Methods for remotely monitoring S7-200SMART via network port

Thread Content

Preface: The Siemens S7-200 SMART PLC (hereinafter referred to as 200-SMART) is an excellent programmable controller that is widely used in the field of industrial control; it is a controller with high performance and stable operation. The 200-SMART is equipped with network ports for uploading and downloading programs as well as for communication. This time, we will use the MODBUS-TCP protocol to connect the 200-SMART to the EMCP Internet of Things cloud platform (referred to as EMCP), thereby enabling remote monitoring of the VW1000, VW1002, and I0.0 registers within the 200-SMART, as well as remote reading and writing to the VW1004 and Q0.0 registers, via computer web pages, mobile apps, and WeChat. I. Preparation work. 1.1 Before docking, we need to prepare the following items ； 1) One Siemens S7-200SMART PLC, along with network cables for communication. 2) One GM20 DTU module from Hebei Blue Bee Technology, along with an antenna and power adapter (the usage method is the same as that of the WM20 DTU). 3) One 4G SIM card with data allowance, a larger capacity card, from any carrier. 4) One networked computer (with WinXP/Win7/Win8 operating system). 5) Electrical tools, communication cables, etc. 1.2 Preparation for the DTU: Follow the instructions in the \"GM20-DTU User Manual\" for these steps. We need to connect an antenna to the DTU gateway (hereafter referred to as the GM20-DTU gateway), insert a SIM card, and connect it to a 12V or 24V power adapter. 1.3 PLC preparation work. 200 SMART is connected to 220V AC power. First, the program is configured using a computer via an Ethernet cable connected to the PLC’s Ethernet port. Then, an Ethernet cable is used to connect the GM20’s LAN port to the PLC’s Ethernet port in order to enable MODBUS-TCP communication. Second, creation of PLC’s MODBUS-TCP communication. Step 1: Create a PLC MODBUS-TCP server ； Using Siemens’ programming software STEP 7-MicroWIN SMART V2.2, the MB_Server instruction library is added to the PLC program; this library contains two instructions, namely MBS_Connect and MBS_Slave. As shown in the figure below: (The figure below shows a properly configured instruction block for communication.) The parameters of the MBS_Connect instruction are defined as follows: l EN Enable: It must be enabled in every scan cycle. l Connect: Initiates the TCP connection establishment process. l Disconnect: The operation to terminate the TCP connection. l ConnID: TCP connection identifier. Note: Modbus TCP belongs to TCP communication and is also a type of open user communication; therefore, the ConnID parameter cannot be the same as that used in other TCP, ISO-on-TCP, or UDP communications. l IPaddr1~IPaddr4: The IP addresses of the Modbus TCP client, where IPaddr1 is the most significant byte of the IP address, and IPaddr4 is the least significant byte. It is recommended to set it to 0.0.0.0 so that any client can access it. l LocPort: Port number on the local device (must be set to 502). l MaxHold: Used to set the number of word hold registers in V memory that are accessible using Modbus addresses 4xxxx or 4yyyyy. This value must be set to be greater than or equal to the length of all the data that needs to be read. For example, if it is necessary to monitor 100 characters of data in area V, this value must be set to 100 or more. l HoldStart: An indirect address pointer that points to the starting address of the hold register in V memory within the CPU. In this example, VW1000 corresponds to Modbus address 40001. (i.e., VW1000 corresponds to 40001, and VW1002 corresponds to 40002). (Other registers, such as the I register area can be accessed directly using function code 02, the Q register area can use function code 01, and the AI register can be accessed directly using function code 04.) l ConnectDone: The Modbus TCP connection has been successfully established. l Busy: The connection operation is in progress. l Error: An error occurred while establishing or disconnecting the connection. l Status: If the command sets the “Error” output, the Status output will display the error code. The definitions of the various parameters for the MBS_Slave command are as follows: l EN – Enable: It must be enabled in every scanning cycle. l Done: When the MB_Server command responds to a Modbus request, the Done flag is set to 1 during the current scanning cycle ； If no requests are processed, the Done completion bit is 0. l Error: Error code, valid only when the Done bit is 1. Step 2: Allocate the library address area. On the right side of the programming software, right-click on the [Program Block] function to invoke the [Library Storage Area] function. Use the [Suggested Address] to ensure that there is no overlap between the library storage area and the data storage area in the program. Click [OK] to complete the configuration of the entire MODBUS-TCP server. As shown in the figure below: In the third step, download the modified program to the PLC; please note down the PLC’s IP address during the download process. In the example in this article, the PLC’s IP address is 192.168.2.2. Third, EMCP platform settings. Log in to the EMCP platform at www.lfemcp.com using an administrator account (it is recommended to use a browser version IE9 or later, or Google Chrome) to configure the EMCP cloud platform. For specific operations, refer to the EMCP IoT Cloud Platform User Manual. After logging into EMCP, you first enter the device list display page. Since we haven’t created any devices yet, it’s an empty page. Click the “Backend Management” button in the upper right corner (this permission is available only to admin accounts) to access the backend of the EMCP platform. 3.1 Remote Configuration of DTU: Open the \"Backend Management -> Module Management\" page, bind the DTU to this administrator account, and then you can use the \"Remote Configuration\" function to set various communication parameters and functional parameters for the DTU. There are two main areas that need to be configured: one is the parameters for communication with the PLC, and the other is the MODBUS channel settings for enabling the DTU to collect data from the PLC at regular intervals. The following explains this functionality step by step. Note: The module can only be remotely configured after it is online. 3.1.1 Module Binding: The initial binding password for the module is 111111; simply click to bind it. 3.1.2 Remote Configuration of Modules: Use the \"Remote Management\" function associated with the corresponding DTU in \"Module Management\" to set various communication parameters for the DTU ； For the remote configuration of modules, it is best to first [read] and then [write]; only when writing is successful can it be determined that the parameter has been successfully configured in the DTU. After performing the write operation, a read operation can also be used to check whether the previous operation was successful. Step 1: Go to the status information page to check the DTU status, as shown in the figure below. Step 2: Perform the \"Communication Settings\" adjustment, setting the DTU’s communication port to use a LAN port for communication; since the PLC’s IP address is 192.168.2.2, it is necessary to set the DTU’s communication IP to an IP address within the same subnet, so it is set to 192.168.2.254 in this case. Then, in the Modbus-TCP Server parameter settings list, enter the slave address, IP address, and communication port number for 200 SMART (the standard MODBUS-TCP port number is 502). For the data communication port, select the type suitable for communication with the PLC; options include RS485, RS232, or a LAN port. In this case, a LAN port is used for MODBUS-TCP communication ； Local IP address: This is the IP address of the DTU as a client in MODBUS-TCP communication. It must fall within the subnet range of the communication network, and its value must not coincide with those of other devices in the same subnet. If it is connected directly to 200 SMART, then it can be set to the same subnet range as 200 SMART; in this case, the value set is 192.168.2.254 ； Modbus-TCPServer parameters: Slave address: This is the slave address of the PLC; it just needs to be different from those of other PLCs involved in communication. In this example, it is set to 1 ； IP address: The IP address of the PLC as a MODBUS-TCP server; in this case, it is 192.168.2.2 ； Port number: This is the communication port for the PLC. According to the MODBUS-TCP protocol standard, the port number is 502; in this example, port 502 is also used ； In the third step, perform [Modbus configuration] to set the parameters for the DTU to periodically read data from the PLC and send it to the platform. As shown in the figure below: Parameter descriptions in the real-time data custom collection list: Device slave number: The slave number of the PLC connected to the DTU, which is the same as the PLC’s slave number in the [Communication Settings]. This case is 1 ； Function code: A flag for the module to read the MODBUS register area of the device. “Function code 01 corresponds to “Coil” (0XXXX), function code 02 corresponds to “Discrete Input” (1XXXX), function code 03 corresponds to “Holding Register” (4XXXX), and function code 04 corresponds to “Input Register” (3XXXX). In Siemens PLCs, Q points correspond to function code 01, I points correspond to function code 02, the area pointed to by HoldSt` in MBS_Connect corresponds to function code 03 (the PLC program mentioned above refers to VW1000 to VW1198), and AI areas correspond to function code 04. Start Address: The starting address for reading MODBUS registers of the device connected to the module (excluding the register area identifier). In the diagram, the first MODBUS instruction address 1 corresponds to 00001, the second MODBUS instruction address 1 corresponds to 10001, and the third MODBUS instruction address 1 corresponds to 40001. Data length: It refers to the continuous length of device data read by the DTU; in the figure, this length is 8 and 10, meaning that data is read consecutively from 00001 to 00008, from 10001 to 10008, and from 40001 to 40010. A standard DTU can connect to multiple slaves (up to 4). Click \"Create\" to establish a MODBUS command channel, and configure it according to the instructions above. Building on the setup of the PLC slave stations described above, what is monitored in real time here are PLC’s Q0.0 to Q0.7, I0.0 to I0.7, and VW1000 to VW1018. Note: When the DTU malfunctions, such as being unable to connect to the network or communicate properly with the PLC, it is possible to use the configuration port (RS232 by default) to connect to a PC, and the “DTU Configuration Software” can be used to check the status and any error alerts. For more details, refer to the “DTU Configuration Software User Manual”. 3.2 Creating a new data rule: Click on 【Data Rules】 on the left side of the webpage to enter the rule settings page. Click on 【Add】 in the upper right corner, and in the pop-up window set the name of this data rule to “S7-200SMART” and choose the display style as 【List Display】. We can opt for list display or configuration display; with list display, the data we add will be shown in a fixed list format, which is a simple and convenient method (list display can be used during the data testing phase). Configuration display: We can freely design the way in which device data is presented, by adding elements such as graphics, images, dashboards, bar charts, and text (this function is similar to that of traditional configuration software; refer to the \"EMCP Platform Screen Configuration Instructions\" document for more details). After creating the data rules, click on [Real-time Data] to add new rules for parsing real-time data (the Modbus configuration set in 3.1.2), and click on [Read/Write Data] to create rules for manual read and write operations of data by the platform to the devices. The created rules are displayed as follows. Note: Real-time data: This refers to the content displayed on the platform, which is obtained by the DTU reading the data from the slave devices at regular intervals set according to the configured Modbus acquisition channels (refer to section 3.1 above) and uploading it ； Reading and writing data: There is no need to configure Modbus timed acquisition channels on the DTU; data can be manually read from and written to the lower-level devices through the platform ； For all “register address” settings on the EMCP platform, it is not necessary to include a register area identifier. For example, when reading or writing the data in the “hold register” (function code 03) with address 40019, simply enter 19 in the “register address” field according to the platform’s data rules. (Note: If the device’s Modbus address counting starts from 0, an addition of 1 is required; in that case, enter 20.) For alarm settings, in the created real-time data, click the [Alarm] option to enter the alarm settings page. We can set the upper and lower limits for alarms related to this data, as well as the alarm message and whether to enable such alarms. After setting an alarm, when the data exceeds the upper and lower limits of the alarm, the platform automatically records the time and value at which the alarm was triggered. Additionally, the platform sends an alarm notification to the APP or WeChat that the user has logged into. 3.3 Creating a new device: In the backend management, select [Device Management] -> [Add] to create a new device named “S7-200SMART”. For newly created devices, you need to fill in the basic information about the device: 1. Select an image that matches the device (you can upload one from your local storage; if none is selected, the system will display a default image); 2. Enter the module’s SN – input the serial number to be bound. If this SN hasn’t been bound before, a binding window will pop up for the process; 3. Select the data rule created earlier; 4. Click the “Map” button to select the geographical location of the device. After completion, click [Save]. IV. Experimental results. Open the PLC programming software, put the PLC into online mode, and monitor the current data of the PLC from the monitoring table, as shown in the figure below: Log in to the EMCP platform (www.lfemcp.com), click on the image or device name of the \"S7-200 SMART\" device to access it. The first thing that is displayed is the data collected by the PLC at regular intervals (real-time data). By clicking on \"Read/Write Data\", operations can be performed on the PLC; clicking on \"Historical Data\" shows a report of the historical data stored by the device at regular intervals; clicking on \"Alarm Records\" takes you to the page displaying the records of alarm information, as shown below. Install the \"Yunlian Wutong\" mobile app on your phone (it can be downloaded by scanning the QR code in the upper right corner of the login page on the computer web platform, or from various app stores). Log in using your username and password; once you’re in the device list, click on the \"S7-200 SMART\" device. This will take you to either the real-time data list page or the configuration screen (in configuration mode). Click on the menu bar in the upper right corner, the 【three-bar button】, to bring up the function menu. Within this menu, click on 【Read/Write Data】 to perform read and write operations on the data. Click on 【Historical Reports】 to view the historical data records of the device, click on 【Historical Curves】 to see the historical trend charts of various data values, and click on 【Alarm Information】 to view the alarm records for that device. V. Introduction to Auxiliary Functions 5.1 Screen Configuration Function. Select the configuration display format to present the corresponding data rules by following the steps: [Backend Settings] -> [Data Rules] -> [Settings] -> [Configuration Display]. After selecting to display it in configuration mode, the screen configuration options for the rule become available; click on the \"Screen Configuration\" option to enter the editing page. Through the configuration editing page, we can freely draw images, text, digital display frames, buttons, indicator lights, pipes, equipment, and more within a space. For detailed functions, please refer to the \"EMCP Platform Screen Configuration User Guide\" at http://www.lanfengkeji.com/h-col-135.html. 5.2 WeChat functions. Follow the official WeChat account \"EMCP IoT Cloud Platform\", bind your platform account as instructed, and you can use WeChat to monitor devices and receive alarm messages. To facilitate equipment management, it is recommended to \"pin\" the official account of the \"EMCP IoT Cloud Platform\". 5.3 Enable communication alarms and the function to authorize regular users in the data rules. The communication alarm function ensures that an alarm is triggered in the relevant device when there is a communication issue between the DTU and the PLC; the cause of the communication problem is indicated in the alarm message, which facilitates troubleshooting. The settings and effects are as follows: 5.4 Public functions of the device. In device management, the attributes of a device can be set to public. Once made public, a URL link and a QR code corresponding to that device are generated; these allow the device to be accessed without logging in. The device can also be shared on social media platforms. 5.5 Added ordinary account and device authorization. After the administrator account creates a device, it can create a separate account for users through the “Regular Account” option, allowing them to access the device to which it belongs. This feature mainly creates a dedicated account for users, allowing them to view the devices to which they belong. 5.6 Video surveillance function. The EMCP platform enables the integration of Fluke Cloud cameras, thereby allowing web browsers, apps, WeChat, and other platforms to be used for on-site video monitoring. For details, please refer to the “EMCP IoT Cloud Platform Video Usage Instructions V3.6”