indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
Qualified Personnel
personnel qualified
Proper use of Siemens products
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
Disclaimer of Liability
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
The product/system described in this documentation may be operated only by
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Note the following:
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
for the specific
01/2015 Subject to change
Page 3
Preface
Validity of this manual
CP 1243-1 PCC
This document contains information on the following product:
●
Article number6GK7 243-1HX30-0XE0
Hardware product version 2
Firmware version V2.0
The CP 1243-1 PCC for Plant Cloud Communication / Data Driven Services is the
communications processor for connecting the SIMATIC S7-1200 via a public
infrastructure (e.g. DSL) to an operation center.
The integrated Plant Cloud Communication of the CP for connection and transfer of data
values to a operation center can be used for the service offer of Industry Services, e.g.
Asset Analytics Services. Communication with other cloud servers is not supported.
Information on Asset Analytics and Industry Services:
Asset Analytics (http://support.automation.siemens.com/WW/view/en/92377679)
Industry Services (http://www.industry.siemens.com/services)
The CP transfers the required data to the communications partner, the operation center.
To obtain a prediction of the status of your system or your devices, the operation center
collects and analyzes the transferred data.
With the help of a firewall, the CP allows protected access to the S7-1200.
The CP can also be used as an additional interface of the CPU for S7 communication.
Behind the top hinged cover of the module housing, you will see the hardware product
version to the right of the article number printed as a placeholder "X". If the printed text is, for
example, "1 X 3 4", "X" would be the placeholder for hardware product version 2.
You will find the firmware version of the CP as supplied behind the top hinged cover of the
housing to the left below the LED field.
You will find the MAC address under the lower hinged cover of the housing.
●
This abbreviation will be used below instead of the full term "Plant Cloud in the operation
center".
●
The term "CP" is used below instead of the full product name CP 1243-1 PCC.
●
This short form will be used below for the STEP 7 Basic / Professional configuration tool.
This manual describes the properties of this module and supports you when installing and
commissioning it.
The required configuration steps are described as an overview and there are explanations of
the relationship between firmware functions and configuration.
You will also find information about the diagnostics options of the device.
You will also find the current version of this manual on the Internet pages of Siemens
Industry Online Support in the directory with following entry ID:
Read the license conditions for open source software carefully before using the product.
Security information
Firmware
Training, Service & Support
Trademarks
You will find license conditions in the following documents on the supplied data medium:
● DOC_OSS-S7CMCP_74.pdf
● DOC_OSS-CP1243-1-PCC_76.pdf
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, solutions, machines, equipment and/or networks. They are
important components in a holistic industrial security concept. With this in mind, Siemens’
products and solutions undergo continuous development. Siemens recommends strongly
that you regularly check for product updates.
For the secure operation of Siemens products and solutions, it is necessary to take suitable
preventive action (e.g. cell protection concept) and integrate each component into a holistic,
state-of-the-art industrial security concept. Third-party products that may be in use should
also be considered. For more information about industrial security, visit
http://www.siemens.com/industrialsecurity.
To stay informed about product updates as they occur, sign up for a product-specific
newsletter. For more information, visit http://support.automation.siemens.com.
The firmware is signed and encrypted. This ensures that only firmware created by Siemens
can be downloaded to the device.
You will find information on Training, Service & Support in the multi--language document
"DC_support_99.pdf" on the data medium supplied with the documentation.
The following and possibly other names not identified by the registered trademark sign ® are
registered trademarks of Siemens AG:
SIMATIC, SIMATIC NET, SIMATIC STEP 7, SCALANCE, Operation Center
A Approvals ............................................................................................................................................. 63
B Dimension drawings .............................................................................................................................. 67
C Documentation references .................................................................................................................... 69
Index .................................................................................................................................................... 71
5.8.2 Filtering of the system events ................................................................................................ 39
The CP is intended for operation in an S7-1200 automation system. The CP allows
connection of the S7-1200 to Industrial Ethernet or via the Internet to a plant cloud in the
operation center.
With the combination of different security functions such as firewall and protocols for data
encryption, the CP protects the station and even entire automation cells from unauthorized
access and protects the communication between the remote S7 station and the operation
centerfrom espionage and manipulation.
To transfer data values of the CP regularly, e.g. diagnostics or maintenance data, to an
operation center:
● Set up the Plant Cloud Communication to one or two operation centers.
To obtain a prediction of the status of your system or your devices:
● Have the transferred data analyzed using this remote computing center/server of the
operation center.
To call up the analyzed data, you have the following options available:
● Direct access to the analyzed data.
● Within the framework of a service contract, you receive regular reports about the status of
your system or your devices.
Remember the following requirements in the CP configuration for Plant Cloud
Communication:
● Activation of Plant Cloud Communication ("Communication types" parameter group).
● IP address assignment: Set the IP address manually or obtain the IP address from a
Due to the data point configuration in STEP 7, programming program blocks in order to
transfer the process data is unnecessary. The individual data points are processed 1:1 in
the operation center.
●
The essential features of IP configuration for the CP:
– The CP supports IP addresses according to IPv4 and IPv6.
For applications in IPv6 networks, an IPv6 address can be used in addition to an IPv4
address.
– IP address assignment:
The IP address, the subnet mask and the address of a gateway can be set manually
in the configuration.
As an alternative, the IP address can be obtained from a DHCP server or by other
means outside the configuration.
●
– If Plant Cloud Communication is enabled, the CP can obtain its local time as UTC time
from the operation center or using NTP or NTP (secure). The time of day can be read
from the CPU. For the communication with an operation center, give preference to the
secure method NTP (secure). The mechanisms are described in the STEP 7
information system.
For information on the format of the time stamp, refer to the section Datapoint types
(Page 33).
For more information, refer to the section Time-of-day synchronization (Page 40).
●
If a connection fails, the CP can buffer the data of events of different classes and transfer
them bundled to the operation center.
●
The Plant Cloud Communication with the operation center is started in the following way:
– Triggered by various selectable criteria.
●
Analog values can be preprocessed on the CP according to various methods.
From an engineering station (ES) on which STEP 7 is installed, you can use the online
functions of STEP 7 via the CP to access the S7-1200 CPU if the station is located in the
same IP subnet. Online access via the operation center is not possible.
The following online functions are available:
– Downloading project or program data from the STEP 7 project to the station.
– Querying diagnostics data on the station.
– Downloading firmware files to the CP.
●
As an SNMP agent, the CP supports data queries using SNMP (Simple Network
Management Protocol) in version V1.
For more detailed information, refer to section SNMP (Page 41).
With Industrial Ethernet Security, individual devices, automation cells or network segments
of an Ethernet network can be protected. The data transfer via the CP can be protected from
the following attacks by a combination of different security measures:
● Data espionage
● Data manipulation
● Unauthorized access
Secure underlying networks can be operated via additional Ethernet/PROFINET interfaces of
the CPU.
The CP supports the following security functions:
●
– IP firewall with stateful packet inspection (layer 3 and 4)
– Firewall also for "non-IP" Ethernet frames according to IEEE 802.3 (layer 2)
– Limitation of the transmission speed ("Bandwidth limitation")
– Global firewall rules
●
Secure communication with one or two operation centers.
●
To allow monitoring, events can be stored in log files that can be read out using the
configuration tool or can be sent automatically to a Syslog server.
Note
Plants with security requirements - recommendation
Use the following options:
•
•
1.5
Configuration limits and performance data
Number of CMs/CPs per station
Connection resources
TCP connections
Online functions
S7 connections
PG/OP connections
1.5 Configuration limits and performance data
●
For secure transfer during time-of-day synchronization
●
The protection provided by the firewall can cover individual devices, several devices or
even entire network segments.
If you have systems with high security requirements, use the secure protocols
NTP (secure) and HTTPS.
If you connect to public networks, you should use the firewall. Think about the services
you want to allow access to the station via public networks. By using the "bandwidth
limitation" of the firewall, you can restrict the possibility of flooding and DoS attacks.
For information on configuring the security functions, refer to the section Security functions
(Page 39).
You will find further information on the functionality and configuration of the security functions
in the information system of STEP 7 and in the manual /2/ (Page 70).
In each S7-1200 station, up to three CMs/CPs can be plugged in and configured; this allows
three CP 1243-1 PCC modules.
●
The CP can establish connections to up to 8 communications partners (S7 stations).
●
1 connection resource is reserved for online functions.
●
8 connection resources for S7 connections (PUT/GET)
Number of data points for the data point configuration
User data
Frame memory (send buffer)
Firewall rules
1.5 Configuration limits and performance data
The maximum number of configurable data points is 200.
The data to be transferred by the CP is assigned to various data points in the STEP 7
configuration.
The size of the user data per data point depends on the data type of the relevant data point.
You will find details in the section Datapoint types (Page 33).
The CP has a frame memory (send buffer) for the values of data points configured as an
event.
The send buffer has a maximum size of 64 000 events divided into equal parts for all
configured communications partners. The size of the frame memory can be set in STEP 7,
refer to the section Communication with the CPU (Page 47).
You will find details of how the send buffer works (storing and sending events) as well as the
options for transferring data in the section Types of transmission, event classes, triggers,
status identifiers (Page 36).
The maximum number of firewall rules in advanced firewall mode is limited to 256.
The firewall rules are divided up as follows:
● Maximum 226 rules with individual addresses
● Maximum 30 rules with address ranges or network addresses
(e.g. 140.90.120.1 - 140.90.120.20 or 140.90.120.0/16)
● Maximum 128 rules with limitation of the transmission speed ("Bandwidth limitation")
Location of the display elements and the electrical connectors
Opening the covers of the housing
The LEDs for the detailed display of the module statuses are located behind the upper cover
of the module housing.
The Ethernet connector is located behind the lower hinged cover of the module.
Open the upper or lower cover of the housing by pulling it down or up as shown by the
arrows in the illustration. The covers extend beyond the housing to give you a grip.
Note the following safety notices when setting up and operating the device and during all
associated work such as installation, connecting up or replacing the device.
If power is supplied to the module or station over longer power cables or networks, the
coupling in of strong electromagnetic pulses onto the power supply cables is possible. This
can be caused, for example by lightning strikes or switching of higher loads.
The connector of the external power supply is not protected from strong electromagnetic
pulses. To protect it, an external overvoltage protection module is necessary. The
requirements of EN61000-4-5, surge immunity tests on power supply lines, are met only
when a suitable protective element is used. A suitable device is, for example, the Dehn
Blitzductor BVT AVD 24, article number 918 422 or a comparable protective element.
The equipment is designed for operation with Safety Extra-Low Voltage (SELV) by a
Limited Power Source (LPS).
This means that only SELV / LPS complying with IEC 60950-1 / EN 60950-1 / VDE 0805-1
must be connected to the power supply terminals. The power supply unit for the equipment
power supply must comply with NEC Class 2, as described by the National Electrical Code
(r) (ANSI / NFPA 70).
If the equipment is connected to a redundant power supply (two separate power supplies),
both must meet these requirements.
DO NOT CONNECT OR DISCONNECT EQUIPMENT WHEN A FLAMMABLE OR
COMBUSTIBLE ATMOSPHERE IS PRESENT.
SUBSTITUTION OF COMPONENTS MAY IMPAIR SUITABILITY FOR CLASS I, DIVISION
2 OR ZONE 2.
The device may only be operated in an environment with pollution degree 1 or 2 (see
IEC 60 664-1).
When used in hazardous environments corresponding to Class I, Division 2 or Class I,
Zone 2, the device must be installed in a cabinet or a suitable enclosure.
General notices on use in hazardous areas according to ATEX
WARNING
Requirements for the cabinet/enclosure
WARNING
WARNING
4.1.3
Notices regarding use in hazardous areas according to UL HazLoc
WARNING
EXPLOSION HAZARD
4.1 Important notes on using the device
To comply with EU Directive 94/9 (ATEX95), the enclosure or cabinet must meet the
requirements of at least IP54 in compliance with EN 60529.
If the cable or conduit entry point exceeds 70 °C or the branching point of conductors
exceeds 80 °C, special precautions must be taken. If the equipment is operated in an air
ambient in excess of 50 °C, only use cables with admitted maximum operating temperature
of at least 80 °C.
Take measures to prevent transient voltage surges of more than 40% of the rated voltage.
This is the case if you only operate devices with SELV (safety extra-low voltage).
DO NOT DISCONNECT WHILE CIRCUIT IS LIVE UNLESS AREA IS KNOWN TO BE
NON-HAZARDOUS.
This equipment is suitable for use in Class I, Division 2, Groups A, B, C and D or nonhazardous locations only.
This equipment is suitable for use in Class I, Zone 2, Group IIC or non-hazardous locations
only.
Read the system manual "S7-1200 Programmable Controller"
Pulling/plugging the module
NOTICE
Turning off the station when plugging/pulling the module
4.2 Installing, connecting up and commissioning
Prior to installation, connecting up and commissioning, read the relevant sections in the
system manual "S7-1200 Programmable Controller", refer to the documentation in the
Appendix.
When installing and connecting up, keep to the procedures described in the system manual
"S7-1200 Programmable Controller".
Before pulling or plugging the module, always turn off the power supply to the station.
* Width B: The distance between the edge of the housing and the center of the hole in the DIN rail mounting clip
DIN rail clamps, control panel installation
4.2 Installing, connecting up and commissioning
Figure 4-1 Dimensions for installation of the S7-1200
Table 4- 1 Dimensions for installation (mm)
CPU (examples)
Communications interfaces (examples)
You will find detailed dimensions of the module in the section Dimension drawings
(Page 67).
All CPUs, SMs, CMs and CPs can be installed on the 35 mm DIN rail in the cabinet. Use the
pull-out DIN rail mounting clips to secure the device to the rail. These mounting clips also
lock into place when they are extended to allow the device to be installed in a switching
panel. The inner dimension of the hole for the DIN rail mounting clips is 4.3 mm.
The module must be installed so that its upper and lower ventilation slits are not covered,
allowing adequate ventilation. Above and below the device, there must be a clearance of 25
mm to allow air to circulate and prevent overheating.
Remember that the permitted temperature ranges depend on the position of the installed
device.
Horizontal installation of the rack:
-20 °C to +70 °C
Vertical installation of the rack:
-20 °C to +60 °C
One requirement for the commissioning of the module is the completeness of the STEP 7
project data (see below, step 5).
Installing, connecting up and commissioning the module
Note
Connection with power off
Only wire up the S7
Step
What to do
Notes and explanations
1
The slots to the left of the CPU are permitted.
2
Secure the DIN rail.
3
specifications (Page 61).
4
Turn on the power supply.
5
6
them closed during operation.
4.2 Installing, connecting up and commissioning
-1200 with the power turned off.
Table 4- 2 Procedure for installation and connecting up
Mount the CP on the DIN rail and connect it to
the module to its right.
Connect the Ethernet cable to the CP. You will find the pinout of the interface in the section Technical
The remaining steps in commissioning involve
downloading the STEP 7 project data.
Close the front covers of the module and keep
Use a 35 mm DIN rail.
The STEP 7 project data of the CP is transferred when you
load to the station. To load the station, connect the engineering station on which the project data is located to the Ethernet
interface of the CPU.
You will find more detailed information on loading in the following sections of the STEP 7 information system:
Requirement for configuring the Plant Cloud Communication
To ensure interference-free operation, keep the front panels of the module closed during
operation.
You configure the modules and networks in SIMATIC STEP 7. You will find the required
version in the section Software requirements (Page 15).
You can configure a maximum of three CMs/CPs per station.
The current online help topics dealing with the CP and the security functions are available in
the STEP 7 information system under the entry "Support Packages".
One requirement for configuring communication between CP and operation center is the
programming of the assigned CPU and the input and output data of the station.
PLC tags must also be created to assign the user data to be transferred to the data points.
When assigning the PLC tags to your communications partners, you can select both
operation centers.
For more detailed information, refer to the following sections.
Required information for the Plant Cloud Communication
Overview of the configuration steps in STEP 7
5.2 Configuration in STEP 7
The following information is required for the STEP 7 configuration of the CP:
● Address of the operation center
The URL address of the operation center.
● DNS server address(es)
You require the DNS server address if you address the operation center using a name
that can be resolved by DNS and the DNS is not operated by the network provider. You
configure DNS in the parameter group "DNS configuration":
– If you do not specify an address, the DNS server address is obtained automatically
from the network provider (recommended procedure).
– If you want to use a different DNS server, enter its IP address. In this case, DNS
servers of the network provider are not taken into account.
Follow the steps below when configuring:
1. Create a STEP 7 project.
2. Insert the required SIMATIC stations.
3. Insert the CPs and the required input and output modules in the stations.
4. Create an Ethernet network.
5. Connect the stations to the Ethernet subnet.
6. Configure the inserted CPs.
7. Save and compile the project.
8. Download the project data to the stations.
Using the "Download to device" function, the STEP -7 project data including the
configuration data of the CPs is downloaded to the relevant CPU.
You will find further information on the individual steps in the following sections and in the
help system of STEP 7.
Address and authentication information for the Plant Cloud Communication
Parameters in the "Operation center" parameter group
Parameters in the "Security" -> "Operation center" parameter group
Importing the certificate with encrypted transfer
5.3 Address and authentication information
Since the CP always establishes the connection to the operation center, a dynamic IP
address can be assigned to the CP by the Internet service provider.
The following information is required for the STEP 7 configuration of the CP for the
Plant Cloud Communication with the operation center :
● Operation center address
URL address via which the operation center is connected to the Internet.
● Operation center number
The operation center number for the relevant operation center is assigned automatically
by the system when Plant Cloud Communication is enabled.
● Operation center key
You obtain the Operation center key from the operator of the operation center. Copy the
key to the input box "Operation center key".
To be able to use encrypted transfer, you need to load the relevant certificate in the
certificate manager of STEP 7. You receive the certificate from the provider of the operation
center.
To import the certificate, follow these steps:
1. Save the certificate from your operation center operator in the file system of the
engineering station.
2. In STEP 7, select the entry "Global security settings > Certificate manager" in the "Project
tree".
3. Change to the "Trusted certificates and root certification authorities" tab.
4. Select any row in the table "Trusted certificates and root certification authorities".
5. Select the "Import" entry in the shortcut menu.
6. In the dialog that follows, select the required certificate.
Requirement: Created PLC tags and/or data blocks (DBs)
Note
Number of PLC tags
Remember the maximum possible number of PLC tags the can be used for data point
configuration in the section
Access to the memory areas of the CPU
5.4 Configuring data points and messages
No program blocks need to be programmed for the CP to transfer user data between the
station and communications partner. The data areas in the memory of the CPU intended for
communication with the partner are configured data point-related on the CP. Each data point
is linked to a PLC tag or a data block on the CPU.
PLC tags or DBs must first be created in the CPU program to allow configuration of the data
points.
The PLC tags for data point configuration can be created in the standard tag table or in a
user-defined tag table. All PLC tags intended to be used for data point configuration must
have the attribute "Visible in HMI".
Address areas of the PLC tags are input, output or bit memory areas on the CPU.
The formats and S7 data types of the PLC tags that are compatible with the protocol-specific
data point types of the CP can be found in the section Datapoint types (Page 33).
The values of the PLC tags or DBs referenced by the data points are read and transferred to
the communications partner by the CP.
Data received from the communications partner is written by the CP to the CPU via the PLC
tags or DBs.
Configuration limits and performance data (Page 13).
Configuring the data points and messages in STEP 7
5.5
Datapoint types
5.5 Datapoint types
You configure the data points in STEP 7 in the editor for the data point and message
configuration. You can find this using the project tree:
Project > directory of the relevant station > Local modules > CP 1200
Figure 5-1 Configuring data points and messages
You will find more information on configuration in the following sections and in the STEP 7
information system.
During the configuration of the user data to be transferred by the CP, each data point is
assigned a protocol-specific data point type. The data point types supported by the CP along
with the compatible S7 data types are listed below. They are grouped according to format
(memory requirements).
Note
Plant Cloud in the operation center cannot process ARRAY
The Plant Cloud in the operation center does not support the ARRAY
this data type are discarded by the operation center. Make sure that you take this into
account in the configuration of the data points.
Format (memory requirements)
Data point type
S7 data types
Address area
Bit
Digital input
BOOL
I, Q, M, DB
Byte
Digital input
BYTE
I, Q, M, DB
Integer with sign (16 bits)
Analog input
INT
I, Q, M, DB
Counter (16 bits)
Counter input
WORD, UINT
I, Q, M, DB
Integer with sign (32 bits)
Analog input
DINT
I, Q, M, DB
Counter (32 bits)
Counter input
DWORD, UDINT
I, Q, M, DB
Floating-point number
with sign (32 bits)
Floating-point number
with sign (64 bits)
Block of data (1 ... 64
bytes)
1)
For the possible formats of the ARRAY data type, refer to the following section.
Block of data (ARRAY)
Time stamp in UTC format
5.5 Datapoint types
data type. Transfers of
Table 5- 1 Supported data point types and compatible S7 data types
Analog input REAL Q, M, DB
Analog input LREAL Q, M, DB
Data ARRAY 1) DB
With the ARRAY data type, contiguous memory areas up to a size of 64 bytes can be
transferred.
Compatible components of ARRAY are the following uniform S7 data types with a size
between 1 and 32 bytes:
● BYTE, CHAR (in total up to 64 times per block of data)
● INT (in total up to 32 times per block of data)
● DINT, UDINT (in total up to 16 times per block of data)
If the array is modified later, the data point must be recreated.
Time stamps are transferred in UTC format (48 bits) and contain the time difference in
milliseconds since 01.01.1970.
The cycle (including the pause) with which the CP scans the memory area of the CPU is
made up of the following phases:
●
For data points of the type "Input", which are configured with the "High priority" setting in
the data point configuration in "General > Priority in the scan cycle", the PLC tags are all
read in one scan cycle.
●
In every cycle, the values of a certain number of unsolicited write jobs are written to the
CPU. The number of tags written per cycle is specified for the CP in the "Communication
with the CPU" parameter group with the "Max. number of write jobs" parameter. The tags
whose number exceeds this value are then written in the next or one of the following
cycles.
●
For data points of the type "Input", which are configured with the "Low priority" setting in
the data point configuration in "General > Priority in the scan cycle", the values of a part
of the PLC tags are read in every scan cycle.
The number of tags read per cycle is specified for the CP in the "Communication with the
CPU" parameter group with the "Max. number of read jobs" parameter. The tags that
exceed this value and can therefore not be read in one cycle are then read in the next or
one of the following cycles.
●
This is the waiting time between two scan cycles. It is used to reserve adequate time for
other processes that access the CPU via the backplane bus of the station.
Since no fixed time can be configured for the cycle and since the individual phases cannot
be assigned a fixed number of objects, the duration of the scan cycle is variable and can
change dynamically.
Types of transmission, event classes, triggers, status identifiers
Classification of the data points and storage of the values
No event (static value)
Event
The image memory
The send buffer
5.7 Types of transmission, event classes, triggers, status identifiers
The values of data points are stored in the image memory of the CP and transferred only
when called by the operation center. Events are also stored in the send buffer and can be
transferred unsolicited. All data points are therefore classified as follows:
●
●
All the current values of the configured data points are stored in the image memory. New
values of a data point overwrite the last stored value in the image memory.
The values are sent after being queried by the communications partner. Refer to "Transfer
after call" in the section "Types of transmission".
The send buffer is the data buffer on the CP for storing the values of events. The send buffer
has a maximum size of 64 000 events. The configured number of events is divided equally
among all configured and enabled communications partners. The "Data buffer size"
parameter for the size of the send buffer is described in the section Communication with the
CPU (Page 47).
Data points that are not configured as an event ("Transfer after call") are entered in the
image memory (process image of the CP).
The values of data points configured as an event are also entered in the image memory
of the CP. The value of the event is sent unsolicited to the operation center.
The values of events are also entered in the send buffer of the CP.
If a connection to a communications partner is interrupted, the values of the events are
retained in the buffer. When the connection returns, the buffered frames are sent.
The frame memory operates chronologically; in other words, the oldest frames are sent first
(FIFO principle). When the maximum number of events is reached and the frames could not
be sent, the oldest values are overwritten.
Resetting the trigger bit in the bit memory area / DB
5.7 Types of transmission, event classes, triggers, status identifiers
Depending on your CP type, you have the following transmission types available:
●
The current value of the data point is entered in the image memory of the CP. New
values of a data point overwrite the last stored value in the image memory.
After being called by the communications partner, the current value at the time is
transferred.
●
The value is entered in the send buffer as an event and transferred unsolicited to the
communications partner when the trigger fires.
You will find details of the event classes and triggers in the following sections.
The type of transmission is specified for each data point in the data point configuration in
STEP 7 with the "Type of transmission" or "Event class" parameter.
The process data of the various event classes is handled as follows:
●
Each value change is entered in the send buffer in chronological order.
●
Only the current value at the time the trigger condition was met is entered in the image
memory and overwrites the last value stored there.
Various trigger types are available for starting event-driven transfer:
●
The value of the data point is transferred when this reaches a certain threshold. The
threshold is calculated as the difference compared with the last stored value, refer to the
section Threshold value trigger (Page 52).
●
The value of the data point is transferred at configurable intervals or at a specific time of
day.
●
The value of the data point is transferred when a configurable trigger signal is fired. For
the trigger signal, the edge change (0 → 1) of a trigger bit is evaluated that is set by the
user program. When necessary, a separate trigger bit can be configured for each data
point.
If the memory area of the trigger bit is in the bit memory or in a data block, the trigger bit is
reset to zero when the data point is transferred.
Generation of events if a data point status changes
Status IDs of data points
Bit
7 6 5 4 3 2 1
0
Flag name
EXISTENT
Meaning
ble
Bit status
(always 0)
1 1 1 1 1 1 1
5.7 Types of transmission, event classes, triggers, status identifiers
With data points that were configured as an event, the change to the status bit of the status
identifiers described below also leads to an event being generated.
Example: If the status "RESTART" of a data point configured as an event changes to "Value
updated" when the station starts up, this causes an event to be generated.
The status IDs listed in the following tables are transferred for each data point in each frame
in 1 byte.
The meaning relates to the bit status in the last row of each table.
Table 5- 2 Byte assignment of the status byte for data points
- NON_
- Data point
does not
exist or S7
address
unreacha-
Firewall sequence when checking incoming and outgoing frames
5.8.1.2
Notation for the source IP address (advanced firewall mode)
5.8.2
Filtering of the system events
Communications problems if the value for system events is set too high
5.8 Security functions
Note the range and application of the security functions of the CP, refer to the section Other
services and properties (Page 11).
Each incoming or outgoing frame initially runs through the MAC firewall (layer 2). If the frame
is discarded at this level, it will not be checked by the IP firewall (layer 3). This means that
with suitable MAC firewall rules, IP communication can be restricted or blocked.
If you specify an address range for the source IP address in the advanced firewall settings of
the CP, make sure that the notation is correct:
● Separate the two IP addresses only using a hyphen.
Correct: 192.168.10.0-192.168.10.255
● Do not enter any other characters between the two IP addresses.
Incorrect: 192.168.10.0 - 192.168.10.255
If you enter the range incorrectly, the firewall rule will not be used.
If the value for filtering the system events is set too high, you may not be able to achieve the
maximum performance for the communication. The high number of output error messages
can delay or prevent the processing of the communications connections.
In "Security > Log settings > Configure system events", set the "Level:" parameter to the
value "3 (Error)" to ensure the reliable establishment of the communications connections.
Note
Special feature of time-of-day synchronization using NTP
If the "Accept time from non
accepts the
If the option is disabled, the response is as follows:
If the CP receives a time of day frame from an unsynchronized NTP server with stratum
16, the time of day is not set according
servers is displayed as "NTP master" in the diagnostics; but rather only as being
"reachable".
NTP (secure) with security functions enabled
Note
Ensuring a valid time of day
If you use security
use the NTP
Configuration
5.9 Time-of-day synchronization
The CP supports the three methods of time-of-day synchronization:
● Time from partner
In this case, the time of day is synchronized by the operation center. This method is
enabled automatically if the Plant Cloud Communication and Security functions are
enabled in "Communication types" in STEP 7.
To be able to receive the time of day from the operation center, "Operation center" and
"Operation centers" need to be fully configured.
● NTP or NTP (secure)
If Plant Cloud Communication is disabled, the time of day can only be synchronized using
NTP or NTP (secure). Here, configure the synchronization mode, the local time zone of
the station, the synchronization interval and the addresses of the NTP servers.
time from NTP servers that are not directly synchronized with stratum 16.
In the extended NTP configuration, you can create and manage additional NTP servers
including those of the type NTP (secure).
The secure method NTP (secure) uses authentication with symmetrical keys according to
the hash algorithms MD5 or SHA-1.
functions, a valid time of day is extremely important. It is recommended to
(secure) method.
-synchronized NTP servers" option is enabled, the CP also
to the frame. In this case, none of the NTP
For information on configuration, refer to the STEP 7 online help of the "Time-of-day
synchronization" parameter group.
If there are discrepancies between the following descriptions and the information in STEP 7 /
Professional V13, the information in this document is valid.
5.11.1
Communication types and SNMP
"Communication types" parameter group
Enable Plant Cloud Communication
Activate online functions
Enabling S7 communication
"SNMP" parameter group
Enable SNMP
5.11 STEP 7 configuration of individual parameters
Below, you will find information on the configuration of individual functions grouped
according to parameter groups in STEP 7.
In this parameter group, you enable the communication type of the CP.
To minimize the risk of unauthorized access to the station via Ethernet, you need to enable
the communications services that the CP will execute individually. You can enable all options
but at least one option should be enabled.
●
Enables communication with the operation center on the CP. Two operation centers can
be configured.
●
Enables access to the CPU for the online functions via the CP (diagnostics, loading
project data etc.). If the function is enabled, the engineering station can access the CPU
via the CP.
If the option is disabled, you have no access to the CPU via the CP with the online
functions. Online diagnostics of the CPU with a direct connection to the interface of the
CPU however remains possible.
●
Enables the functions of S7 communication with a SIMATIC S7 on the CP.
If you configure S7 connections to the relevant station, and these run via the CP, you will
need to enable this option.
●
Enables communication using SNMP on the CP.
If security functions are enabled, you will find the entry in "Security".
5.11 STEP 7 configuration of individual parameters
The setting made here applies globally to all TCP connections of the CP.
Note the option of overwriting the value configured here for individual operation centers, refer
to the section Operation center1 or Operation center2 (Page 45).
If there is no data traffic within the connection monitoring time, the CP sends a keepalive to
the communications partner.
● Permitted range: 0 ... 65535 s
● Default setting: 180 s; if you enter 0 (zero), the function is deactivated.
The monitoring time is configured for the Ethernet interface as the default for all TCP
connections. The default value can be adapted individually for each connection in "Operation
center".
After sending a keepalive, the CP expects a reply from the communications partner within
the keepalive monitoring time. If the CP does not receive a reply within the configured time, it
terminates the connection.
● Permitted range: 0 ... 65535 s
● Default setting: 1 s; if you enter 0 (zero), the function is deactivated.
The monitoring time is configured for the Ethernet interface as the default for all TCP
connections. The default value can be adapted individually for each connection in "Operation
center".
●
Selecting the option enables communication with the configured operation center on the
CP. You have option of configuring two operation centers.
●
The Operation center number in this parameter group is set by the system. It is required
for data point configuration.
5.11 STEP 7 configuration of individual parameters
●
The URL address of the operation center.
●
When the function is enabled, the connection to the communications partner (operation
center) is monitored by sending keepalive frames.
The TCP connection monitoring time is set for all TCP connections of the CP in the
parameter group of the Ethernet interface, see also the section Ethernet interface (X1) >
Advanced options (Page 44). The setting applies to all TCP connections of the CP.
Here in the parameter group "Operation center", the globally set TCP connection
monitoring time can be set separately for the operation center. The value set here
overwrites the global value for the operation center that was set in the "Ethernet interface
(X1) > Advanced options > TCP connection monitoring" parameter group.
●
Only with TCP: If there is no data traffic within the connection monitoring time, the CP
sends a keepalive to the communications partner.
– Permitted range: 0 ... 65535 s
– Default setting: 180 s; if you enter 0 (zero), the function is deactivated.
The monitoring time is configured for the Ethernet interface as the default for all TCP
connections. The default value can be adapted individually for each connection in
"Operation center" and this overwrites the global value for this partner that was set in the
parameter group "Ethernet interface (X1) > Advanced options > TCP connection
monitoring".
●
Only with TCP: After sending a keepalive, the CP expects a reply from the
communications partner within the keepalive monitoring time. If the CP does not receive
a reply within the configured time, it terminates the connection.
– Permitted range: 0 ... 65535 s
– Default setting: 1 s; if you enter 0 (zero), the function is deactivated.
The monitoring time is configured for the Ethernet interface as the default for all TCP
connections. The default value can be adapted individually for each connection in
"Operation center".
5.11 STEP 7 configuration of individual parameters
●
Description of the operation center e.g. name of the server.
●
If the CP does not receive a response from the communications partner (operation
center) within the configured time, the CP interprets this as a fault/error on the partner.
With 0, after 5 minutes the lack of a response is interpreted as a connection problem.
●
If the establishment of an HTTPS connection to the communications partner (operation
center) fails, this is interpreted as a connection problem.
●
Value for the wait time until the next connection establishment following an unsuccessful
attempt to establish a connection.
The reconnection delay is the waiting time between repeated attempts to establish the
connection by the CP when the operation center is not reachable or the connection has
aborted.
A value is configured for the waiting time before the next connection establishment
attempt.
With the value 0, the attempts until successful connection establishment are made as
default at the following intervals: 3 x 60 s, 3 x 120 s, 4 x 900 s, 23 x 3 600 s (1 hour),
1 x 86 400 s (1 day).
●
If the "Report operation center status" function is enabled, the CP signals the status of the
communication to the operation center.
– Bit 0 of "PLC tag for operation center status" (data type WORD) is set to 1 if the
operation center can be reached.
– Bit 1 is set to 1 if all the paths to the operation center are OK (useful with redundant
paths).
– Bits 2-3 indicate the status of the send buffer (frame memory).
The following values are possible:
- 0: send buffer OK
- 1: send buffer threatening to overflow (more than 80 % full).
5.11 STEP 7 configuration of individual parameters
●
Here, you set the size of the send buffer for events.
A maximum of 64 000 events divided up equally among all the communications partners
can be buffered.
You will find details of how the send buffer works (storing and sending events) as well as the
options for transferring data in the section Ethernet interface (X1) > Advanced options
(Page 44).
When a data point is created, the name of the PLC tag is initially adopted. In the "General"
tab of the data point you can change the name of the data point.
When assigning the name, only the following ASCII characters can be used: ASCII
characters 0x20 ... 0x7e with the exception of the characters listed below.
The following characters are forbidden since they do not adhere to the syntax rules of the
operation center for OPC items:
Recommendation for finished values that were preprocessed by the CPU:
Mean value generation
5.11 STEP 7 configuration of individual parameters
An analog value in the overflow range (32767 / 7FFFh) or underflow range (-32768 / 8000h)
is not transferred for the duration of the error suppression time. This also applies to live zero
inputs. The value in the overflow/underflow range is only sent after the error suppression
time has elapsed, if it is still pending.
If the value returns to the measuring range before the error suppression time elapses, the
current value is transferred immediately.
A typical use case for this parameter is the suppression of peak current values when starting
up powerful motors that would otherwise be signaled to the control center as a disruption.
The suppression is adjusted to analog values that are acquired by the S7 analog input
modules as raw values. These modules return the specified values for the overflow or
underflow range for all input ranges (also for live zero inputs).
If mean value generation is active, this parameter has no effect.
If the CPU makes preprocessed finished values available in bit memory or in a data block,
suppression is only possible or useful if these finished values also adopt the values listed
above 32767 / 7FFF
case, the parameter should not be enabled for preprocessed values.
or -32768 / 8000h in the overflow or underflow range. If this is not the
h
With this parameter, acquired analog values are transferred as mean values.
The current values of an analog data point are acquired cyclically and totaled. The number of
acquired values per time unit depends on the read cycle of the CPU and the CPU scan cycle
of the CP. The mean value is calculated from the accumulated values as soon as the
transfer is triggered by a time trigger. Following this, the accumulation starts again so that
the next mean value can be calculated.
The mean value can also be calculated if the transmission of the analog value message is
triggered by a request from the communications partner. The duration of the mean value
calculation period is then the time from the last transmission (for example triggered by the
trigger) to the time of the request. Once again, the accumulation restarts so that the next
mean value can be calculated.
If you have configured an error suppression time and then enable mean value generation,
the value of the error suppression time is grayed out but no longer used. If mean value
generation is enabled, the
Set start of measuring range / Set end of measuring range
Note
Evaluation of the value even when the option is disabled
If you enable one or both options and configure a value and then disable the option later, the
grayed out value is nevertheless evaluated.
To disable the two options, delete the previously configured values "Start of measuring
range" or "End of measuring range" from the input boxes and then disable the relevant
option.
Recommendation for quickly fluctuating analog values:
5.11 STEP 7 configuration of individual parameters
Acquisition of a value in the overflow or underflow range results in the mean calculation
being stopped immediately. The value 32767 / 7FFF
invalid mean value for the current mean value calculation period and sent when the next
analog value frame is triggered. The calculation of a new mean value is then started. If the
analog value remains in the overflow or underflow range, this new value is again saved
immediately as an invalid mean value and sent when the next frame is triggered.
error suppression time is set to 0 (zero) internally.
or -32768 / 8000h is saved as an
h
In these two input boxes, you set a limit value at the start of the measuring range and at the
end of the measuring range and if these limits are violated, the transfer of a frame is
triggered. Configuration of a threshold value trigger is necessary for this function.
The range of the value that can be configured as a decimal number corresponds to the
measuring range of the analog module (-32768 ... 32767).
By configuring these two values, you specify that the values of this analog value are
transferred as a frame only in the following situations:
● When the threshold value trigger fires
● When the value of "Set start of measuring range" is exceeded
● When the value of "Set end of measuring range" is undershot
The parameters "Set start of measuring range" and Set end of measuring range" are
pointless for measured values that have already been preprocessed in the CPU.
If the analog value fluctuates quickly, it may be useful to smooth the analog value first if the
"Set start of measuring range" and "Set end of measuring range" parameters are enabled.
This avoids a frame being sent every time a limit value is violated if the analog value
fluctuates close to one of the two limit values for a longer period of time.
51
Page 52
Configuration and operation
5.11.5.4
Threshold value trigger
Threshold value trigger: How the integrattion calculation works
The calculation cycle
5.11 STEP 7 configuration of individual parameters
The CP calculates the value for the threshold value trigger after the analog value
preprocessing, refer to the section Threshold value trigger and Analog value preprocessing
(Page 48).
To calculate the threshold value trigger, the integration method is used.
In the integration threshold value calculation, it is not the absolute value of the deviation of
the process value from the last stored value that is evaluated but rather the amount of the
integrated deviation.
The integration threshold value calculation works with a cyclic comparison of the integrated
current value with the last stored value. The calculation cycle in which the two values are
compared is 500 milliseconds.
(Note: The calculation cycle must not be confused with the scan cycle of the CPU memory
areas).
The deviations of the current process value are totaled in each calculation cycle. The trigger
is set only when the totaled value reaches the configured value of the threshold value trigger
and a new process value is entered in the send buffer.
5.11 STEP 7 configuration of individual parameters
The method is explained based on the following example in which a threshold value of 2.0 is
configured.
Table 5- 4 Example of the integration calculation of a threshold value configured with 2.0
0.5 20.3 +0.3 0.3
In this example, a value of 2.0 was configured for the threshold value trigger.
With the changes in the process value shown in the example, the threshold value trigger
fires twice, if the value 2.0 is reached:
● At the time 3.5 s: The value of the integrated deviation is at 2.0. The new process value
stored in the send buffer is 20.5.
● At the time 6.0 s: The value of the integrated deviation is at 2.1. The new process value
stored in the send buffer is 19.9.
In this example, if a deviation of the process value of approximately 0.5 should fire the
trigger, then with the behavior of the process value shown here a threshold value of
approximately 1.5 ... 2.5 would need to be configured.
STEP 7: The "Diagnostics" tab in the Inspector window
STEP 7: Diagnostics functions in the "Online > Online and diagnostics" menu
The following diagnostics options are available.
For information on the LED displays, refer to the section LEDs (Page 18).
Here, you can obtain the following information on the selected module:
● Entries in the diagnostics buffer of the CPU
● Information on the online status of the module
Using the online functions, you can read diagnostics information from the CP from an
engineering station on which the project with the CP is stored. You obtain the following static
information on the selected module:
● General information on the module
● Diagnostics status
● Information on the Ethernet interface:
– Network
– Ethernet interface
– Statistics
● Information on Plant Cloud Services:
– Operation center
– List of data points
– Protocol diagnostics
– Device-specific event
● Security
The information under the "Security" entry is not used for the CP.
If you want to operate online diagnostics with the station via the CP, you need to select
Activate online functions, see section Communication types and SNMP (Page 43).
You will find further information on the diagnostics functions of STEP 7 in the STEP 7
information system.
Loading the firmware with the online functions of STEP 7 via a WAN
Requirements:
Procedure:
6.2 Downloading firmware
If a new firmware version is available for the module, you will find this on the Internet pages
of Siemens Industry Online Support under the following entry ID:
Downloading the firmware via the Web server of the CPU
Requirements in the CPU configuration
Connection establishment with HTTP
Connection establishment with HTTPS
Connection establishment with HTTP
http
6.2 Downloading firmware
Follow the steps below to connect to the Web server of the CPU from the engineering station
and to download the CP's new firmware file to the station.
1. Open the corresponding project on the engineering station.
2. Select the CPU of the station involved in STEP 7.
3. Select the "Web server" entry.
4. In the parameter group "General", select the "Enable Web server for this interface"
option.
5. With a CPU version V4.0 or higher, create a user in the user management with the name
"admin".
You need to assign the right to perform firmware updates in the access level.
The procedure for establishing a connection to the Web server depends on whether you
have enabled or disabled the "Allow access only using HTTPS" option in the "General"
parameter group:
●
Procedure if the "Allow access only using HTTPS" option is disabled
●
Procedure if the "Allow access only using HTTPS" option is enabled
These two variants are described in the following sections.
Requirement: The new firmware file is stored on your engineering station.
You will find the requirements for access to the Web server of the CPU (permitted Web
browser) and the description of the procedure in the STEP 7 information system under the
keyword "Information about the Web server".
1. Connect the PC on which the new firmware file is located to the CPU via the Ethernet
interface.
2. Enter the address of the CPU in the address box of your Web browser:
address>
3. Press the Enter key.
The start page of the Web server opens.
4. Click on the "Download certificate" entry at the top right of the window.
5. Download the certificate to your PC by clicking the "Install certificate ..." button.
The certificate is loaded on your PC.
You will find information on downloading a certificate in the help of your Web browser and
in the STEP 7 information system under the key words "HTTPS" or "Access for HTTPS
(S7-1200)".
6. When the connection has changed to the secure mode HTTPS ("
://<IP address>/..."
in the address box of the Web server), you can continue as described in the next section
"Downloading firmware".
If you terminate the connection to the Web server, the next time you can log in with the
Web server without downloading the certificate using HTTP.
1. Connect the PC on which the new firmware file is located to the CPU via the Ethernet
interface.
2. Enter the address of the CPU in the address box of your Web browser:
s://<IP
address>
3. Press the Enter key.
The start page of the Web server opens.
4. Continue as described in the following section "Downloading firmware".
1. Log in on the start page of the Web server as an administrator.
– User name: admin
– Password: No password necessary
2. After logging in, select the entry "Module status" in the navigation panel of the Web
server.
3. Select the CP in the module list.
4. Select the "Firmware" tab lower down in the window.
5. Browse for the firmware file on your PC using the "Browse..." button and download the file
to the station using the "Run update" button.
Read the system manual "S7-1200 Programmable Controller"
6.3 Module replacement
Prior to installation, connecting up and commissioning, read the relevant sections in the
system manual "S7-1200 Programmable Controller" (refer to the documentation in the
Appendix).
When installing and connecting up, keep to the procedures described in the system manual
"S7-1200 Programmable Controller".
Make sure that the power supply is turned off when installing/uninstalling the devices.
The STEP -7 project data of the CP is stored on the local CPU. If there is a fault on the
device, this allows simple replacement of the CP without needing to download the project
data to the station again.
When the station starts up again, the new CP reads the project data from the CPU.
For details, refer to the IK PI catalog, cabling technology
You will find further characteristics and performance data in the section Application and
properties (Page 9).
The table below shows the pin assignment of the Ethernet interface. The pin assignment
corresponds to the Ethernet standard 802.3-2005, 100BASE-TX version.
Table 7- 2 Pin assignment of the Ethernet interface
You will also find the current approvals for the product on the Internet pages of Siemens
Industry Online Support under the following entry ID:
51297224 (http://support.automation.siemens.com/WW/view/en/51297224)
→ "Entry list" tab, entry type "Certificates"
SIMATIC NET products are regularly submitted to the relevant authorities and approval
centers for approvals relating to specific markets and applications.
If you require a list of the current approvals for individual devices, consult your Siemens
contact or check the Internet pages of Siemens Industry Online Support:
Note
Issued approvals on the type plate of the device
The specified approvals apply only when the corresponding mark is printed on the product.
You can check which of the following approvals have been granted for your
markings on the type plate.
EC declaration of conformity
product by the
The CP has the following approvals and meets the following standards:
The CP meets the requirements and safety objectives of the following EU directives and it
complies with the harmonized European standards (EN) for programmable logic controllers
which are published in the official documentation of the European Union.
● EC directive 2006/95/EEC "Electrical Equipment Designed for Use within Certain Voltage
Limits" (Low Voltage Equipment Directive)
● EN 60950-1 Information Technology Equipment - Safety
● Underwriters Laboratories, Inc.: UL 508 Listed (industrial control devices)
● UL 1604 (Hazardous Location)
● Canadian Standards Association: CSA C22.2 No 142 (process control equipment)
● CSA C22.2 No. 213 (Hazardous Location)
APPROVED for Use in:
● Cl. 1, Div. 2, GP. A, B, C, D T4A; Ta = -20 °C...60 °C
● Cl. 1, Zone 2, GP. IIC T4; Ta = -20 °C...60 °C
Factory Mutual Research (FM):
Approval Standard Class Number 3600 and 3611
approved for use in:
Class I, Division 2, Group A, B, C, D, Temperature Class T4A, Ta = 60 °C
Class I, Zone 2, Group IIC, Temperature Class T4, Ta = 60 °C
The CP meets the requirements of the AS/NZS 2064 standards (Class A)
Customs union of Russia, Belarus and Kazakhstan
Declaration of the conformity according to the technical regulations of the customs union
(TR CU)
Go to the required product group and make the following settings:
"Entry list" tab, Entry type "Manuals / Operating Instructions"
● You will find the documentation for the SIMATIC NET products relevant here on the data
medium that ships with some products:
– Product CD / product DVD or
– SIMATIC NET Manual Collection
SIMATIC
S7-1200 Programmable Controller
System Manual
Siemens AG
Current issue under the following entry ID:
34612486 (http://support.automation.siemens.com/WW/view/en/34612486)