Simatic Ti 505 Ethernet Manual
Simatic Ti 505 Ethernet Manual
Simatic Ti 505 Ethernet Manual
Table of Contents
Table of Contents 2
Simatic / TI 505 Ethernet Driver Help 3
Overview 3
Device Setup 4
Cable Diagrams 5
Communications Parameters 5
Addressing Options 7
Optimizing Simatic / TI 505 Ethernet Communications 9
Data Types Description 11
Address Descriptions 12
Addressing 12
Common Data Type Addressing 12
Status Words 16
Alarm Addressing 21
AVF Bit Definitions 23
ACF Bit Definitions 24
Loop Addressing 25
LVF Bit Definitions 26
LCF Bit Definitions 27
LRSF Bit Definitions 28
Find Forced Addressing 29
Error Descriptions 31
Address <address> is out of range for the specified device or register. 31
Array size is out of range for address <address>. 31
Array Support is not available for the specified address: <address>. 31
Data type <type> is not valid for device address <address>. 32
Device address <address> contains a syntax error. 32
Device address <address> is read only. 32
Device <device name> cannot execute a read request (<address>, <size>). 32
Device <device name> cannot execute a write request (<address>, <size>). 32
Device <device name> detected a NITP protocol error (tag <address>, size <size>). 32
Device <device name> detected a Task Code error <error> (tag <address>, size <size>). 33
Device <device name> input queue is full. The module is receiving requests faster than it can process
requests. 33
Device <device name> is not responding. 33
Device <device name> responded with Extended error <error> (tag <address>, size <size>). 33
Device <device name>, write value not in range 1-->65536. (Tag 'FFSTART'). 34
Missing address. 34
Unable to write to <address> on device <device name>. 34
Winsock initialization failed (OS error = n). 34
Winsock V1.1 or higher must be installed to use the Simatic / TI 505 Ethernet device driver. 34
Task Code Error Codes 36
Index 37
www. kepware.com
3 Simatic/TI 505 Ethernet Driver Help
CONTENTS
Overview
What is the Simatic / TI 505 Ethernet Driver?
Device Setup
How do I configure a device for use with this driver?
Address Descriptions
How do I address a data location on a Simatic / TI 505 Ethernet device?
Error Descriptions
What error messages does the Simatic / TI 505 Ethernet driver produce?
Overview
The Simatic / TI 505 Ethernet Driver provides an easy and reliable way to connect Simatic / TI 505 Ethernet
devices to OPC client applications, including HMI, SCADA, Historian, MES, ERP, and countless custom
applications. It is intended for use in communicating with Simatic 505 Programmable Logic Controllers that may
be accessed via either the Siemens Simatic 505-CP2572 Ethernet module, the Siemens 505-CP1434-TCP card,
the Control Technology Inc. CTI CP2572 and CTI 2572-A Ethernet cards card, and a CTI 2500 Series CPU module.
The driver supports both TCP / IP and UDP transport protocols while using both CAMP and CAMP Packed Task
Code messaging protocols for efficient data transfer.
Note: The CTI 2500 Series CPUs are direct replacements for the legacy Simatic TI 500 / 505 CPUs.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 4
Device Setup
Supported Devices
CTI Interface Cards
CTI 2572, CTI 2572-A, and CP2572 Ethernet interface cards on TI series CPUs TI545, 555, and 565.
Simultaneous device connections are allowed. The model should be set to 505-CP2572. For more information,
refer to "Connection Limitations" below.
Supported Protocols
505: CAMP and CAMP Packed Task Code
IP: UDP and TCP / IP
Connection Timeout
This parameter specifies the time that the driver will wait for a connection to be made with a device. Depending
on network load, the connect time may vary with each connection attempt. The default setting is 3 seconds. The
valid range is 1 to 30 seconds.
Request Timeout
This parameter specifies the time that the driver will wait on a response from the device before giving up and
going on to the next request. Longer timeouts only affect performance if a device is not responding. The default
setting is 1000 milliseconds. The valid range is 100 to 30000 milliseconds.
Retry Attempts
This parameter specifies the number of times the driver will retry a message before giving up and going on to the
next message. The default setting is 3 retries. The valid range is 1 to 10.
Device IDs
Up to 2048 devices may be defined on a given channel. Each device on the channel must be uniquely identified
by its own IP address.
Connection Limitations
1. The default number of TCP connections allowed for the CTI 2572 / 2752-A and CP2572 cards is 8. When
configured from the PLC, this number may be set to a higher or lower number through the Start Network
Server command. In the CTI 2572 and CP2572 cards, this can be configured when started from PLC logic.
In the CTI 2572-A card, this can be configured when automatically started from EEPROM.
2. DIP Switch 3 in Switch Block 2 enables and disables the Data Share feature. When enabled, the number of
TCP server connections is automatically limited to two.
3. To connect to the PLC via the 505-CP1434-TCP card, configure a UDP Server Job in the card.
www. kepware.com
5 Simatic/TI 505 Ethernet Driver Help
Cable Diagrams
Communications Parameters
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 6
l Port Number: This parameter specifies the port number that the remote device is configured to use. The
default port number is 1505.
l IP Protocol: This parameter specifies whether the driver should connect to the remote device using the
User Datagram Protocol (UDP) or Transfer Control Protocol (TCP). This driver requires Winsock V1.1 or
higher.
Note: If the Simatic 505-CP1434-TCP card is being used, then a UDP server job must also be set up if
using the UDP IP Protocol (or a TCP server job if using the TCP IP Protocol). It is recommended that the
TCP IP Protocol have retries set to a greater value than the default setting of 3.
l Request Size: This parameter specifies the number of bytes that may be requested from a device at one
time. To refine this driver's performance, configure the request size to one of the following settings: 32,
64, 128, or 250 bytes. The default value is 250 bytes.
505 Protocol
l 505 Protocol: This parameter specifies whether the driver should use CAMP or CAMP+Packed Task Code
Protocol when communicating with devices. When set to CAMP, the driver will only use the CAMP Memory
Transfer protocol. When set to CAMP+Packed Task Code, the driver will use Packed Task Code when
possible in addition to CAMP Memory Transfer. The default value is CAMP+Packed Task Code.
Note: CAMP+Packed Task Mode will be used for C, X, and Y registers when TI565 is checked.
l TI565: This option should be checked when using a 565 model PLC to access C, X, and Y registers. The
default value is unchecked. For more information, refer to Common Data Type Addressing.
Note 1: Some address types, strings, and arrays are not supported under the Packed Task Code Protocol. For
more information, refer to "Packed Task Code Protocol" in Common Data Type Addressing.
Note 2: For best performance when using CAMP+Packed Task Code, the number of task codes per scan on the
PLC should be set to the maximum number available, which is typically 8. If using TISOFT, this may be set using
Aux Function 19.
www. kepware.com
7 Simatic/TI 505 Ethernet Driver Help
For applications where the data can be divided into large blocks, using CAMP memory transfer will result in the
most efficient data transfer. Note that, in one CAMP read, up to 125 words could be returned which could include
2000 discrete points. Since CAMP memory transfer allows only one data type and only one memory range per
message, applications which read many small blocks or many different data types may benefit from using the
Packed Task Code format.
For example, reading 10 V memory values, 10 WY values, 30 WX values and 2 loop process variables would
require four messages (one for the V, one for the WY, one for the WX and one for the loop). Using the packed task
code format (which allows 14 NITP task code requests to be placed in a single message), allows data to be
obtained in a single message.
2. Items that are not capable of utilizing Packed Task Code. This includes the following:
l Arrays
l Strings
l Address types that are not supported with Packed Task Code. For example, DCP.
l Contiguous address ranges > 36 Words. For example, V1, V2, V3, ... V36, V37, V38.
All items in Category 1 should be placed into a device that is set to CAMP+Packed Task Code 505 Protocol mode on
a different channel from Category 2 items. It is recommended that the request size be set to 64 or 128.
All items in Category 2 should be placed into a device that is set to CAMP 505 Protocol mode on a different channel
from Category 1 items. It is recommended that the Request Size be set to 250.
Note: When reading a project file prior to addition of 505 Protocol option, the default value is set to CAMP.
Addressing Options
0/1-Based Bit Addressing
Memory types that allow bit within Word (such as V) can be referenced as a Boolean. The addressing notations
for doing this are as follows:
<memory type><address>.<bit>
<memory type><address>:<bit>
<memory type><address>,<bit>
For each of these syntax, <bit> represents the bit number within the Word or DWord, depending on the memory
type. 0/1-Based bit addressing provides two ways of addressing a bit within the given Word or DWord; 0-Based
and 1-Based. 0-Based addressing means the first bit begins at 0. With 1-Based, the first bit begins at 1. The bit
order for the Word or DWord is irrelevant with this option. In other words, it doesn't matter whether the first bit
is the Most Significant Bit or the Least Significant Bit.
Note: In this driver, the first bit will either be bit 0 or bit 1 depending on this 0/1-Based bit addressing setting.
0-Based
This is the default setting.
1-Based
Note: 0/1-Based bit addressing does not apply to non-bit addresses such as Word addresses in V memory.
These addresses are always 1-Based and are not configurable.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 8
Note: For the following example, the 1st through 16th bit signifies either 0-15 bits or 1-16 bits depending on if
the driver is set at 0-Based bit addressing or 1-Based.
DWord follows the same bit order logic as Words except that there are 32 bits instead of 16.
MSB LSB
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
MSB LSB
16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
Note for CTI 2572/2572-A and CP2572: Bit 0/1 Is MSB corresponds to the TICVU I/O server and is not the
default setting with this OPC server. Select this option if applicable. Bit 0/1 Is LSB corresponds to the TI Direct
I/O server (TIDIR). Select this option to make the OPC server compatible with the TIDIR I/O server. For instance,
the TIDIR I/O server should be used as a backup in certain applications.
www. kepware.com
9 Simatic/TI 505 Ethernet Driver Help
Our server refers to communications protocols like Simatic / TI 505 Ethernet as a channel. Each channel defined
in the application represents a separate path of execution in the server. Once a channel has been defined, a
series of devices must then be defined under that channel. Each of these devices represents a single Simatic 505
controller from which data will be collected. While this approach to defining the application will provide a high
level of performance, it won't take full advantage of the Simatic / TI 505 Ethernet driver or the network. An
example of how the application may appear when configured using a single channel is shown below.
If the Simatic / TI 505 Ethernet driver could only define one single channel, then the example shown above would
be the only option available; however, the Simatic / TI 505 Ethernet driver can define up to 100 channels. Using
multiple channels distributes the data collection workload by simultaneously issuing multiple requests to the
network. An example of how the same application may appear when configured using multiple channels to
improve performance is shown below.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 10
Each device has now been defined under its own channel. In
this new configuration, a single path of execution is
dedicated to the task of gathering data from each device. If
the application has 100 or fewer devices, it can be optimized
exactly how it is shown here.
Block size, which is available on each defined device, can also affect the Simatic / TI 505 Ethernet driver's
performance. Block Size refers to the number of bytes that may be requested from a device at one time. To refine
the performance of this driver, configure Block Size to one of the following settings: 32, 64, 128, or 250 bytes.
Depending on the Simatic / TI 505 Ethernet device model, the Block Size setting can affect the application's
performance drastically. A default value of 250 bytes is recommended. If an application has large requests for
consecutively ordered data, however, block size should be increased.
www. kepware.com
11 Simatic/TI 505 Ethernet Driver Help
The driver interprets two consecutive registers as a floating-point value by making the
second register the high word and the first register the low word.
String Null-terminated ASCII string
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 12
Address Descriptions
Address specifications vary depending on the model in use. Select a link from the following list to obtain specific
address information for the model of interest.
Addressing
Common Data Type Addressing
Status Words
Addressing
The following sections define addressing. For information on the Event Log, refer the OPC server's help
documentation.
Note: The actual number of addresses available for of each type depends on the PLC's configuration. If the driver
finds at runtime that an address is not present in the device, it will post an error message and remove the tag
from its scan list.
www. kepware.com
13 Simatic/TI 505 Ethernet Driver Help
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 14
DWord, Float
System Status STW<address>.<bit> 1-65536 Boolean, Read/Write
Bit Access STW<address>:<bit> Bit 0/1-15/16 Short, Word
STW<address>,<bit> 0/1-Based Bit
Addressing
Timer/Counter Preset TCP<address> 1-65536 Short, Word Read/Write
1-65535 Long,
DWord, Float
Timer/Counter Current TCC<address> 1-65536 Short, Word Read/Write
1-65535 Long,
DWord, Float
Drum Step Preset DSP<address> 1-65536 Short, Word Read/Write
1-65535 Long,
DWord, Float
Drum Step Current DSC<address> 1-65536 Short, Word Read/Write
1-65535 Long,
DWord, Float
Drum Count Preset** DCP<drum>.<step> drum 1-65536 Short, Word Read/Write
DCP<drum>:<step> step 1-16
DCP<drum>,<step>
Drum Current Count DCC<address> 1-65536 Short, Word Read Only
1-65535 Long,
DWord, Float
*X, Y, and C memory types are supported on the 565 model controller by setting the TI565 checkbox in
Communications Parameters.
**DCP registers must be accessed in groups of 16 words. Therefore, when writing to a DCP register, the driver
performs a read to obtain the current values of all 16-word values (DCP00001.01 - DCP00001.16). The driver
modifies the one register that is being written to and sends the 16 values to the device. Since the driver performs
this read/modify/write procedure, it could be possible for any one of the registers to change between the read
and write transaction. The result would be a new value being written over by an older value. It is recommended
that users write to another type of memory location (such as Vxxxxx). If using a ladder, transfer the value to a
DCP register.
***For more information, refer to String Support.
Array Support
Non-Boolean addresses accept array notation. To view data as an array, append '[rows][cols]' to an address
(e.g., V500 [2][2], V100 [12]).
String Support
Standard String
The Simatic/TI 505 Ethernet driver supports reading and writing V registers as an ASCII string. When using V
registers for string data, each register will contain two bytes of ASCII data. The order of the ASCII data within a
given register can be selected when the string is defined. The length of the string can be from 2 to 250 bytes and
is entered in place of a bit number. The length must be entered as an even number. The byte order is specified
by appending either a "H" or "L" to the address.
Null Terminated
This type of string is a Standard String with LoHi byte order that is null terminated at all times. This means the
last byte will always be a null terminator, essentially losing one character place when compared to a Standard
String with LoHi byte order.
Length + String
This type of string is also a Standard String with LoHi byte order except the MSB of the first word contains the
desired length of the string to follow. This means one character place is lost when compared to a Standard String
with LoHi byte order. Based on this length, a string is formed up to the maximum size set by the address range
(ie. (<last word> - <first word>) / 2 - 1 bytes). The maximum length of the string can vary between the length
byte value and (<last word>-<first word>) / 2 - 1 bytes.
Note: Any null terminators in the string can cut the length short of these maximum lengths. If a string to be
written is less than this maximum length, it will be padded on the right with blank-spaces until all maximum
bytes contain a non-NULL value.
Blank-Padded on Right
www. kepware.com
15 Simatic/TI 505 Ethernet Driver Help
This type of string is a Standard String with LoHi byte order except the string length is always the maximum
because the string is padded with blank spaces on the right until its length becomes the maximum (no NULLs).
Recall the maximum length of the string is (<last word> - <first word>) / 2 bytes in the address. If a string to be
written is less than this maximum length, it too will be padded on the right with blank-spaces until all maximum
bytes contain a non-NULL value.
To address a null-terminated string starting at V200 with a length of 10 bytes and the memory data is as stated
above:
V200-204C would read "hello wor".
Note: Only 9 characters can be displayed because the last is the null terminator.
To address a string with length byte information, starting at V200 and the memory data is as stated above:
V200-204P would read "ello".
Note: The length byte is 0x04 so only 4 characters are displayed. If the length byte were 0x07, V200-204P
would read "ello wo".
To address a blank padded string starting at V200 with a length of 10 bytes and the memory data is as stated
above:
V200-204 would read "hello".
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 16
Note: All 10 characters are displayed with the null-terminated string "hello" padded with 5 spaces to fill the 5
words.
To write "world" to this address, the memory data would look as follows:
V200/MSB = 'w'
V200/LSB = 'o'
V201/MSB = 'r'
V201/LSB = 'l'
V202/MSB = 'd'
V202/LSB = ' '
V203/MSB = ' '
V203/LSB = ' '
V204/MSB = ' '
V204/LSB = ' '
V205/MSB = ' '
Since "world" is less than 10 characters in length, it is padded with blanks to become 10 characters in length.
Notes:
1. Packed Task Code Protocol will be used for writing address types X, Y, and C.
2. If the TI565 option is selected in Communications Parameters, Packed Task Code Protocol will be used for
reading and writing the X, Y, and C address types independent of the 505 Protocol setting.
3. Task Codes TC7F (Read Block) and TC5A (Write Block) are used.
Status Words
For all Status Words, Bit 1 is the Most Significant Bit (MSB) and Bit 16 is the Least Significant Bit (LSB) in order
from left to right. Users can configure bit addressing to be 0-15 or 1-16 addressing, and can also set the driver
to use 1 or 15 as the MSB (changing the bit referencing). For more information, refer to Addressing Options.
Note: Only addresses that are not used by the controller can be written.
CTI
Register Description CP525 CP545 CP565
2500
STW00001 Non-Fatal errors x x x x
www. kepware.com
17 Simatic/TI 505 Ethernet Driver Help
0 = Status is good.
1 = Base is not present or has a problem.
Bit 1, Base 15
Bit 2, Base 14
Bit 3, Base 13
Bit 4, Base 12
Bit 5, Base 11
Bit 6, Base 10
Bit 7, Base 9
Bit 8, Base 8
Bit 9, Base 7
Bit 10, Base 6
Bit 11, Base 5
Bit 12, Base 4
Bit 13, Base 3
Bit 14, Base 2
Bit 15, Base 1
Bit 16, Base 0
STW00003-00009 Profibus DP Slave Status x x x x
Each bit is 0 if a slave is present, or 1 if the slave is
missing or failed.
STW03 Bit 1-16 slave addresses 16-1
STW04 Bit 1-16 slave addresses 32-17
STW05 Bit 1-16 slave addresses 48-33
STW06 Bit 1-16 slave addresses 64-49
STW07 Bit 1-16 slave addresses 80-65
STW08 Bit 1-16 slave addresses 96-81
STW09 Bit 1-16 slave addresses 112-97
STW00010 Contains the value of the previous dynamic scan x x x x
time.
STW00011 Indicates the status of the modules in the Local x x x x
Base (Base 0). Each bit indicates a module in a
slot.
0 = Good
1 = Module not present or failed
Bit 1 - 16 = Module 16 - 1
STW00012-00026 Status bits for modules in bases 1 - 15, STW012 = x x x x
Base 1…
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 18
www. kepware.com
19 Simatic/TI 505 Ethernet Driver Help
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 20
www. kepware.com
21 Simatic/TI 505 Ethernet Driver Help
Checksum
STW00243 Reserved N/A N/A N/A x
STW00244 Additional Control Status Flags N/A N/A N/A x
Alarm Addressing
The driver supports the following addresses. The default data type for each address type is indicated in bold.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 22
Note: The actual number of addresses available for of each type depends on the PLC's configuration. If the driver
finds at runtime that an address is not present in the device, it will post an error message and remove the tag
from its scan list.
www. kepware.com
23 Simatic/TI 505 Ethernet Driver Help
Array Support
Non-Boolean addresses accept array notation. To view data as an array, append '[rows][cols]' to an address. For
example, V500 [2][2], V100 [12].
MSB LSB
ABCD EFGH IJKL MNOP
V/W, X/Y
V=0-based bit addressing. Bit 0 is MSB.
W=1-based bit addressing. Bit 1 is MSB (Simatic 505 documentation).
X=0-based bit addressing. Bit 0 is LSB.
Y=1-based bit addressing. Bit 1 is LSB.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 24
*Elements A and B are write-only triggers. Writing 1 to the triggers sets the mode. The mode (or status) is
reported in Element L (Bit 12).
**If a word is selected for the analog alarm V-flags, element L is written as bit 12 is written. If a C or Y is
selected, bit 12 (element L) is not used.
Note: If an analog alarm is programmed and not disabled, the controller will begin to monitor the programmed
variables as soon as the controller is placed in RUN mode.
MSB LSB
ABCD EFGH IJKL MNOP QRST UVWX YZab cdef
V/W, X/Y
V=0-based bit addressing. Bit 0 is MSB.
W=1-based bit addressing. Bit 1 is MSB (Simatic 505 documentation).
X=0-based bit addressing. Bit 0 is LSB.
Y=1-based bit addressing. Bit 1 is LSB.
www. kepware.com
25 Simatic/TI 505 Ethernet Driver Help
Loop Addressing
The driver supports the following addresses. The default data type for each address type is indicated in bold.
Note: The actual number of addresses available for of each type depends on the PLC's configuration. If the driver
finds at runtime that an address is not present in the device, it will post an error message and remove the tag
from its scan list.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 26
Array Support
Non-Boolean addresses accept array notation. To view data as an array, append '[rows][cols]' to an address. For
example, V500 [2][2], V100 [12].
MSB LSB
ABCD EFGH IJKL MNOP
V/W, X/Y
V=0-based bit addressing. Bit 0 is MSB.
W=1-based bit addressing. Bit 1 is MSB (Simatic 505 documentation).
X=0-based bit addressing. Bit 0 is LSB.
Y=1-based bit addressing. Bit 1 is LSB.
www. kepware.com
27 Simatic/TI 505 Ethernet Driver Help
*Elements A, B and C are write-only triggers. Write 1 to set the mode. The element will always show a value of 0
(zero).
**Elements D and E will indicate the mode that the loop is in. These elements are read only.
Note: Elements F through P are read only and indicate the error and alarm state that the loop is in.
MSB LSB
ABCD EFGH IJKL MNOP QRST UVWX YZab cdef
V/W, X/Y
V=0-based bit addressing. Bit 0 is MSB.
W=1-based bit addressing. Bit 1 is MSB (Simatic 505 documentation).
X=0-based bit addressing. Bit 0 is LSB.
Y=1-based bit addressing. Bit 1 is LSB.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 28
MSB LSB
ABCD EFGH IJKL MNOP
V/W, X/Y
V=0-based bit addressing. Bit 0 is MSB.
W=1-based bit addressing. Bit 1 is MSB (Simatic 505 documentation).
X=0-based bit addressing. Bit 0 is LSB.
Y=1-based bit addressing. Bit 1 is LSB.
www. kepware.com
29 Simatic/TI 505 Ethernet Driver Help
12/13
E 4/5, 1=Wait. This bit is set during a soak period when the PV is not within a specified
11/12 deviation from the SP. The loop holds the soak timer when bit 5 is set.
F 5/6, 1=Hold in progress at current step
10/11
G 6/7, Unused (always returned as 0)
9/10
H 7/8, Unused (always returned as 0)
8/9
I 8/9, Ramp/soak step number currently executing
7/8
J 9/10, Ramp/soak step number currently executing
6/7
K 10/11, Ramp/soak step number currently executing
5/6
L 11/12, Ramp/soak step number currently executing
4/5
M 12/13, Ramp/soak step number currently executing
3/4
N 13/14, Ramp/soak step number currently executing
2/3
O 14/15, Ramp/soak step number currently executing
1/2
P 15/16, Ramp/soak step number currently executing
0/1
Note 1: FFSTART is a driver internal tag (one per device) that is initialized to 1 on server startup. It has a write
range of 1->65536 and a write of values outside of this range will fail with an error message.
Note 2: If the starting address value in FFSTART is greater than the range for the Find Forced type issued, then
the read will fail with an "Address out of Range" error (Task Code error '02') and the quality of the tag will be set
to "Bad". For example, if FFSTART was set to a value of 65536 and a read of "FFC" was issued, the error generated
would look similar to the following due to C memory in the PLC only being configured for maximum value of
32768: "Device 'Channel1.Device1' detected a Task Code error '02' (Tag 'ffc', Size '256')."
Usage
1. Perform a write to FFSTART with the value of the starting address to be used for the Find Forced type in
Step 2.
Caution: Make sure that the value written is within the configured range for the type.
2. Perform a read using the Find Forced type selected. The read issues a command to the PLC asking it to
perform a search for any Forced discretes (C, X/Y) or words (WX/WY).
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 30
enough addresses are found to fill the output buffer. The search will cycle through all address types (C then X/Y
for discretes, WX/WY for words) for the command given.
If the search responds with the maximum number of addresses, then another request, beginning with the
address following the last forced address returned, must be issued to continue the search. This must be
repeated until the original starting address is reached to produce the complete list if a large number of addresses
are forced.
1. X/Y points reside in the same memory space (i.e. X1=Y1, X2=Y2, etc). The PLC will preferentially express
X/Y points using Y addresses unless the search is explicitly started using an X address. Using FFX versus
FFY lets users choose whether to have the results returned using an "X:address" format or a "Y:address"
format.
2. WX/WY words reside in the same memory space (i.e. WX1=WY1, WX2=WY2, etc). The PLC will
preferentially express WX/WY words using WY addresses unless the search is explicitly started using a
WX address. Using FFWX versus FFWY lets users choose whether to have the results returned using an
"WX:address" format or a "WY:address" format.
Examples
2. Read a tag named 'ffc', with an address of FFC. Value returned in data type of string:
"<Start Address 00600>C:00600,C:00601,Y:00001,Y:01024,C:00001,C:00002"
This example illustrates the algorithm by which the Find Forced search is performed. The search was started at
address C:00600 and it found two discretes forced at addresses C:00600,C:00601. It then proceeded to search
X/Y discretes where it found Y:00001,Y:01024 forced. Next, it looped back around to the start of C discretes and
found C:00001,C:00002 forced. Finally, it ended its search at C:00599 without finding any further forced
discretes.
Output Formats
where
SSSSS: value of FFSTART
Type: one of: C, X, Y, WX, WY
Address: fixed at five characters (00001 -> 65536)
Notes:
1. A minimum of 1 address is returned.
2. A maximum of 15 addresses are returned if each returned address uses a one word format.
3. If an address consumes two words (due to the address not being within the first page), then the
maximum output will be reduced by one for each two-word address. Users can determine if an address
will consume one word or two by using the following:
C - Addresses
1 through 512 = one word
Addresses 513 through 65536 = two words
X,Y,WX,WY - Addresses
1 through 1024 = one word
Addresses 1025 through 65536 = two words
4. A maximum of seven addresses are returned if each returned address consumes two words.
5. The final output is independent of the address being returned in a one word or two word format.
www. kepware.com
31 Simatic/TI 505 Ethernet Driver Help
Error Descriptions
The following messages may be generated. Click on the link for a description of the message.
See Also:
Task Error Codes
Possible Cause:
A tag address that has been specified dynamically references a location that is beyond the range of supported
locations for the device.
Solution:
Verify the address is correct; if it is not, re-enter it in the client application.
Possible Cause:
A tag address that has been specified dynamically is requesting an array size that is too large for the address
type or block size of the driver.
Solution:
Re-enter the address in the client application to specify a smaller value for the array or a different starting point.
Possible Cause:
A tag address that has been specified dynamically contains an array reference for an address type that doesn't
support arrays.
Solution:
Re-enter the address in the client application to remove the array reference or correct the address type.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 32
Possible Cause:
A tag address that has been specified dynamically has been assigned an invalid data type.
Solution:
Modify the requested data type in the client application.
Possible Cause:
A tag address that has been specified dynamically contains one or more invalid characters.
Solution:
Re-enter the address in the client application.
Possible Cause:
A tag address that has been specified dynamically has a requested access mode that is not compatible with what
the device supports for that address.
Solution:
Change the access mode in the client application.
Possible Cause:
The device is unable to return the amount of read data requested in one request.
Solution:
Adjust the requested block size on the device so that the driver makes smaller requests.
Possible Cause:
The device is unable to receive the amount of write data sent in one request.
Solution:
Adjust the array size on the address so that a smaller amount of data is sent to the device in one transaction.
Device <device name> detected a NITP protocol error (tag <address>, size
<size>).
Error Type:
Serious
Possible Cause:
This error may occur when sending Packed Task Code messages. The device is experiencing network errors.
www. kepware.com
33 Simatic/TI 505 Ethernet Driver Help
Solution:
Check network connections.
Device <device name> detected a Task Code error <error> (tag <address>,
size <size>).
Error Type:
Serious
Possible Cause:
This error may occur when sending Packed Task Code messages.
The device is experiencing network errors or PLC encountered an error when processing a task code.
Solution:
See Also:
Task Error Codes
Device <device name> input queue is full. The module is receiving requests
faster than it can process requests.
Error Type:
Serious
Possible Cause:
The device is handling requests from more than one PC at a time.
Solution:
Using the device programming software, make sure that the "task codes per scan time" parameter is set to 8.
Adjusting the scan time may also improve device performance. It is recommended that users set the scan time to
Variable. For more information on adjusting these settings, refer to the device's documentation.
Possible Cause:
3. The response from the device took longer to receive than the amount of time specified in the "Request
Timeout" device setting.
Solution:
2. Verify that the IP address given to the named device matches that of the actual device.
3. Increase the Request Timeout setting so that the entire response can be handled.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 34
Possible Cause:
The device is unable to receive the amount of write data sent in one request.
Note:
This error is used for extended error information by some error responses.
See Also:
Device <device name> cannot execute a write request (<address>, <size>).
Device <device name>, write value not in range 1-->65536. (Tag 'FFSTART').
Error Type:
Warning
Possible Cause:
Value written outside of range specified.
Solution:
Write a value in the range of 1-65536.
Missing address.
Error Type:
Warning
Possible Cause:
A tag address that has been specified dynamically has no length.
Solution:
Re-enter the address in the client application.
Possible Cause:
Solution:
2. Verify that the IP address given to the named device matches that of the actual device.
Winsock V1.1 or higher must be installed to use the Simatic / TI 505 Ethernet
device driver.
Error Type:
Fatal
www. kepware.com
35 Simatic/TI 505 Ethernet Driver Help
Possible Cause:
The version number of the Winsock DLL found on the system is less than 1.1.
Solution:
Upgrade Winsock to version 1.1 or higher.
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 36
Code Description
02 Address out of range (other than ladder logic).
03 Requested data not found.
04 Illegal task code request (such as "Task Code not supported").
05 Request exceeds program memory size (ladder logic).
07 Fatal error detected.
09 Incorrect amount of data sent with request.
0C Attempted write operation did not verify.
0D Illegal number of ASCII characters received.
0E Illegal write to program memory (Non Volatile).
11 Invalid data sent with the command.
16 Attempted write to a Protected Variable (such as TCC and TCP).
17 No response from PLC (such as, "Single Scan not performed").
18 Requested memory size exceeds total available memory.
19 Requested memory size is not a multiple of block allocation size.
1A Requested memory size is less than minimum defined value.
1B Requested memory size is larger than maximum defined value.
1C PLC busy - cannot complete the requested operation.
3F Bus error detected.
40 Operating system error detected.
4A Attempt to access an integer only variable as a real.
4B Attempt to access a real. Only value as an integer.
4C Task code buffer overflow. Too much data requested.
4E Attempt to write a read-only variable.
4F Invalid variable type for this operation.
50 Task code request buffer too large. PLC internal error.
www. kepware.com
37 Simatic/TI 505 Ethernet Driver Help
Index
505 Protocol 6
Boolean 11
Cable Diagrams 5
CAMP 6
Common Data Type Addressing 12
Communications Parameters 5
Error Descriptions 31
www. kepware.com
Simatic/TI 505 Ethernet Driver Help 38
Missing address. 34
Network 4
NITP 7
Short 11
Status Words 16
www. kepware.com
39 Simatic/TI 505 Ethernet Driver Help
www. kepware.com