TM SM Maximum Value for OEMs SM From Rockwell Automation NX Protocol Training Feb 27, 2007 ~ Mar 2,...
-
Upload
irving-osswald -
Category
Documents
-
view
228 -
download
2
Transcript of TM SM Maximum Value for OEMs SM From Rockwell Automation NX Protocol Training Feb 27, 2007 ~ Mar 2,...
TM
SMMaximum Value for OEMsMaximum Value for OEMs
Maximum Value for OEMsSM
From Rockwell Automation
NX Protocol TrainingNX Protocol TrainingFeb 27, 2007 ~ Mar 2 , 2007Feb 27, 2007 ~ Mar 2 , 2007
Ki Joon Kim
RAK OBB Strategic Marketing
Ki Joon Kim
RAK OBB Strategic Marketing
2
Simple Demo with PLC + HMI + OPC ServerSimple Demo with PLC + HMI + OPC Server
In H/W point, this Simple demo consists of PLC and PC.In S/W point, PC has Serial Port, OPC Server and HMI Software.
OPC : OLE for Process Control.HMI : You can use every HMI software such as RSView32, InTouch, iFix , WinCC and etc which support OPC.
Through this simple demo, we will show basic concept of communication with NX-Series PLC.
SerialPort
OPC ServerWinOPC orKepServer
HMIRSView32 or
iFIX orInTouch
Windows XP/2K
3
Setup OPC Server - WinOPCSetup OPC Server - WinOPC
WinOPC is a kind of OPC Server for NX-Series PLC but current is Version 1.0. So, it is inconvenient, yet.
You can use this one freely after download.
To define tag to read or write, user have to modify XML file.
In near future, GUI will be changed.
Configuration of Device.xml
Also, you can use help file to setup.
4
Setup OPC Server - KepServerSetup OPC Server - KepServer
This is came from KepWare. Also, you can download from www.kepware.com freely and you are able to use during 3 hours for each execution. (Ver.4 is able to use 2 hours.))
KepServer has 2 version. One is KepServer Enterprise for RA products such as RSView32, RS-SQL,etc and another is KepServerEX for general customer.
Let’s see procedure of setting up. (Application Note)
5
Simple Demo with PLC + HMI + OPC ServerSimple Demo with PLC + HMI + OPC Server
• We will show simple demo which are one of real applications.• One is an example of “Gas Engine Steam Supply and Power Generator”• The other is an example of controlling AC Drive with PLC.
6
PLC Communication ProtocolPLC Communication Protocol
RS232CRS485
CCU+ 통신Port(9Pin Female)
Items Description
Interface RS-232 / RS-485 1 Port
Baudrate 4800 / 9600 / 19200 / 34800
Synch/Asynch Half Duplex Asynchronous
Method Polling
Code Binary (HEX)
Communication Format Data Bits 8 bits
Stop Bits 1 bit
Parity Bit None
Error Check CRC-16
Data Transmit. Order Lower Byte First
Cable Twisted Pair Cable
Communication Specification
7
How to ConnectHow to Connect
Signal Pin
F.G 1
SD (TxD) 2
RD (RxD) 3
- 4
S.G (GND) 5
485- 6
485+ 7
- 8
Vcc 9
Pin Signal
1 F.G
2 RD(RxD)
3 SD(TxD)
4 DTR
5 S.G(GND)
6 DSR
7 RTS
8 CTS
9
PLC (9 Pin D-Sub Male) PC (9 Pin D-Sub Female)
RS-232C and RS-485 Cable
8
Function CodesFunction Codes
FunctionsQuery Function Code Response Function Code
Remark2 Step 4 Step 2 Step 4 Step
Read Bit $21 $01 $A1 $81
Write Bit $22 $02 $A2 $82
Read Word $23 $03 $A3 $83
Write Word $24 $04 $A4 $84
Read Mixed Bit/Word $25 $05 $A5 $85
Write Mixed Bit/Word $26 $06 $A6 $86
Read Program $27 $07 $A7 $87
Write Program $28 $08 $A8 $88
Read Instruction $29 $09 $A9 $89
Change Instruction $2A $0A $AA $8A
Change Operand $2B $0B $AB $8B
Insert Instruction $2C $0C $AC $8C
Delete Instruction $2D $0D $AD $8D
Find Instruction $2E $0E $AE $8E
Find Operand $2F $0F $AF $8F
Delete All/Partial Program $20 $10 $A0 $90
No Service $00 $00 $00 $00
9
Communication Frame (2-Steps)Communication Frame (2-Steps)
DA SAFunction
CodeLength Data CRC L CRC H
1~255 Byte (01~FF)0 : 256 Byte
See Function Code
Source Address
Destination Address
CRC-16 Code
Error Frame
DA SA $8x $01 Error Code CRC L CRC H
Data Size
Error #1 : Invalid FunctionError #2 : Overflow Error #3 : Invalid Frame StructureError #4 : Invalid CPU OperationError #5 : Too Long Frame
Source Address
Destination Address
CRC-16 Code
Function Code
10
Communication Frame (2-Steps)Communication Frame (2-Steps)
Communication Frame Example
Read Bit : Read 5 Bits from K0000.0 to K0000.4
Command
Answer
Write Bit : Write 3 Bits to M0000.0 to M0000.2
Command
Answer
Read Word : Read 3 Words from M0010 to M0012
Command
Answer
Write Word : Write 3 Word from M0000 to M0002
Command
Answer
FF FF 21 03 00 14 05 73 40
FF FF A1 05 FF FF 00 00 FF D4 DF
FF FF 22 05 00 00 FF 00 FF 71 77
FF FF A2 01 00 A0 72
FF FF 23 03 CA 00 03 A5 BC
FF FF A3 06 1B 00 BE 00 E6 00 41 CE
FF FF 24 08 C0 00 34 12 78 56 BC 9A 9F 43
FF FF A4 01 00 40 73
11
Calculate CRCCalculate CRC
DA SAFunction
CodeLength Data CRC L CRC H
CRC Calculation Scope 2 Byte CRC
CRC = 65535For i = 0 To PL - 1 CRC = Int(CRC / 256) Xor CRCTable((CRC Xor DATABLOCK(i)) And 255)Next i
12
Protocol (1/4) – Read BitProtocol (1/4) – Read Bit
Request Frame
Response Frame
Only for R, L, M, K, F, TC Register
Example Read Bit : Read 5 Bits from K0000.0 to K0000.4
Command
Answer
DA SA $21 $03 Base L Base H N CRC L CRC H
PLC ID PC ID Function Code Data Size
Absolute Register Address
The length of bits to read CRC
DA SA $A1 NBase+0
Bit ValueBase+1
Bit Value….
Base+N-1 Bit Value
CRC L CRC H
PC ID PLC ID Function Code Data Size
Data: ON=$FF,OFF=$00CRC
FF FF 21 03 00 14 05 73 40
FF FF A1 05 FF FF 00 00 FF D4 DF
$21 OR $80
* * * * *
13
Protocol (2/4) – Write BitProtocol (2/4) – Write Bit
Request Frame
Response Frame
Only for R, L, M, K, F, TC Register
Example Write Bit : Write 3 Bits to M0000.0 to M0000.2
Command
Answer
DA SA $22 N Base L Base HBase+0
Bit Value
Base+1
Bit Value…
Base+N-1
Bit ValueCRC L CRC H
PLC ID PC IDFunction
CodeAbsolute Register
AddressThe length of bits to write
CRC
DA SA $A2 $01 $00 CRC L CRC H
PC ID PLC ID Function Code Data SizeCRC
FF FF 22 05 00 00 FF 00 FF 71 77
FF FF A2 01 00 A0 72
$22 OR $80
* * * * *
14
Protocol (3/4) – Read WordProtocol (3/4) – Read Word
Request Frame
Response Frame
All Register
Example Read Word : Read 3 Words from M0010 to M0012
Command
Answer
DA SA $23 N Base L Base H N CRC L CRC H
PLC ID PC ID Function Code Data Size
Absolute Register Address
The length of bits to read CRC
DA SA $A3 LBase +0
Low Byte
Base +0
High Byte
Base +1
Low Byte
Base +1
High Byte….
Base +N-1
Low Byte
Base +N-1
High ByteCRC
LCRC
H
PC ID PLC ID
FunctionCode
Data Size L = N * 2
CRC
FF FF 23 03 CA 00 03 A5 BC
FF FF A3 06 1B 00 BE 00 E6 00 41 CE
$23 OR $80
15
Protocol (4/4) – Write WordProtocol (4/4) – Write Word
Request Frame
Response Frame
All Register
Example Write Word : Write 3 Word from M0000 to M0002
Command
Answer
DA SA $24 L Base L Base HBase +0
Low Byte
Base +0
High Byte
Base +1
Low Byte
Base +1
High Byte…
Base +1
Low Byte
Base+1
HighByteCRC L CRC H
PLCID
PC ID
Function Code
Absolute Register Address
CRCData Size L = N * 2+2
DA SA $A4 $01 $00 CRC L CRC H
PC ID PLC ID Function Code Data SizeCRC
FF FF 24 08 C0 00 34 12 78 56 BC 9A 9F 43
FF FF A4 01 00 40 73
$24 OR $80
16
Hand On LabHand On Lab
MaterialsHardware : PC, PLC (NX7 / 70), AC Drive or Servo Drive, Motor
Software : WinGPC, OPC Server, HMI Software
17
Modbus RTU – Inverter/Servo ControlModbus RTU – Inverter/Servo ControlEOI or HMI SW (OPC server)Speed and Status
COM1
COM2Modbus RTU
Master
Slave Slave
NX7 or NX70 or NX700 PLC
Inverter (AC Drive) or Servo
Speed/Torque Output Reference using Modbus RTU
Speed/Torque Input Feedback using 4-20mA Analog Inputs
EOI Monitors Feedback and Status
Yaskawa Servo
OEMax G5 AC Drive
18
Custom Protocol – Inverter/Servo ControlCustom Protocol – Inverter/Servo ControlEOI or HMI SW (OPC server)Speed and Status
COM1
COM2Modbus RTU Master and CSD* Protocol
Modbus RTU Slave CSD* Slave
NX7 or NX70 or NX700 PLC
Inverter (AC Drive) or Servo
Speed/Torque Output Reference using Modbus RTU
Speed/Torque Input Feedback using 4-20mA Analog Inputs
EOI Monitors Feedback and Status
OEMax CSD* Servo
OEMax G5 AC Drive
19
Success StoriesSuccess Stories
20
Tianjin SailingTianjin SailingOEMax protects China’s Environment!
Hengshui Haijiang Filter PressSludge Filtering under High PressureNX7-28ADR + NX7-28EDR digital I/O
30 Sets sold to CustomerAlso E-View EOI
Replaced LG Master-K PLCKeys to Win
Tianjin Relationship and ExperienceOffered Low Price similar to LG (but not lower)Tianjin Engineer programmed and integrated PLC
Next Targets are expected WinsShanghai Dazhang Filter Press
2 NX7 sets sold – Verbal commitment to use OEMax
Shanghai Coal Mining ApplicationNX70 – Verbal commitment to use OEMax
Dezhou Filter Press
21
Shanghai Hands (actually Wuxi Vanpoo Siemens branch)Shanghai Hands (actually Wuxi Vanpoo Siemens branch)
Wuxi BD Flocking (bdflocking.com)Textile – Pattern/Screen Printing on ClothNX70 Digital I/O and Analog 1-Axis Motion
1 set sold – Machine sold at Guangzhou Textile Exhibition100 sets projectedAlso Proface EOI + Siemens AC Microdrives
Replaced Siemens S7-200 or S7-300 PLCKeys to Win
Vanpoo DI Relationship and ExperienceVanpoo DI Makes Higher Margin selling OEMax PLC than Siemens
NX70 price is similar to S7-200 but functionally between S7-200 and S7-300
2-3 Vanpoo Engineers and OEMax Strategic Marketing programmed and integrated PLC
22
Shenzhen SandingShenzhen Sanding
MingSang Industrial (mingsang.com)Assembly – Ornament (Bracelet) Assembly MachinesNX7(S) Digital I/O and PTO 2-Axis Motion
20-30 sets sold so far to DI/SIAlso Eview EOI + Low Cost Steppers
Replaced Siemens S7-200Keys to Win
Shenzhen DI is Siemens System IntegratorProbably higher margin for System Integrator using OEMax PLC over Siemens S7-200 PLC
SOBB Engineering (BD Kim + JY Bae) modified NX7(S) FW to provide 32-bit PTO supportShenzhen Engineers programmed and integrated PLC
23
Question ?Question ?
24
TM
Maximum Value for OEMsSM