Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

Where are the variables stored?

Created by: shamshun at: 2/23/2014 12:13 PM (11 Replies)

Rating (3)

Thanks 12

Result pages:: |; 1 | 2; |

12 Entries

Entries per page: 10 | all

2/23/2014 12:13 PM	Rate (0)
shamshun Posts: 6 Rating: (0)	Hi everyone, I am trying to design a program that shows some "machine state variables" , obtained from some pre-programmed PLCs. Data that I need to show are, of course, somewhere in plc's memory. Now, I want to know if it is possible to find where each variable is (in memory). Like, there is a Temperature variable for the Oven machine's PLC, and I do not know where it is stored. I can download PLC's content into my S7 SIMATIC. I have no symbol files. I am relatively new to PLCs, but if there is a way, I will try until I succeed. Yesterday, I successfully set up an OPC server and connected a (exsiting) LabView project to it. Now I want to see if I can make a simpler program able to show some data from PLC. I appreciate your help,
shamshun Posts: 6 Rating: (0)
Suggestion To thank Quote Answer

2/23/2014 12:49 PM	Rate (0)
hdhosseini Diamond Expert Joined: 1/28/2009 Last visit: 10/6/2024 Posts: 6852 Rating: (1365)	shamshun Hi everyone, I am trying to design a program that shows some "machine state variables" , obtained from some pre-programmed PLCs. Data that I need to show are, of course, somewhere in plc's memory. Now, I want to know if it is possible to find where each variable is (in memory). Like, there is a Temperature variable for the Oven machine's PLC, and I do not know where it is stored. I can download PLC's content into my S7 SIMATIC. I have no symbol files. I am relatively new to PLCs, but if there is a way, I will try until I succeed. Yesterday, I successfully set up an OPC server and connected a (exsiting) LabView project to it. Now I want to see if I can make a simpler program able to show some data from PLC. I appreciate your help, Hello, If you want to find the process parameters of a machine without having an authentic back up of S7 program with comments(symbol table),It is possible to find some addresses by having electrical diagram of the machine and tracing the codes.It needs skill and it is not recommended for a big machine. Best regards, Hamid Hosseini
	Demo Channel on Youtube
Suggestion To thank Quote Answer
This contribution was helpful to 2 thankful Users IBN-Service shamshun

2/23/2014 12:50 PM	Rate (0)
IBN-Service Posts: 8946 Rating: (999)	The fastest solution would be to ask the other programmers for the program including comments and symbol list. To find datapoints inside an uncommented CPU-backup can be a bloody work, specially at large programs.
IBN-Service Posts: 8946 Rating: (999)
Suggestion To thank Quote Answer
This contribution was helpful to 2 thankful Users hdhosseini shamshun

2/23/2014 12:55 PM	Rate (0)
IBN-Service Posts: 8946 Rating: (999)	Hamid was faster.
IBN-Service Posts: 8946 Rating: (999)
Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users hdhosseini

2/23/2014 1:14 PM	Rate (0)
shamshun Posts: 6 Rating: (0)	Thanks! @IBN-Service: I don't think the programmers would like to share their comments/symbols/tags ; but I'll contact them anyway...Worth a shot . Unfortunately the machines are rather big, with lots of plc components. @Hamid: How would the electric diagram help? Can I track sensors? It would be great if you could explain it in a simple example! Also, is there a way to dump PLC memory when the machine is working? If so I might be able to track the variable.
shamshun Posts: 6 Rating: (0)
Suggestion To thank Quote Answer

2/23/2014 1:43 PM	Rate (2)
IBN-Service Posts: 8946 Rating: (999)	shamshun ...How would the electric diagram help? Can I track sensors? ... Example: You looking for a temperature value. You search the temperature probe in Hardware plans. If you are lucky, you find the corresponding peripherieadress inside the plans (but mostly you are not lucky...) If there is the correct adress in the plan (lets say, PIW 300 for an analog temperature Input), you can search inside the program for PIW300. If you find this adress, you will mostly find a scaling block and some DB.DBW that contains the scaled temperature value. Good luck!
IBN-Service Posts: 8946 Rating: (999)
Suggestion To thank Quote Answer
This contribution was helpful to 2 thankful Users hdhosseini shamshun

2/23/2014 7:49 PM	Rate (1)
hdhosseini Diamond Expert Joined: 1/28/2009 Last visit: 10/6/2024 Posts: 6852 Rating: (1365)	shamshun @Hamid: How would the electric diagram help? Can I track sensors? It would be great if you could explain it in a simple example! Also, is there a way to dump PLC memory when the machine is working? If so I might be able to track the variable. Thanks to Jürgen for his impressive answer , If you find all related addresses, it is possible to capture those internal variables with help of some softwares.You can try SIMATIC WINCC with the best sampling time of 500ms in tag logging and also use other options such as alarm logging capabilities.Also some software solutions exist that can capture and store process values in a cycle precise manner.Read more HERE.
	Last edited by: hdhosseini at: 2/23/2014 8:13 PM Last edited by: hdhosseini at: 2/23/2014 8:01 PM Demo Channel on Youtube
Suggestion To thank Quote Answer
This contribution was helpful to 2 thankful Users IBN-Service shamshun

2/24/2014 5:44 AM	Rate (0)
shamshun Posts: 6 Rating: (0)	Thank you both! My idea was : capture a snapshot of PLC memory in my PC, use a control (lets say "decrease" some temperature) , then capture another snapshot, compare the two snapshots for decreased words/bytes/.., then increase the temperature again, and capture/compare for increased values. Do this multiple times and when you have about a few hundred addresses, it's easy to just look at the values and see which one changes with control input when the machine is working. I'll get a copy of IBA PDA soon, will try some I/O logging with it. Will share some report of the results here, in a few days time.
shamshun Posts: 6 Rating: (0)
Suggestion To thank Quote Answer
This contribution was helpful to 2 thankful Users IBN-Service hdhosseini

2/24/2014 11:50 AM	Rate (0)
shamshun Posts: 6 Rating: (0)	IBN-Service The fastest solution would be to ask the other programmers for the program including comments and symbol list. To find datapoints inside an uncommented CPU-backup can be a bloody work, specially at large programs. Update: I asked my manager about getting comments/sybol files from the companies, today. As I expected, the manufacturers of the machines will not co-operate with us. Now I either have to somehow filter out the data blocks that contain the variables needed to display, or find out another way to snatch the data from other sources, rather than directly from PLC. By the way, the machines already have HMI panels, I think they use lab-view to monitor and control the processes. I'm thinking using their data could be possible, too? Any ideas, comments will be appreciated
shamshun Posts: 6 Rating: (0)
Suggestion To thank Quote Answer

2/25/2014 5:17 PM	Rate (0)
Piotr.M Platinum Member Joined: 6/24/2013 Last visit: 9/20/2024 Posts: 1628 Rating: (421)	You may need dig it in PLC program i.e. where temperature is scaled to. 1. Use cross-references and display program structure. 2. look for FC105 "SCALE" (in uploaded program it will be known as FC105) The FC105 un-scales analog values to the real data type 3. if there is no FC105 in structure switch to cross - references then press filter and leave ticked PIW only. this will give all accesses which are most probably Your analog inputs. Search for them in program. when You know how conversion is done You can create VAT (variable table) wlth list of suspected variables. monitor them and check what is changing when You change temperature. Also check Hardware Config (open hardware from uploaded program) and check where and under which addresses analog input cards are. Bit of digging but not impossible. Remember: each analog input occupy 2 addresses i.e. AI0 = PIW256, AI1 = PIW258 etc. Moreover, resistor (PT100 directly connected to AI module) occupies 2 consecutive channels so in such case let's say if PT100 is at PIW256, next usable analog is at PIW260. PIWs can not be monitored directly in vat. You need copy them to different variabled (MWs) or use scaled values from the program. RAW analog values are: - unipolar: 0..27648 == 0..100% (for example 0..10V / 4..20mA / etc.) - bipolar: -27648 .. 27648 == -100% .. 100% (for example -10V..10V, etc. - Temperature (Thermocouples, PT100 connected directly to AI card) - show temperature in degrees C x 10 (i.e. 100 = +10.0 degrees C) Hope this helps

Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users shamshun

|

Share this page:

Share this page on...

Follow us on