content.gif menu.gif basics.gif

Defining the peripheral addresses of the S7 driver

Click on the address config of a data point element, select the driver type NATIVE SIMATIC S7 from the combo box and click on the button "Configure" .... The opened panel, shown in the next figure, allows a configuration of peripheral address for the S7 driver.

The address is created with the aid of the single components (Connection name combo box, Address combo box, Spin-buttons x, y and z). The peripheral address is finally visible in the text field Reference and contains the connection name that was defined for a specific device and the symbolic address or the S7 protocol address. The driver determines all other important parameters for the access to a specific device via this connection name.

 

Figure: Definition of an S7 peripheral address

S7_Driver-27.png

  • Connection name
    Choose the configured connection from the combo box. The communication takes place via this connection name. The peripheral devices/connections the S7 driver establishes a connection to are created with the aid of the configuration panel for the S7 driver (see Configuration of the S7 driver).

  • Address
    Define here the address that is assigned to the data point element at the peripheral device. As shown in the figure above a read/write bit with the address "M0.0" on a Siemens Simatic S7 is configured for the data point element TestDP03.bool. The reference is composed of the configured device and the address. The address can be configured with symbolic addresses (in this case open the symbol editor via the button "..." which is visible in the address area when selecting the option Symbolic address from the combo box - see also Symbolic addresses for further details on this symbol editor) or you can use the S7 protocol specific addresses (select the desired address from the combo box and specify the x, y or z component for the address with the Spin buttons below - you can find the possible S7 data types and the type of transformation in WinCC OA in a table at the end of this page).
    The selected address is put into the field Reference of the address panel and has the following form:

    <Connection name>.<Symbolic address>
    resp. <Connection name>.<S7 specific address>

    The addresses can also be set directly in the field Reference without the aid of the single components described before. The value in the Reference field is checked automatically.

  • Type of transformation
    Choose the transformation type from the combo box. The transformation type is the interpretation of the data that was read on the peripheral device. The transformation always has to match with the address (if e.g. 4 bytes are read from the PLC the type of the transformation has to be float or int32). If the address is defined via the combo box and Spin buttons also the correct type of transformation for the specific address will be selected automatically.
    If the type default is selected in the combo box, the driver determines the transformation type automatically, depending on the value in the field Reference. For symbolic addresses the mapping in the corresponding data point of type _S7_Symbolics will be checked automatically.
    If you click on OK or Apply in the PARA panel, the panel checks whether the transformation type and the value in the field Reference fit (according to the table, at the end of this page, if the type is not default).
    For reading/writing a string either symbolic addresses or byte addresses from the table (at the end of this page) can be used. When writing a string only the number of bytes corresponding to the string length including the terminating 0 are written. When polling an input using the transformation type "string" the number of bytes can be set e.g. DB100.DBB10:100 polls 100 Bytes beginning from the address DB100.DBB10. Note that you can specify the number only for the transformation type String.

    You can find the possible S7 data types and the type of transformation in WinCC OA in a table at the end of this page.

note.gifNote

When writing a value of type TIME, note that the reference string has to point to the first target data block!

note.gifNote

Using symbolic addresses you have to check that the type of transformation is correct and not set to "default"!

  • Low level comparison
    This option can only be chosen if the direction was set to input or in/out (bidirectional peripheral communication). If it is selected data are sent only when they are changed. The comparison is based on raw data without any conversion. The low level comparison is an old/new comparison and is executed already with the data received from the periphery (contrary to smoothing where the data is already assigned to data points). In a low level comparison the single bits of byte blocks are compared to old values and when a bit changes the value is updated in WinCC OA.

  • Direction
    Defines whether the values of a data point element are sent in the send direction (output), in the receive direction (input) or in both directions (In/Out).

IconNote

When the values of a data point element are sent in both directions (In/Out), then this data point element must not be directly subordinated to a struct node (structure of values).

  • Receive mode
    The receive mode for the input can be Spontaneous TSPP, Polling or Single query. Spontaneous TSPP can only be used if Use TSPP has been activated in the S7 configuration panel for the corresponding connection.
     

  • Poll group
    Choose already existing poll groups. If there are no poll groups available you have to create them with the specific polling parameters in an own panel. The panel is opened by clicking on the Poll groups... button (see Poll groups for more information on poll groups and polling parameters).

  • Address active
    If the
    Address active check box is chosen the address is used by the driver (see Reference tables). An inactive address exists and the attributes can be set and queried but the driver does not use them. This means that no values can be sent to PLC or received from the PLC for this data point element.

Possible WinCC OA data types

The following WinCC OA data types can be used to define peripheral addresses for the S7 driver:

  • char, unsigned, int, float, bool, bit32, string, dateTime

  • array char, array unsigned, array int, array float, array bool, array bit32, bitString

Possible S7 data types

In an S7-300 or an S7-400 the following data types with the following names for the addresses are available:

S7-300 / S7-400 variable (corresponds to the address in the PARA panel)

Type of exchange

WinCC OA transformation type

My.z

read / write bits

boolean

DBx.DBXy.z

read / write bits

boolean

Ey.z

read input bits

boolean

Ay.z

read / write output bits

boolean

MBy

read / write bytes

byte

DBx.DBBy

read / write bytes

byte

EBy

read input bytes

byte

ABy

read / write output bytes

byte

MWy

read / write words

int16, uint16

DBx.DBWy

read / write words

int16, uint16

EWy

read input words

int16, uint16

IWy

read input words

int16, uint16

AWy

read / write output words

int16, uint16

QWy

read / write output words

int16, uint16

MDy

read / write double words

int32, uint32

DBx.DBDy

read / write double words

int32, uint32

EDy

read / write double words

int32

IDy

read / write double  words

int32

ADy

read input double words

int32

QDy

read input double words

int32

MDyF

read / write floating words

float

DBx.DBDyF

read / write floating words

float

Tn

read / write timers

uint16

Zn

 

read / write counters

uint16

MBx and DBx.DBy

transformation of date and time.

byte, dateTime

Bx.DBW, EW, MW, AW

 

bitString

caution.gifCAUTION

The following dynamic types work for input TSPP data:

dyn char, dyn unsigned, dyn int, dyn float, dyn bool. If WinCC OA receives a TSPP block and a dyn DPE with an address has been configured at the beginning, or in this block, all data starting from that address is mapped to the dyn DPE. For the dyn bool, define the address with a bit number 0!

note.gifNote

When writing a value of type TIME, note that the reference string has to point to the first target data block!

note.gifNote

For the letters E resp. A (input resp. output) in the address variables you can also use I resp. Q (the English variant)!

 

Bit Access

If bits have to be written, the whole byte/word must be sent to the PLC. If several bits are used in a byte/word, these can be mapped to WinCC OA by using an array with peripheral address on the node of the array. This can be seen in the configuration example (see below). If one bit is changed in WinCC OA in this case all 16 bits are sent to the PLC. In that case the address must start at bit 0.

caution.gifCAUTION

You have to configure at least one peripheral address on the corresponding driver since the driver cannot establish a connection to S5 otherwise.

 

Figure: Example for writing several bits in a data block word.

S7_Driver-15.gif

note.gifNOTE

The driver does not do a ”read before write” to avoid overwriting bits that are not configured. Thus, no bits can be used for other purposes in the corresponding byte/word.

 

page_top.gif

V 3.11 SP1

Copyright ETM professional control GmbH 2013 All Rights Reserved