Siemens S7 PLC Plugin

Purpose

This is a plugin to read data from a Siemens S7 PLC.

Usage

You run a log to send data to the cloud, or a discover to only display information. There must be a config file when running log or a discover. The config file defines which variables need to be collected, what names they appear on the the Ardexa cloud, units and scaling, what table(s) they variables will be sent to, and the source name(s). Example config file as follows. Always verify data accuracy by running a discover first, before committing the plugin to collect data.
1
# Table, Source Name, Variable Name, Memory Area, Block Number, Memory Address, Type, Units, Scale, Invalidate, Lookup Table/Num Bytes
2
solar, hec, AC Voltage 1, DB, 1, MW23, dec, V, 1+10, ,
3
solar, hec, Grid Freq, DB, 1, freal9, dec, Hz, 0.01, ,
4
solar, hec, Cos Phi, DB, 1, freal7, dec, ., 100, ,
5
solar, hec, PT100 Temperature, DB, 1, freal6, dec, C, 1, ,
6
solar, hec, Total Hours, DB, 3, freal3, dec, h, 0.1, ,
7
solar, hec, Total Hours, DB, 3, freal4, dec, h, 0.1, ,
8
solar, hec, DC Current 1, DB, 3, freal5, dec, A, 1, ,
9
solar, hec, HDG Setpoint Mode, DB, 6, MX0.0, bitb, bool, 1, , 1
10
solar, hec, Run Auto, DB, 6, MX0.1, bitb, bool, 1, , 2
11
solar, hec, Run Manual, DB, 6, MX0.2, bitb_int, bool, 1, , 3
12
solar, hec, Key Switch, DB, 6, EW33, str, , 1, , mode.dict
13
solar, hec, Key Switch2, DB, 9, EW34, str_rep, , 1, , mode.dict
14
solar, hec, Program Name, DB, 9, DW3467, str_raw, , 1, , 20
15
solar, pid_box, PV- Voltage, DB, 9, EW35, int, V, 1, ,
16
solar, pid_box, PV- Current, DB, 9, EW63, int, mA, 1, ,
17
solar, alarm, Alarm 0 Keyword, DB, 9, MX6.3, bit, , 1, , container_alarm0.dict
18
solar, alarm, Alarm 1 Keyword, DB, 9, MX7.4, bit, , 1, , container_alarm1.dict
19
solar, alarm, Alarm 2 Keyword, DB, 9, MX8.5, bit, , 1, , container_alarm2.dict
20
solar, alarm, Alarm 3 Keyword, DB, 9, MX9.6, bit, , 1, , container_alarm3.dict
21
solar, alarm, Alarm 1, DB, 9, MX1.0, bool, , 1, ,
22
solar, alarm, Alarm 2, DB, 9, MX2.0, bool, , 1, ,
23
solar, alarm, Alarm 3, DB, 9, MX3.0, bool, , 1, ,
24
solar, alarm, Alarm 4, DB, 9, MX4.0, int_bool, , 1, ,
25
solar, hec, Total Current, DB, 10, MW888, dec, h, 0.1, >100000,
26
solar, status, Binary Status Raw, DB, 10, MX0.1, bin, , 1, ,
Copied!
NOTES:
  • Anything that starts with # is a comment line, and will be ignored
  • The Memory Area is sometimes referred to as the "block". Valid values can be things like OB, DB, SDB, FC, SFC, FB, SFB. However, they can also be customised implementations.
  • In Block Number, this is an integer value, usually in the range [0...127]. Check with the PLC project manager.
  • Memory Address MUST be formatted as follows:
    a. Boolean values: eg; MX13.1. The value M is ignored, but the X denotes a bit wise mapping. 13 is the memory location, and .1 is bit 1.
    b. Date and Integer values: eg; MW2. The value M is ignored, but the W denotes a WORD (2 byte) entry . 2 is the memory location, in this case.
    c. Real (decimal) values: eg freal334. The value freal is used to denote a real (4 bytes value). 334 is the memory location, in this case.
  • Scale will only be used for decimal and integer types. An error will be reported if you try and divide an integer, or multiply by anything other than a whole number. The scale can also be a value such as 0.75-9, where the -9 is a BIAS value (addition or subtraction). In which case it will FIRST subtract the 9, THEN multiply by 0.75. If using a bias value, then it can ONLY be used with a decimal type.
  • Invalidate. This column will only do the following task": If an entry starts with >, it will invalidate ALL entries in a configuration file, if the value for this entry is greater than the specified amount. For example; if the Invalidate column entry is >10000, then a value of 12,000 will ensure ALL readings in the configuration file are invalidated. Use this item with caution. Also, it will ONLY work on dec values. This invalidation feature is intended for those machines that have poor quality control, and sometimes transmit wildly wrong values.
  • in Lookup Table; Sometimes you want to convert an INT to a keyword, through a lookup table. Or you may want to get a register bit and convert it to a keyword, or the string length. See examples below.
  • Allowable Type column values are as follows:
    • dec ... Converts the S7 location to a decimal. Can be scaled (including division).
    • int ... Converts the S7 location to an integer. Can only be scaled upwards (not divided). So a scale value that is not a whole number will be rejected.
      1
      See also the explanation for `scale` above, since it can include a bias and scale factor.
      Copied!
    • bool ... S7 location is converted to an INT. This value is then check as follows: Anything other than 0 will output a True. Else, output will be False.
    • int_bool ... S7 location is converted to an INT. This value is then check as follows: Anything other than 0 will output a 1. Else, output will be 0.
    • bin ... Converts the S7 location to an integer, then to a binary representation.
    • bit ... Used with a lookup table (in the Lookup Table column) to define a bit being turned or off. See example contents of file below.
      1
      Bits start at "1" (not "0"), and are defined in the `Lookup Table` column.
      Copied!
    • bitb ... If a bit in the S7 location is turned on/off, it will reflect a boolean ("True"/"False") output.
    • bitb_int ... If a bit in the S7 location is turned on/off, it will reflect a boolean ("1"/"0") output.
    • str ... Treated as an ASCII character. If it can't be converted, it will output an empty field
    • str_rep ... Same as str, but it will clear \0 values in the resultant string.
    • str_raw ... Treated as raw characters without ANY conversion. Note the INTEGER in the example above specifies the LENGTH of the string to the PLC

Arguments

  • ip_address This is the IP Address of the S7 PLC. Make sure that Port 102 is open.
  • config_path. This is the config file location
  • --attempts Is the number of attempts to make to get data from the PLC. The default=2
  • --rack and --slot values are both integers. They default to rack=0 and slot=1. The Rack (0..7) and Slot (1..31) can be found in the hardware configuration of the project. There is however some special cases for which those values ​​are fixed or can work with a defaults, as shown:
    1
    S7 TYPE RACK SLOT Comments
    2
    ========================================================================
    3
    S7 300 CPU 0 2 Always
    4
    S7 400 CPU ....Not fixed... Follow the hardware configuration.
    5
    Win AC CPU ....Not fixed... Follow the hardware configuration.
    6
    S7 1200 CPU 0 0 Or 0, 1
    7
    S7 1500 CPU 0 0 Or 0, 1
    8
    WinAC IE 0 0 Or follow Hardware configuration.
    Copied!

Write Arguments

This plugin can be used to write to an S7 PLC. Only a single value can be written at any one time. A log record is written anytime a memory location is written. This log record is written to the S7_write table, and is available in SEARCHES on the Ardexa front end. The command is s7_ardexa set_command {arguments}. The arguments for the write capability include, in order:
  • The IP address if the IP Address of the S7 PLC
  • The area (eg; DB)
  • The block (eg; 99)
  • The memory address (eg; MW916)
  • The --rack and --slot values are both optional integers. See the above Read Arguments
For example: s7_ardexa set_command 192.168.1.2 db 2 MW876 1193

Example of "bit" lookup

Bit starts at 1. Include a 0 value to display something (or blank) if no bits are turned on
1
0 :
2
1 : leakage sensor#1
3
2 : AC surge protection device
4
3 : key-operated switch
5
4 : scram button
6
5 : switcher signal from UC PCB Control Board
7
6 : leakage sensor#2
8
7 : leakage sensor#4
9
8 : leakage sensor#3
10
9 : signal 8 abnormal
11
10 : energy-saving contractor KM1 return signal
12
11 : bad leakage sensor #2
13
12 : bad leakage sensor #1
14
13 : bad leakage sensor #4
15
14 : bad leakage sensor #2
16
15 : signal 4 abnormal
17
16 : signal 4 abnormal
Copied!

Example of "str" lookup file

Numbers can be anything, since they are read from a single modbus (16 bit) register
1
-1 :
2
51 : Closed
3
267 : Inverter
4
276 : Instantaneous value
5
295 : MPP
6
303 : Off
7
308 : On
8
309 : Operation
9
311 : Open
10
336 : Contact the manufacturer
11
337 : Contact the installer
12
338 : Invalid
13
381 : Stop
14
455 : Warning
15
569 : Activated
16
1041 : Leading
Copied!