHIVE or RAW_EVENT simply because there is no addressing specified when these are configured, but I can find no documentation on them! More clues please - or links to documentation!
Reuben Posts: 70 Rating: (13)
Suggestion To thank Quote Answer

10/4/2006 8:48 PM	Rate (3)
Dec Gold Expert Joined: 5/19/2006 Last visit: 8/5/2023 Posts: 547 Rating: (107)	Hi Reuben, S7 Channelhas 5 raw data tag types (see S5COMMON.H [:o]): RDT_EVENT= 1 RDT_ARCHIV= 2 RDT_PBKBSEND = 4 RDT_BSEND = 8 RDT_S7CHN = 128 First 4 are configurable using Address properties dialog window. Last one requires direct configuration into SQL Table see attachment. The quickest way to create this type of raw tag is to create a raw archive type tag and modify ADDRESSPARAMETER into the tableMCPVARIABLEDESC. The values you are going to read/write into this raw tag are described in S7CHN.H The start headeris S7RDHDS structure for all raw data tag types. Then depends on what function typewill be used,you willneed additional structures to append after S7RDHDS. For example togetconnection info you will write(SetTagRaw) WORD 0x80, // RDT_S7CHN WORD 0x4011, // RDFT_GET_CONN_INFO DWORD sizeof(S7RDHDS), //we only haveS7RDHDS when write; (+ S7RDCINF) when read DWORD 0x0, // no error DWORD 0xFFFF, //not relevant; can be any value WORD wRawSeqId ++, // increment previous SeqId WORD 0x0 // no other data records after this structure header In response you will read (GetTagRaw) the same start header typeS7RDHDS plus S7RDCINF with the connection info. In the same way you will use RDFT_VAR_READ & RDFT_VAR_WRITE to read any S7 PLC address area. You will use other structures after S7RDHDS eg ANYPTRS, S7ADDRS etc. To debug wrong formats you can enable trace (S7 raw … flags) in channel diagnosis and analyze the output file TRC. The relevant entries are RAWFOUND etc. Have fun! Dec P.S. If can't get anywhere drop me a line and I can send an example of how to format the raw tag for use with RDFT_VAR_READ & RDFT_VAR_WRITE. BTW This raw tag (#AsRead, #AsWrite)is used by PCS7 SFC Visualization and iscreated by theAS-OS MAP if you have SFCsin the AS[8)] Attachment raw_s7chn.zip (275 Downloads)
	Last edited by: Dec at: 10/4/2006 11:58 PM Last edited by: Dec at: 10/4/2006 8:48 PM
Suggestion To thank Quote Answer

10/5/2006 11:48 AM	Rate (0)
Reuben Posts: 70 Rating: (13)	Very cool [8)]
Reuben Posts: 70 Rating: (13)	Last edited by: Reuben at: 10/5/2006 11:54 AM
Suggestion To thank Quote Answer

10/6/2006 10:52 AM	Rate (0)
Reuben Posts: 70 Rating: (13)	OK, I'm reaching the limit of what I can achieve on guesswork! Where can I find documentation on the S7 protocol? I have some ideas about using the system status list, like extracting Profibus/ASi slave information. Thanks!
Reuben Posts: 70 Rating: (13)
Suggestion To thank Quote Answer

10/6/2006 4:54 PM	Rate (0)
jackr Posts: 17 Rating: (0)	Hi, I just stumbled upon this discussion while looking for a means to do exactly what it looks like this set of procedures can do. For troubleshooting, I would like the operator to be able to enter an address (parse it if necessary) and return the value that is in the PLC. Primarily, this would be DB, timer, or memoryaddresses. If I'm reading this thread right, that is what is being discussed. However, I am now thoroughly lost. I got the raw tag properly defined as shown in your attachment, but I think I am in over my head when it comes to setting up the necessary logic to actually read and write. Do you have a little demo that shows how to get one of these values (like an integer in a DB)? I would really appreciate it since would save a lot of reprogramming on the PLC side. Thanks a lot! jack
jackr Posts: 17 Rating: (0)
Suggestion To thank Quote Answer

10/6/2006 8:10 PM	Rate (0)
Dec Gold Expert Joined: 5/19/2006 Last visit: 8/5/2023 Posts: 547 Rating: (107)	[quote user="Reuben"] I have some ideas about using the system status list, like extracting Profibus/ASi slave information. Thanks! Tryto formatthe raw taglike thisand write (SetTagRaw) //raw tag write structure // S7RDHDS struct WORD 0x80//wRawDataType = RDT_S7CHN WORD 0x1 //wFunctionType =RDFT_READ_SZL DWORD sizeof(S7RDHDS) + sizeof(DWORD) + sizeof(S7RDSZL) //dwRawDataSize DWORD 0x0 // dwErrorCode DWORD 0xFFFF //dwUserId can be any number WORD previousSeqId++ // wRawSeqId ++ or can be any number (not semnificative actually) WORD 0x1 //wDataBlkCount // end S7RDHDS struct DWORD 0xacdcf802 // SCMN_VARSPECMAGIC from S5COMMON.H [:P] // S7RDSZL struct WORD 0x0 //wSzlId = 0 // SZL 0x0Index 0x0 return the mapof all SZLssupported bythe PLC WORD 0x0 //wIndex = 0 DWORD 0x0 //dwSzlSize will return the size of records // end S7RDSZL struct // end raw tag write structure Here is my trace from TRC file when I call READ SZL function with PLCSim 12:48:39,038 000017ec RAWFUND 0x0 0001 Rawdata to CHN : RDT_S7CHN RDFT_READ_SZL RawDataSize=32 UserId=0x0 RawSeqId=123 DataBlkCount=1! 12:48:39,038 000017ec RAWFUND 0000 02 F8 DC AC 00 00 00 00 00 00 00 00 ............ 12:49:45,212 000017ec S7DosFS 0x0 0001 s7ag_read_szl : OrderId=1 dynmod=2 wUserId=0x10001 szl_id=0x0000 index=0 12:49:47,556 00000fc0 RAWFUND 0x0 0001 Rawdata to DM : RDT_S7CHN Q RDFT_READ_SZL RawDataSize=114 UserId=0x0 RawSeqId=0 DataBlkCount=1! 12:49:47,556 00000fc0 RAWFUND 0000 5A 00 00 00 00 00 00 00 00 02 00 29 00 00 03 00 Z..........).... 0010 00 11 01 11 0F 11 01 12 0F 12 00 13 01 13 00 14 ................ 0020 00 15 01 15 00 19 01 19 0F 19 00 21 0F 21 02 22 ...........!.!." 0030 00 23 0F 23 01 24 04 24 05 24 01 31 01 32 00 33 .#.#.$.$.$.1.2.3 0040 05 91 0A 91 0C 91 0D 91 0F 91 00 92 02 92 0F 92 ................ 0050 00 A0 01 A0 0F A0 00 B1 00 B3 00 B4 00 00 .............. Setup an Action with the raw tag trigger uppon change and dispatch the return values (GetTagRaw)from the raw tag into internal tags as a result. Don't forget to check if RDFT is arequest or reply see MSB (do an AND with RDFT_ACK 0x8000) (Q char in TRC is the reply) Check the return error code (see RDEC_ from S7CHN.H) as well. As far as SZL reply struct you will parse like this: DWORD dwSize //total length of this struct 0x5A WORD wSzlId //0x0 return the requested SzlId WORD wIndex //0x0 return the requested Index WORD wSizeRec //2 bytes length of a data records WORD wNoRec // 0x29 records (0x29 SZLs) REC1 0x0 // SZL 0x0000 REC2 0x3 // SZL 0x0300 REC3 0x11 // SZL 0x0011 REC4 0x111 // SZL 0x0111 REC5 0xF11 // SZL 0x0F11 etc Pay attention to the byte swap (Motorola format) Dec
	Last edited by: Dec at: 10/6/2006 8:38 PM Last edited by: Dec at: 10/6/2006 8:32 PM
Suggestion To thank Quote Answer

|

Share this page:

Share this page on...

Follow us on