PLC & Control

Experion is Honeywell's unified system for process, business, and asset management that helps industrial manufacturers increase their profitability and productivity. Experion takes customers well beyond Distributed Control System (DCS) functionality with an advanced automation platform solution and innovative application integration to improve business performance and peace of mind. And there's no need to worry about upgrading from TDC 2000®/TDC 3000® or TotalPlant® Solution (TPS). The unique, patent pending design of Series C combines sleek styling and function to provide process I/O with reduced footprint, easier installation and maintenance, and longer life. The Series C form factor benefits extend to multiple modules, such as the Series C C300 Controller, the Fieldbus Interface Module, the Control Firewall, and HART analog modules. The Control Execution Environment (CEE) is the common core software used in the various controllers supported by ExperionTM. This includes the C200 Process Controller, the C300 Process Controller, the Application Control Environment (ACE) and the C200 Simulation Environment (SIM-C200). The CEE provides an execution and scheduling environment where control strategies are configured from a rich set of standard and optional function blocks using a single builder tool, Control Builder. Function blocks are grouped and wired together in a container to perform a specific control function such as a valve control strategy. The Control Execution Environment (CEE) supports two types of containers: the Control Module in which continuous and discrete controls are combined; and an SCM, which is used for sequence control. Function blocks support the complete control application range, such as continuous, discrete and batch control.

Advant OCS (Open Control System) is an ABB solution for operators to improve their manufacturing productivity and achieve sustainable competitive advantages. In 1992, based on the success of the Master systems in the 80's, the Master system began its evolution to Advant OCS. This evolution introduced high capacity controllers and I/O with an improved redundancy scheme. Also included were modern UNIX workstations, and in 1996 S800 I/O was added providing modular flexible remote I/O. In 2000, Advant OCS with Master Software began its next step in the evolution process with the introduction of Industrial IT enabled products. ABB's commitment to protecting your investment continues with these enhancements by providing connectivity to our latest control offering. A versatile and complete range of process I/O systems within the Advant family enables optimal user configurations: S100I/O - A rack-based I/O system for AC400 controllers S600I/O - A rack-based I/O system for AC100 controllers S800I/O - A highly modularized and flexible I/O-system Numerous characteristics and functions facilitate and improve operation, monitoring, and reengineering of each process in a company. 800xA Operations (Process Portal) and the proven AdvaCommand for Unix solution (based on HP-UX) are available as an operator station for Advant OCS with Master Software. The intuitive operator software provides consistent access and interaction with data from multiple control and I/O to plant and enterprise information.

The DCS is a control system which collects the data from the field and decides what to do with them. Data from the field can either be stored for future reference, used for simple process control, use in conjunction with data from another part of the plant for advanced control strategies. What must be in the DCS for it to be able to do so much?

Operator Console

These are like the monitors of our computers. They provide us with the feedback of what they are doing in the plant as well as the command we issue to the control system. These are also the places where operators issue commands to the field instruments.

Engineering Station

These are stations for engineers to configure the system and also to implement control algorithms.

History Module

This is like the harddisk of our PCs. They store the configurations of the DCS as well as the configurations of all the points in the plant. They also store the graphic files that are shown in the console and in most systems these days they are able to store some plant operating data.

Data Historian

These are usually extra pieces of software that are dedicated to store process variables, set points and output values. They are usually of higher scanning rates than that available in the history module.

Control Modules

These are like the brains of the DCS. Specially customized blocks are found here. These are customized to do control functions like PID control, ratio control, simple arithmetic and dynamic compensation. These days, advanced control features can also be found in them.

I/O

These manage the input and output of the DCS. Input and output can be digital or analogues. Digital I/Os are those like on/off, start/stop signals. Most of the process measurements and controller outputs are considered analogue. These are the points where the field instruments are hard-wired to. All above mentioned elements are connected by using a network, nowadays very often used is Ethernet. The practical and technological boundaries between a Distributed Control System DCS, Programmable Logic Controller PLC and Personal Computer PC control are blurring. Systems traditionally associated with process control are being used in discrete applications. Likewise, traditionally discrete solutions are used increasingly in both batch and continuous process control. Today's control hardware are constructed from many of the same standard industry components such as Intel processors. Therefore the only real difference between control systems is at the software level.

IEC 61131-3 is an international standard first published in December 1993 by the IEC. It is the third publication in the series IEC 61131. The current (second) edition was published in 2003. This standard defines two graphical and two textual PLC programming language standards: - Ladder logic (graphical) - Function block diagram (graphical) - Structured text (textual) - Instruction list (textual) The standard also defines both graphical and textual sequential function chart elements to organize programs for sequential and parallel control processing. Copyright©2006-2007 What-is.Net All rights reserved. Last Updated: June 16, 2007 What is IEC 61131-3? Basically it is a programming language standard that originates from the Programmable Logic Controllers (PLC's) but has been adopted very widely in the Industrial world. It is the only viable standard and therefore is at the core of an Open Solution to Control and Automation. Any standard needs a body to control it since all standards are continually developing. Also there has to be some form of independent conformance testing and the administration of this falls under the remit of the standardisation body. For IEC 61131-3, the body is PLC Open http://www.plcopen.org/ .

The new Controller-E from ifm efector, Exton, Pa. (www.ifmefector.com), is a high-speed AS-I master and PLC integrated into a compact housing. It features 1 Mbyte of total memory and can be used as a stand-alone controller or as a gateway to higher-level bus systems. As a gateway, the Controller-E can connect two full AS-I systems, up to 868 I/O points, as one node on a higher-level bus system. Information passes transparently from the AS-I system to the higher network without the need for additional software, and a full-range of diagnostics are available to both systems. Interfaces include Profibus, DeviceNet, and Ethernet (Modbus TCP/IP and Web enabled). The Controller-E fully supports all AS-I 2.1 extensions, including the extended-addressing mode that allows up to 62 nodes on each master. The master also supports peripheral fault indication and connects analog devices without function blocks As a PLC, the 128-K word program memory holds more than 300 counters and timers. The software conforms to the IEC61131-3 standard supporting five programming languages: Ladder, Function Block Diagram, Sequential Function Chart, Structured Text, and Instruction List. It also supports standard PLC functions such as floating-point math, real-time clocks, and online changing. The unit features a highly visible four-line LCD display that lets users instantly check operational status or diagnostic information. Data include status of digital I/Os, analog values, fault messages, freely programmable texts, and user-defined messages. In many applications this eliminates the need and expense of a separate MMI unit. Pushbutton programming and a configurable menu structure provide quick setup, and the integrated display can be changed from English to another language, such as German or French. According to the company, the dual-function device is ideal for distributed-control systems because it can reduce plant downtime, shorten machine cycle times, and simplify programming and maintenance. Four Controller-E models are available in single and dual models that range from $715 to $1,160.

Power line communication (PLC), also known as power line carrier, mains communication, power line telecom (PLT), or power line networking (PLN), is a system for carrying data on a conductor also used for electric power transmission. Broadband over Power Lines (BPL) uses PLC by sending and receiving radio signals over power lines to provide access to the Internet Electrical power is transmitted over high voltage transmission lines, distributed over medium voltage, and used inside buildings at lower voltages. Powerline communications can be applied at each stage. Most PLC technologies limit themselves to one set of wires (for example, premises wiring), but some can cross between two levels (for example, both the distribution network and premises wiring). All power line communications systems operate by impressing a modulated carrier signal on the wiring system. Different types of powerline communications use different frequency bands, depending on the signal transmission characteristics of the power wiring used. Since the power wiring system was originally intended for transmission of AC power, the power wire circuits have only a limited ability to carry higher frequencies. The propagation problem is a limiting factor for each type of power line communications. Data rates over a power line communication system vary widely. Low-frequency (about 100-200 kHz) carriers impressed on high-voltage transmission lines may carry one or two analog voice circuits, or telemetry and control circuits with an equivalent data rate of a few hundred bits per second; however, these circuits may be many miles (kilometres) long. Higher data rates generally imply shorter ranges; a local area network operating at millions of bits per second may only cover one floor of an office building, but eliminates installation of dedicated network cabling

Data Regeneration Since the ports are connected via sampling software, data-regeneration is inherent in the design, That is, incoming codes are sampled and interpreted, and outgoing codes are generated with perfect framing and bit times (within the 250-us resolution of the software's sampling mechanism). Programmable Features All customizable features in TTY-Connect are stored in non-volatile memory (eeprom). This includes the current connection (TU to HV1 loop, PC to LV loop...), current port parameters (60-wpm...), selcal sequences, which, if any, selcals are enabled, etc. In addition to the primary connection features of TTY-Connect, there are two categories of programmable options: General-Options and RX-Stream-Options. General-Options These general options are applied regardless of the baudot-specific RX-Stream-Options (discussed next). These features may be independently enabled/disabled. The factory setting is disabled. 1: Unconnected-TTY-Loops-Mark: If enabled, tty loops NOT involved in the current connection will be set to the mark state (loop current flowing). Enable this if you need to provide loop current for an attached tty machine; disable this to minimize power/heat in unused loop circuitry. 2: TU-Data-Inversion: If enabled, will invert the TU data for connection to TUs having MIL-188 ports. Standard RS-232 signals use mark < -3V, and space > +3V. Some TUs use MIL-188 signals, in which case mark = +5V, and space = -5V. 3: Auto-CRLF-RX-Insertion, if enabled: a- After a CR is detected, reaching a max char trigger count (default: 72) forces return/linefeed string. b- For a baudot connection (modes 1,4,6), the default string to be inserted is CR CR LF LTRS LTRS c- For an ascii connection (modes 2,5), the default string to be inserted is CR LF NUL NUL NUL 4: Motor-Power-Mode provides Autostart or Selcal motor powering. All modes are valid for baudot operation, but only a subset of modes are valid for ascii use. The modes are discussed in the following section. 5: TX-Diddle Insertion: If enabled, constantly send LTRS chars when TX stream is idle (modes 1,4,6).

TTY-Connect provides everything needed for connecting most teletype machines in up to three local current loops, and for connecting a computer (PC) and/or a radio terminal-unit (TU) via RS-232 serial ports. Power is provided for the TTY loops (and current-limiting), as well as full opto-isolation. Note: this unit is NOT designed to connect to externally-powered loops. You can simply use the unit as a loop supply for connecting multiple TTYs on a loop. Or, you can manually patch a loop to a computer's 232-serial (com) port, allowing a program on the computer to talk to the tty gear. Or, you can manually patch a loop to a radio terminal-unit's 232-serial port, and have the tty gear print the received rtty broadcast. Or, you can include the optional microcontroller to provide programmable signal connections between the loops/TU/PC, data-regeneration, and customizable features like Auto-CR-LF-Insertion, Autostart (motor powering), Selective-Calling, Who-Are-You (WRU), Ascii/Baudot-Conversion, Speed-Conversion, etc. With either the PC232 or TU232 port connected to a tty loop in Full-Duplex mode, the keyboard (or tape-reader) contacts are sensed, and the characters are sent to the 232 port RX line only. Characters from the 232 port TX line are sent to printers (and/or punches). In Half-Duplex mode, typed characters will echo locally on the tty (as well as all other ttys in the loop). Characters sent from the 232 TX line are also echoed on the RX line, since they are returned from the loop sense. Firmware Features When the optional PIC microcontroller is included on the TTY-Connect board, it provides a number of programmable features, and allows “connections” between various “ports” -- the ports are PC232, TU232, HV1 loop, HV2 loop, and LV loop. These features are accessible using commands sent to the PC232 port. Connection Modes Once a connection is made, the unit will power-up in that mode until it is changed (since the connection configuration is stored in non-volatile memory, and is established at power-up). The system provides eight connection modes: 1) Mode-1: Connect the PC232 port in Ascii, to talk Baudot to one of three powered tty loops, or to the TU232 port, at any of the standard tty speeds (60, 66, 75, or 100-wpm). The PC232 port is fixed Ascii at 38400-baud, and uses xon/xoff for data throttling -- the unit automatically converts to/from baudot. The data stream from the PC to the TTY/TU is piped through the baudot “Receive-Stream-Options,” for programmable Auto-CRLFInsertion, AutoStart or SelCal motor powering, Unshift-on-Space, etc. Example: PC connected to M15 on HV1 loop, or Dovetron on TU port... 2) Mode-2: Connect the PC232 port to talk Ascii directly to one of three powered tty loops, or the TU232 port, at a fixed 110-baud. The PC232 port is fixed at 38400-baud, and uses xon/xoff for data throttling. Example: PC connected to M33 on LV loop, or M43 on TU port... 3) Mode-3: Connect the PC232 port to talk raw 5-, 6-, 7-, or 8-bit data to one of three powered tty loops, or the TU232 port, at an adjustable speed (16 to 1000-baud, with 250us resolution). The PC232 port is fixed at 38400-baud, and uses xon/xoff for data throttling. Using 8-bits allows connection to Ascii ttys (M33/35...). Using 5/6/7 bits allows the PC to send/receive custom codes, such as non-ustty 5-level, or 6-level TTS. Example: PC connected to 6-level M20 on HV1 loop... 4) Mode-4: Connect the TU232 port to talk Baudot directly to one of the three powered tty loops, at any of the standard tty speeds (60, 66, 75, or 100-wpm). The TU and TTY must be on the same speed. The data stream from the TU to the TTY is piped through the baudot “Receive-Stream-Options,” for programmable Auto- CRLF-Insertion, AutoStart or SelCal motor powering, Unshift-on-Space, etc. Example: Dovetron TU connected to M15 on HV1 loop, or M28 on HV2 loop... 5) Mode-5: Connect the baudot TU232 port to talk Ascii directly to one of three powered tty loops at a fixed 110- baud. The data stream from the TU to the TTY is piped through the ascii “Receive-Stream-Options,” for programmable Auto-CRLF-Insertion, AutoStart motor powering, etc. Example: TU connected to M33 on LV loop... 6) Mode-6: Connect Baudot ports at DIFFERENT SPEEDS (60, 66, 75, or 100-wpm). A PC must be connected, and running a buffering program, for connecting the high-to-low speed stream. The data stream from Port-A to Port-B is piped through the baudot “Receive-Stream-Options,” for programmable Auto-CRLF-Insertion, AutoStart or SelCal motor powering, Unshift-on-Space, etc. Example: TU at 60-wpm connected to M28 on HV1 loop at 100-wpm Example: TU at 75-wpm connected to M15 on HV2 loop at 60-wpm 7) Mode-10: No connection, but place tty loops in space state (for system testing). 8) Mode-11: No connection, but place tty loops in mark state (for system testing).

Never worked with those nice guys of the "SCADA developing people" ? They need to "tag" each PLC value before using it within their SCADA and therefore they need a complete table of all interfaced values along with their type declaration and address in PLC memory. This people know a lot about SCADA but many of them do not know how to move within the Siemens S7 developing environment. In most cases, even if you can obtain a printout of the datablock along with the addresses, you can not use it for automated tags creation and you need to type manually every variable. You can easily copy the contents of a Datablock and paste it to an Excel spreadsheet. Unfortunately this operation does not allow to paste the variable addresses within the datablock. It is a minor problem if all the data belongs to the same datatype (eg. all integers or all Reals), but if you have a Datablock created using structures with mixed data types, it is a real trouble. Here comes a way to fix it: a) install a "print to file" driver in Windows b) print to file the datablock c) import the file in Excel How to install the "print to file" driver in Windows - in Windows' taskbar, select "setting" menu, then select "printers" - click on "install new printer" - select "local printer" - from the manufacturers list, select "generic" (generic/text only) - when assigning the printer port, select "file" - finish installing the printer - now in the "printer" folder, you have the "Generic/text only" printer - select "Generic/text only" printer, click with right-mouse button and select "properties" - on the "properties", select the "paper" tab - scroll all the paper sizes and select "user-defined size" - assign the largest possible values (this ensures no carriage returns when printing long Datablock vars and comments) - in "Paper source" list, assign "continuous, no page break" - click "Ok" and terminate. How to print a datablock to file - open your datablock in Step7 editor - chose "view" menu and select "data view" (this ensure address to be printed for each variable). - From the "file" menu, select "print setup" - select "Generic/text only" printer and "user defined size". - From the "file" menu, select "print" (there is no need to select the "print to file" checkbox of the dialog window). - press "Ok" ant type the name of the file to be output. - start the printing How to import the file to Excel - open the printed file with any editor - remove all the pages header and footer that the Step7 editor has added (I think there is no way to avoid them to be printed...) - save the file - open Excel and open the file - Excel displays a window where you can assign the data separators - select "fixed width" and go to next step - move the first limit to just before the variables name - leave the second limit at the beginning of the data type - add a new limit after 4 chars (this limits the data type to be displayed with four chars only) - add a new limit just before the variables comment. - go to next steps and have the file imported - from Excel spreadsheet you may have to delete the "values" column, but this is a minor problem.

Siemens data frame is not usual, open your port with: speed 9600 baud data 8 bits stop 1 bit parity EVEN DLE (10hex) is a control character, used to inform the receiver that the following char is to be considered a control character and not a data byte. In other words, DLE is a software switch within the AS511 protocol to divide control and data bytes. Whenever a DATA byte containing the value 10hex is to be sent, the sender must DOUBLE the char. This means that to send a data byte 10hex, the sender must send 10hex 10hex (DLE DLE). The receiver must consider the thing, so a single DLE will mean a protocol signal, while two consecutive DLE are to be interpreted as a SINGLE data byte containing the 10hex value. This is a little tricky, since the receiver NEVER knows exactly how many bytes to expect. Take also note that the AG can answer DLE NAK instead of DLE ACK if the requested operation can not be carried out. In this case, the PG must abort the communication and wait for 500ms before attempting a new communication. The value of 500mS is also applied as timeout value in case of missing response from the partner.This also means that no "holes" of 500mS (or more) are allowed during a communication (e.g. within a DB_READ function) To read or write a datablock value, you need to know its address in PLC memory. Therefore you must invoke B_INFO function to know the address, then you can call DB_READ or DB_WRITE by giving the initial and final address of the area to be read or written. Be aware that in SIMATIC the LSB/MSB bytes order is reversed:

SIMATIC:

15..............0

BYTE 0 BYTE 1

INTEL:

15..............0

BYTE 1 BYTE 0

To obtain the correct integer value of a dataword, the user must therefore: - swap the received bytes and - swap the bytes before sending them to the PLC B_INFO input: block number output: initial address of DW0 in AG PG AS (hex) (hex) ---------------------- function start -------- 02 ----> STX <---- 10 DLE <---- 06 ACK 1A ----> B_INFO function code = 1Ah <---- 02 STX 10 ----> DLE 06 ----> ACK <---- 16 AG answer=16h <---- 10 DLE <---- 03 ETX 10 ----> DLE 06 ----> ACK ---------------------- header info -------- 01 ----> ID=01h for Datablock XX ----> DB number (0..255) 10 ----> DLE 04 ----> EOT <---- 10 DLE <---- 06 ACK ---------------------- data -------- <---- 02 STX 10 ----> DLE 06 ----> ACK <---- 00 NUL <---- XX DB initial address <---- XX <---- 70 synchronization code: 70 70 <---- 70 <---- 41 block ID and DB number : 41 XX <---- XX <---- XX PG ID code: XX XX <---- XX <---- XX library number: XX XX <---- XX <---- XX block length (words): XX XX <---- XX <---- 10 DLE <---- 03 ETX 10 ----> DLE 06 ----> ACK ---------------------- terminate -------- <---- 02 STX 10 ----> DLE 06 ----> ACK <---- 12 AG "end of transmission" code: 12h <---- 10 DLE <---- 03 ETX 10 ----> DLE 06 ----> ACK DB_READ input: initial address in AG final address in AG output: contents of datawords PG AS (hex) (hex) ---------------------- function start -------- 02 ----> STX <---- 10 DLE <---- 06 ACK 04 ----> DB_READ function code = 04h <---- 02 STX 10 ----> DLE 06 ----> ACK <---- 16 AG answer=16h <---- 10 DLE <---- 03 ETX 10 ----> DLE 06 ----> ACK ---------------------- header info -------- XX ----> initial address in AG: XX XX XX ----> XX ----> final address in AG: XX XX XX ----> 10 ----> DLE 04 ----> EOT <---- 10 DLE <---- 06 ACK ---------------------- data -------- <---- 02 STX 10 ----> DLE 06 ----> ACK <---- 00 NUL <---- 00 NUL <---- 00 NUL <---- 00 NUL <---- 00 NUL <---- XX first byte of data <---- XX <---- XX . . . . . . <---- XX <---- XX <---- XX last byte of data <---- 10 DLE <---- 03 ETX 10 ----> DLE 06 ----> ACK ---------------------- terminate -------- <---- 02 STX 10 ----> DLE 06 ----> ACK <---- 12 AG "end of transmission" code: 12h <---- 10 DLE <---- 03 ETX 10 ----> DLE 06 ----> ACK DB_WRITE input: - initial address in AG - contents of datawords output: - none PG AS (hex) (hex) ---------------------- function start -------- 02 ----> STX <---- 10 DLE <---- 06 ACK 03 ----> DB_WRITE function code = 03h <---- 02 STX 10 ----> DLE 06 ----> ACK <---- 16 AG answer=16h <---- 10 DLE <---- 03 ETX 10 ----> DLE 06 ----> ACK ---------------------- header info -------- XX ----> initial address in AG: XX XX XX ----> ---------------------- data -------- XX ----> first byte of data XX ----> XX ----> . . . . . . XX ----> XX ----> XX ----> last byte of data 10 ----> DLE 04 ----> EOT ----> 10 DLE ----> 06 ACK ---------------------- terminate -------- <---- 02 STX 10 ----> DLE 06 ----> ACK <---- 12 AG "end of transmission" code: 12h <---- 10 DLE <---- 03 ETX 10 ----> DLE 06 ----> ACK

The Siemens SIMATIC S5 PLCs are programmed via a TTY serial interface (called also 20mA Current Loop). To connect a PC, which is normally equiped with RS232 ports, a converter is therefore required. In the AutoCAD R12 file there is a complete drawing of a RS232 to 20mA Current Loop converter, suitable for data access or programming functions. It works on all Simatic S5 CPUs (tested on 100U CPU 100/102/103, 115U CPU941/942/943/944, 135U CPU928, not tested on 150U and 155U) Since this is a PASSIVE converter (the current source is fetched from the PLC port), it is not possible to program other devices such as CP526/CP527 or OP393/OP396/OP5 etc., which require an ACTIVE (with separate power source) converter. Drawing 232_20mA