SIMATIC SPC4 User Manual

Download

SIMATIC NET SPC4 Siemens PROFIBUS Controller

User Description Date 08.05.96

Order No. 6GK1 971-5XA00-0BA0

SINEC

(Siemens PROFIBUS Controller)

SPC4

User Description

Release: V1.2

Date: 08.05.1996

WKF B1 T2 SPC4

Liability Exclusion

We have tested the contents of this document regarding agreement with the hardware and software described. Nevertheless, deviations can’t be excluded and we can’t guarantee complete agreement. The data in the document is checked regularly, however. Required corrections are included in subsequent versions. We gratefully accept suggestions for improvement.

Copyright © Siemens AG 1995 All Rights Reserved Unless permission has been expressly granted, passing on this document or copying it, or using and sharing its content is not allowed. Offenders will be held liable. All rights reserved, in the event a patent is granted, or a utility model or design is registered.

The trademarks SIMATIC, SINEC and SOFTNET, L2 are protected by law through registration by Siemens. All other product- and system names are (registered) trademarks of their respective owner and are to be treated as such.

Subject to technical change.

Page 2 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

Table of Contens

1 INTRODUCTION 7

2 FUNCTION OVERVIEW 8

3 PIN ASSIGNMENT 9

4 MEMORY ASSIGNMENT 10

4.1 Addressing of the SPC4 10

4.2 Memory Area Distribution of the Internal RAM 11

4.2.1 Overview 11

4.2.2 RAM Parameter Block 12

4.2.3 SAP List 12

4.2.4 Data Areas in the Internal RAM 14

4.2.5 Addressing via the Memory Window 14

4.3 Assignment of the Parameter Latches 15

5 FLC INTERFACE 18

5.1 SAP List 18

5.1.1 Structure of the SAP List 18

5.1.2 Control Byte 18

5.1.3 Request SA 20

5.1.4 Request SSAP 20

5.1.5 Access Byte 20

5.1.6 Reply Update Ptr/ SDN-DDB-TIn-Tab-Ptr 21

5.1.7 Special Features for the DEFAULT SAP 22

5.2 SM-SAP List 22

5.3 Indication Queue 23

5.3.1 Description 23

5.3.2 Structure of the Indication Block 24

5.4 Reply on Indication Blocks 27

5.4.1 Function 27

5.4.2 Structure of the Reply-on-Indication Blocks 27

6 DP INTERFACE 29

6.1 Description 29

6.2 Productive Services 30

6.2.1 Data Exchange 30

6.2.2 Read Input Data 31

6.2.3 Read Output Data 32

6.2.4 Global Control (Sync, Freeze, Clear Data) 32

6.2.5 Leave Master 34

6.2.6 Baudrate Search 34

SPC4 User Description Release V1.2 Page 3

WKF B1 T2 SPC4

7 ASIC INTERFACE 36

7.1 Latch Parameters 36

7.1.1 Slot Time Register 36

7.1.2 Baudrate Register 36

7.1.3 BEGIN PTR Register 37

7.1.4 UMBR PTR Register 38

7.1.5 BASE PTR Register 38

7.1.6 TRDY Register 38

7.1.7 PREAMBLE Register 39

7.1.8 SYN Time Register 39

7.1.9 Delay Timer Register 39

7.1.10 Factor Delay Timer Clock Register 40

7.1.11 Mode Register 40

7.2 RAM Parameter Block 46

7.2.1 Indication Write Pointer 46

7.2.2 Indication Write PRE Pointer 46

7.2.3 Indication Read Pointer 46

7.3 Interrupt Controller 47

7.4 SPC4 Timer 52

7.4.1 Delay Timer 52

7.4.2 Idle Timer 53

7.4.3 Syni Timer 53

7.4.4 Slot Timer 53

7.4.5 Time Out Timer 54

8 ASYNCHRONOUS INTERFACE 55

8.1 Baudrate Generator 55

8.2 Transmitter 55

8.3 Receiver 55

8.4 Serial Bus Interface PROFIBUS Interface (asynchronous) 55

8.4.1 Interface Signals 55

8.4.2 Timing RS 485: 56

8.4.3 Example for the RS 232 Interface 57

9 SYNCHRONOUS INTERFACE 58

9.1 Overview 58

9.2 Baudrate Generator 58

9.3 Transmitter 58

9.4 Receiver 60

10 CLOCK SUPPLY 61

Page 4 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

11 PROCESSOR BUS INTERFACE 63

11.1 Universal Processor Interface 63

11.2 Bus Interface Unit (BIU) 65

11.3 Dual Port RAM Controller 65

11.3.1 Function 65

11.3.2 Access to the SPC4 under LOCK 65

11.4 Other Pins 66

11.4.1 Test Pins 66

11.4.2 XHOLDTOKEN 66

11.4.3 XINTCI 66

11.5 Interrupt Timing 67

11.6 Reset Timing 67

11.7 Intel / Siemens 8051 (synchronous) etc. 68

11.7.1 Diagram 68

11.7.2 Timing 80C32 69

11.8 Intel X86 (asynchronous) 70

11.8.1 Diagram 70

11.8.2 Timing X86 71

11.9 Siemens 80C165 (asynchronous) 73

11.9.1 Diagram 73

11.9.2 Timing 80C165 74

11.10 Motorola 68HC16 (asynchronous) 76

11.10.1 Diagram 76

11.10.2 Timing 68HC16 76

11.11 Motorola 68HC11 (synchronous) 78

11.11.1 Diagram 78

11.11.2 Timing 68HC11 78

12 TECHNCIAL SPECIFICATION 80

12.1 Maximum Limits 80

12.2 Permissible Operating Values 80

12.3 DC Specification of the Pad Cells 81

12.4 Identification Data for the Output Drivers 81

13 CASING 82

13.1 Notes on Processing 83

14 BIBLIOGRAPHY 84

SPC4 User Description Release V1.2 Page 5

WKF B1 T2 SPC4

15 ADDRESS LIST 84

15.1 PNO 84

15.2 Technical Contact Persons in the Interface Center 84

16 APPENDIX 85

16.1 Server Software for the SPC4 85

16.1.1 Application 85

16.1.2 Special features of the PROFIBUS -PA / -FMS / -DP server software: 85

16.1.3 Functions of the Server Software 86

16.2 SIM1 88

16.2.1 Area of Appliction 88

16.2.2 Special Functions 89

16.2.3 Fields of application 89

16.2.4 Function of the Application 90

16.2.5 Electrical Data 91

Page 6 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

1 Introduction

For simple and fast digital exchange between programmable logic controllers, Siemens offers its users several ASICs. These ASICs are based on and are completely handled on the principles of the PROFIBUS DIN 19245, Part 1 and the Draft, Part 3, of data traffic between individual programmable logic controller stations. The following ASICs are available to support intelligent slave solutions, that is, implementations with a microprocessor. The SPC (Siemens Profibus Controller) is built directly on Layer 1 of the OSI model and requires an additional microprocessor for implementing Layers 2 and 7. The ASPC2 already has integrated many parts of Layer 2, but the ASPC2 also requires a processor’s support. This ASIC supports baud rates up to 12 Mbaud. In its complexity, this ASIC is conceived primarily for master applications. Due to the integration of the complete PROFIBUS-DP protocol, the SPC3 decisively relieves the processor of an intelligent PROFIBUS slave. The SPC3 can be operated on the bus with a baud rate of up to 12 MBaud. However, there are also simple devices in the automation engineering area, such as switches and thermoelements, that do not require a microprocessor to record their states. There are two additional ASICs available with the designations SPM2 (Siemens Profibus Multiplexer, Version 2 ) and LSPM2 (Lean Siemens PROFIBUS Multiplexer) for an economical adaptation of these devices. These blocks work as a DP slave in the bus system (according to DIN E 19245 T3, EN 50 170) and work with baud rates up to 12 Mbaud. A master addresses these blocks by means of Layer 2 of the 7 layer model. After these blocks have received an error-free telegram, they independently generate the required response telegrams. The LSPM2 has the same functions as the SPM2, but the LSPM2 has a decreased number of I/O ports and diagnostics ports.

In the SPC4, parts of Layer2 which handle the bus protocol, are already integrated. For the remaining functions of Layer2 (interface service, management), an additional microprocessor is needed. In addition to the Layer2 functionality, the following productive services are integrated: Data_Exchange, Read_Input, Read_Output and the Global_Control command of DIN E 19245 Part 3(EN 50 170), as well as the PROFIBUS PA functionality (Part 4).

The server software offered for the SPC4 provides support for simple access to the protocols

o FMS o PA o DP

The analog ASIC SIM1 facilitates the configuration of the PROFIBUS PA interface (synchronous) considerably. Please have also a look to the short descriptions in the appendix, and the detailed descriptions of the analog ASIC SIM1 and the Server Software.

The chip supports passive stations on the bus system and filters out all external messages as well as faulty user messages.

SPC4 User Description Release V1.2 Page 7

WKF B1 T2 SPC4

2 Function Overview

Except for the bus drivers, the entire PROFIBUS periphery is contained in the SPC4. The additional processor doesn’t have to make a hardware timer available( except the Server Software), in order to process the bus protocol.

Baudrates starting with 9.6kBd to 12MBd are supported. The SPC4 has a universal micro-controller interface with an 8bit data bus interface and a 10 bit address

bus. Depending on the configuration, the data-/address bus can be operated multiplexed or separate; thus, processors with standard Intel timing, with Motorola timing, with SABC165 timing or with 80C32 timing can be connected.

Since the interface supports INTEL- as well as MOTOROLA architectures, the Intel- or Motorola data format is specified with two configuration pins, and synchronous (rigid timing) or asynchronous (with Ready support) processor bus timing is supported. The handshake between the processor and the SPC4 is executed by the FLC firmware (Fieldbus Link Control) and carried out via the 1.5 kB Dual Port RAM integrated in the SPC4.

From the view of the user, the SPC4 occupies an address space of 1kByte. The SPC 4 carries out all the checks when request messages are received.

Page 8 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

3 PIN Assignment

The SPC4 has a 44 pin EIAJQPF casing with the following signals:

Pin Signal Name In/ 1 XCS I Chip Select CPU C32 Mode: apply to

2 XWR / E I Write Signal

3 Divider I Divider for ISCLK-OUT (Pin 7) 4 XRD

R/W 5 CLK I Clock Input System 6 GND 7 ISCLK-Out O Clock divided by 2 or 4 System, CPU 8 TYP I see mode table 9 XINT O Interrupt Output CPU, Interrupt Contr. 10 XINTCI O not used 11 DB0 I/O Data Bus CPU, Memory C32 Mode: Data-

12 DB1 I/O Data Bus CPU, Memory alt.: Data-/Address Bus 13 XHOLDTOKEN O not used

14 XREADY

XDTACK 15 DB2 I/O Data Bus CPU, Memory 16 DB3 I/O Data Bus CPU, Memory 17 GND 18 VDD 19 DB4 I/O Data Bus CPU, Memory 20 DB5 I/O Data Bus CPU, Memory 21 DB6 I/O Data Bus CPU, Memory 22 DB7 I/O Data Bus CPU, Memory 23 MODE I see Mode Table System 24 ALE

AS 25 AB9 I Address Bus CPU C32 Mode: <log> 0

26 TXD-TXS O serial Send Channel RS 485 Sender 27 RTS-ADD O Request to Send RS 485 Sender 28 GND 29 AB8 I Address Bus System, CPU 30 RXD-RXS I serial Receive Channel RS 485 Receiver 31 AB7 I Address Bus System, CPU 32 AB6 I Address Bus System, CPU 33 XCTS I Clear to Send <log> 0 = send enable MODEM/FSK 34 XTEST0 I Pin has to be applied to VDD permanently 35 XTEST1 I Pin has to be applied to VDD permanently 36 RESET I Reset Input: connect with portpin of CPU 37 AB4 I Address Bus System, CPU 38 GND 39 VDD 40 AB3 I Address Bus System, CPU 41 AB2 I Address Bus System, CPU 42 AB5 I Address Bus System, CPU 43 AB1 I Address Bus System, CPU 44 AB0 I Address Bus System, CPU Note: all signals which start with X.. are low-active

Description Source/Destination Processor Variant

Out

E-Clock for Motorola 1pulse=1memory cycle (for asynchronous operation, apply to VDD)

0=:4, 1=:2

I Read Signal

Read/Write for Motorola (low=Write)

O Ready for external CPU

Data Transfer Acknowledge for Motorola

I Address Latch Enable

Address Strobe for Motorola (for synchronous operation, apply to VDD)

CPU

System CPU

System, CPU

CPU C32 Mode: ALE

VDD alt.: CS-Signal

/Address Bus multiplexed

separate

Motorola Mode AS

SPC4 User Description Release V1.2 Page 9

WKF B1 T2 SPC4

4 Memory Assignment

4.1 Addressing of the SPC4

From the view of the user, the 1.5 kByte internal Dual Port RAM and the internal latches use a 1kByte address space. Parts of the internal RAM are directly imaged into the address area of the microprocessor; the other parts can be addressed via a window mechanism.

1FFH

200H

MicroProcessor

512 Byte General Parameter SAP-List

SPC4

1.5 kB RAM

256 Byte Memory Window

Base Pointer

2FFH

300H

256 Byte Control Unit Parameter

3FFH

Figure 4.1 Addressing the Internal 1.5k RAM The 1k byte address range is divided into four 256 byte blocks with different functions. Via the lower address window, the FLC can directly access the first 512 (2x256) bytes of the RAM physically

(without having to load the base pointer). This has the advantage that the FLC can access the general parameters and the SAP list directly, without having to load the base pointer first.

Page 10 Release V1.2 SPC4 User Description

5FFH

Latches

SPC4 WKF B1 T2

Via the second 256 kByte address window (200h to 2FFh), the entire internal memory can be addressed with an 8 bit base pointer. The FLC has to load this pointer; it always addresses the beginning of an 8 byte segment. Thus, the FLC can address up to 256 bytes via the offset address applied to the address pins of the SPC4.

The third segment which also consists of 256 bytes (300h to 3FFh), addresses the internal latches which are stored for directly controlling the hardware. These latches are not integrated in the internal RAM area!

Address BitA9Address BitA8Window Select 0 0 Parameter Area (physically 00h-FFh)

0 1 Parameter Area (physically 100h-1FFh) 1 0 entire RAM via Base Pointer 1 1 Parameter Latches

Table 4.1 Window Select

Attention: The hardware won’t prevent overwriting the address area; that is, if the user writes beyond the station table, the parameters in the lower memory area are overwritten through the wrap-around. In this case, the SPC4 generates the Mem-Overflow interrupt. If the user writes on write-protected parameters, an access violation interrupt will be generated.

4.2 Memory Area Distribution of the Internal RAM

4.2.1 Overview

The figure shows the distribution of the internal 1.5k RAM of the SPC4. The entire memory, divided into segments of 8 bytes each, is broken down into different areas.

Segment 0

BEGIN-PTR

UMBR_PTR

RAM Parameter

SAP-List

SM-SAPs (5x5 byte) Default-SAP (16 byte)

SAP-0..SAP-63 (64 x 5 byte)

Indication Queue

Reply on IndicationBlocks

Exchange Buffer

Byte 0

Segment 0

Byte 7

Segment 1

Segment 2

Segment 3

Segment 4

Station Table

Ident Buffer

Segment 191

Figure 4.2 Memory Area Distribution

SPC4 User Description Release V1.2 Page 11

WKF B1 T2 SPC4

4.2.2 RAM Parameter Block

In the first 6 bytes of the integrated RAM, the general parameters, such as the read- and write pointers of the indication queue, are filled which don’t directly engage the control. The FLC is only to write parameters with the addresses 00H to 5H. The internal user cells are not allowed to be overwritten (the hardware will generate a write violation interrupt and enter Offline).

Address Name Access Meaning 00H IND-WP-PRE RD/WR The write pointer for early indication processing points to the

next free segment which follows the request message received last, even if no indication “IND” has been made. The pointer IND-WP-PRE makes fast slave reaction possible (for example, for PROFIBUS DP). Immediately after the correct receipt of a request message (and before a response message is sent), the pointer IND-WP-PRE is set to the next free segment boundery. At the same time, the interrupt “IND-PRE” is generated.

01H IND-WP RD/WR The write pointer of the indication queue points to the next free

segment which follows the request message indicated last. With each indication interrupt “IND”, the SPC4 will set IND-WP to a new segment boundary.

02H IND-RD RD/WR The read pointer of the indication queue is also a segment

address and is managed by the FLC. 03H FDL-Ident-Ptr RD/WR Pointer to ident-buffer 04H TS-ADR-REG RD/WR Contains station address 05H SAP-MAX RD/WR The highest SAP list number is parameterized 06H..17H internal

working cells

The following cells must not be overwritten (write violation

interrupt)

Table 4.2 Assignment of the RAM Parameter Block In addition to correctly setting up the corresponding address bits, access to the parmeter latches or the

internal RAM also requires applying an XCS signal to the SPC4. Moreover, the XREADY signal of the SPC4 has to be noted, or corresponding wait states have to be inserted.

When writing the RAM parameters, the upper, unutilized bits have to be set to ‘0’, while for the parameter latches, the unassigned bit positions are ‘don’t care’.

4.2.3 SAP List

The SAP list can be addressed directly; segmentation and using the base pointer are not required, but addressing via the base pointer is also possible. To address the data to which an SAP points, the base pointer must be used.

The area of the SAPs uses 361 bytes; that is, 46 segments (segment 5...50; of the last segment, only 1 byte is assigned). The SAP list consists of the following:

- 5 SM SAPs (System Management Service Access Point) of 5 bytes each

- DEFAULT SAP with 16 bytes

- 64 SAPs of 5 bytes each The function of the individual registers and bits is explained in the following chapters.

Page 12 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

Address Name Register Meaning 18H SM1 Control Byte Bit Information 19H Request-SA Request-Source Address 1AH reserved 1BH reserved 1CH Reply-Update-Ptr/

SDN-DDB/-Tln-Tab-Ptr 1DH - 21H SM2 see above SM1 see above SM1 22H - 26H SM3 see above SM1 see above SM1 27H - 2BH SM4 see above SM1 see above SM1 2CH - 30H SM5 see above SM1 see above SM1 31H DEFAULT

SAP 32H Request SA Request-Source Address 33H Request SSAP Request-SourceServiceAccessPoint 34H Access Byte Access Protection 35H Reply-Update-Ptr/

36H Reply-Update-Ptr D 37H Reply-Update-Ptr N 38H Reply-Update-Ptr U 39H Response-Buffer-Length 3AH Response Status 3BH Indication-Buffer-Ptr D 3CH Indication-Buffer-Ptr N 3DH Indication-Buffer-Ptr U 3EH Indication-Buffer-Length 3FH Active-Group-Ident 40H Control Command 41H SAP[0] Control-Byte Bit Information 42H Request-SA Request-SourceAddress 43H Request SSAP 44H Access-Byte 45H Reply-Update-Ptr/SDN-DDB/-Tln-

46H - 4AH SAP[1] see above SAP (0) see above SAP(0) 4BH -

17BH 17CH SAP[63] Control-Byte Bit Information 17DH Request-SA Request-SourceAddress 17EH Request SSAP 17FH Access-Byte 180H Reply-Update-Ptr/SDN-DDB/-Tln-

181-187H not used The indication queue has to start at 188H IndicationQueue Start of Indication Queue

SAP[2]-

SAP[62]-

Control Byte Bit Information

SDN-DDB/-Tln-Tab-Ptr

Tab-Ptr

see above SAP (0) see above SAP(0)

Tab-Ptr

Pointer to Response Buffer

Pointer to response buffer

Pointer to Response buffer

the beginning of an 8 Byte segment

Table 4.3: SAP List

SPC4 User Description Release V1.2 Page 13

WKF B1 T2 SPC4

4.2.4 Data Areas in the Internal RAM

4.2.4.1 Indication Queue

The FLC can set the memory area of the indication queue at the segment boundaries. The BEGIN-PTR is the address of the 1st segment of the indication queue. The end of the queue is marked by the UMBR_PTR. The UMBR_PTR points to the address of the 1st segment which is not part of the indication queue.

After initialization, both pointers have to be set to the desired area start in the offline state. THEY CAN’T BE CHANGED DYNAMICALLY; that is, to modify memory distribution, the SPC4 has to be set to the offline state. Exchanging the pointer sequence leads to faulty behavior of the SPC4 relative to the individual memory areas.

If the SPC4 receives request messages, it will enter them in the indication queue. The indication queue is organized as cyclic buffer (queue); that is, data to be processed is successively entered in the queue as long as there is enough memory space, while blocks which have been processed are removed. The indication queues are organized with write- and read pointers. The FLC has to set the indication read pointer (IND-RP), while the hardware of the SPC4 is responsible for updating the indication write pointer (IND-WP).

Since it is a cyclic buffer, the end of the queue is to be monitored when data is entered. If the end of the queue is exceeded, the address has to be wrapped around. For this, the SPC4 offers hardware support which does the wrap-around automatically.

4.2.4.2 Reply on Indication Blocks

In these buffers, the FLC has to make reply data available. The reply data is assigned to the calls via pointers in the SAP lists.

4.2.4.3 Exchange Buffers

If PROFIBUS DP services are to be supported (DP mode = 1 in Mode Register 0), six exchange buffers have to be made available.

4.2.4.4 Ident Buffer

The ident buffer contains the reply data for ident messages.

4.2.4.5 Station Table

The station table is needed for filtering SDN and DDB response messages.

4.2.5 Addressing via the Memory Window

The physical address of the integrated RAM is generated (when addressing the SPC4 via the address window (200h to 2FFh)) from the base pointer, the segment address for the indication queue and the lower 8 bits of the address bus. For this, the address bus adds the base pointer to the address shifted by 3 bit positions.

The address is calculated in an ALU which also automatically calculates the address wrap- around when the queue boundary is exceeded. If the queue boundary is exceeded, the central processor calculates the wrap around address according to the following pattern:

New segment address = base pointer + AB7..3 - end pointer + start pointer

Together with the 3 least significant address bits, the result is the physical 11bit RAM address for the memory. After the FLC has loaded the base pointer, it can read up to 256 data bytes through the central processor, without having to reload the base pointer, and without having to concern itself with the wrap around at the queue boundary.

Page 14 Release V1.2 SPC4 User Description

Base Pointer Register

SPC4 WKF B1 T2

A10

11 Bit-RAM Address

Address Bus Bit 7..0

Byte Address within a Segment

Figure 4.3 Calculating the Physical RAM Address

4.3 Assignment of the Parameter Latches

Access to the internal parameter latches -that is, those memory cells which directly intervene in the controlis only possible at the SPC4 via the address window 300H to 3FFH.

These cells can either only be read or written, and in that case, have a different function. In the Motorola mode, the SPC4 swaps addresses when accessing the address area of 300H (word register); that is, it exchanges the address bit 0 (it generates from an even address an odd one, and vice versa).

The SPC4 has an 8 bit data interface. When accessing the byte register via this interface, it makes no difference whether the SPC4 is operated in the Intel- or in the Motorola mode.

When a word register ( two byte register) is accessed, the SPC4 has to decide between Intel and Motorola: Example: INT-MASK-REG

Intel Mode: write access with address 300 ð INT-MASK-REG (7..0) is written (little endian)

Motorola Mode: write access with address 300 ð INT-MASK-REG (15..8) is written (big endian)

The meaning of the individual bits in the registers is described in more detail in the following chapters. Since the addresses of the parameters latches are not completely decoded, these registers will reappear at

every 32 bytes. This facilitates implementation since different addresses (names) can be assigned for the read- and write accesses.

SPC4 User Description Release V1.2 Page 15

WKF B1 T2 SPC4

Addresse Intel /Motorola

300H 301H Int--Req-Reg 7..0 Interrupt Controller Register 301H 300H Int--Req-Reg 15..8 302H 303H Int-Reg 7..0 303H 302H Int-Reg 15..8 304H 305H Status-Reg 7..0 Status Register 305H 304H Status-Reg 15..8 306H 307H Delay 7..0 Delay Timer Register (actual counter value) 307H 306H Delay 15..8 308H 309H reserved 309H 308H reserved 30AH 30BH reserved 30BH 30AH reserved

30CH- 30FH reserved

310H reserved 311H reserved 312H reserved 313H reserved 314H reserved 315H reserved 316H reserved 317H reserved 318H Mem-Lock 0 Memory Lock Cell 319H reserved

31AH reserved

Name

Meaning (READ Access !)

Figure 4.4 Assignment of the Internal Parameter Latches for READ

Page 16 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

Address Intel /Motorola

300H 301H Int--Mask-Reg 7..0 Interrupt Controller Register 301H 300H Int--Mask-Reg 15..8 302H 303H Int-Ack-Reg 7..0 303H 302H Int-Ack-Reg 15..8 304H 305H TSLOT 7..0 Parameter assignment of Wait-to-Receive time 305H 304H TSLOT 13..8 306H 307H BR-REG 7..0 Parameter assignment of the division factor 307H 306H BR-REG 10..8 for generating the baudrate 308H 309H TID1 7..0 309H 308H TID1 10..8

30AH 30BH FACT-DEL-CLK 7..0 DelayTimer for SM time service 30BH 30AH FACT-DEL-CLK 10..8

30CH- 30F reserved

310H UMBR_PTR S 7..0 UMBR_PTR points to the address of the first

311H Mode-Reg 7..0 Parameter assignment of single bits 312H Mode-Reg1-Res 5..0 313H Mode-Reg1-Set 5..0 314H Base-PTR 7..0 Base address for accesses to the internal RAM 315H TRDY 7..0 Parameter assignment for TRDY (ready time valid

316H PREAMBLE Parameter assignment of number of bits 317H TSYN The following time is parameterized:

318H Mem-Lock 0 Memory Lock Cell 319H BEGIN-PTR 7..0 BEGIN-PTR points to the smallest segment

31AH Mode-Reg2 2..0 Parameter assignment of single bits

Name

Meaning (Write Access !)

segment which is no longer part of the indication queue

before sending a response message) (preamble) in the synchron-mode TSYN (33Bit asynchronous mode)

TIFG (Interframe GAP-Time; synchronous mode)

address of the indication queue. The BEGIN-PTR have to point at the beginning of an 8 byte segment.

Figure 4.5: Assignment of the Internal Parameter Latches for WRITE

SPC4 User Description Release V1.2 Page 17

WKF B1 T2 SPC4

5 FLC Interface

5.1 SAP List

5.1.1 Structure of the SAP List

In the FLC, a data transmission service is processed via a Service Access Point (SAP). For each station, up to 64 SAPs, that is SAP [0..63], are possible at the same time, and the default SAP. Communication from DEFAULT SAP to a SAP and vice versa is possible. The SPC4 checks the Request SSAP. Each SAP (including the DEFAULT SAP) has special entries in the SAP list; via this SAP list, the FLC makes receive resources available. If the SPC4 receives a message to a SAP which is not available, it will respond with No Service Activated (SD1 response).

In the SAP list already described, individual registers are assigned to each SAP.

5.1.2 Control Byte

Bit Position Designation 7 6 5 4 3 2 1 0 SAPLocked

SDN/ DDBFilter

RS/RA or UE

RR IN USE Buffer available Control Byte

Page 18 Release V1.2 SPC4 User Description

Bit 0-2 Buffer available

The three bits are counters for the resources made available externally. The FLC

increments the 3 bits, as soon as it loads a resource. The SPC4 decrements the 3 bits,

if a received block was indicated. At receipt, after it has received the entire message,

the SPC4 reads the 3 bits. If the status = zero, it will cancel the receipt, set the event

flag ‘No Ressource’ (RR, see below) and respond with No Ressource (SD1-Response)

Exception:

If DP Mode = 1 is set, the SPC4 will not change Buffer Available in the DEFAULT

SAP. Buffer Available has to be parameterized larger than zero, however; otherwise,

the response will be No Resource.

Bit 3 IN USE

The SPC4 will set this bit as soon as it has entered the complete message of a request

message in the indication buffer. It will only reset it if an indication was executed (valid

or invalid). If the FLC wants to assign a new reply block, it has to wait until the bit is

reset. Only then (under Mem-Lock) can it reload the Reply Update Pointer. This

prevents that the FLC can reload data for the SPC4 during transmission operation.

Exception:

If DP Mode = 1 is set, the SPC4 will not set the In Use Bit in the DEFAULT SAP. A

correctly received request message to the DEFAULT SAP will not be entered in the

Indication Queue and not be indicated.

Bit 4

RS/RA or UE

No Service Activated/ Service Access Point Blocked or User-Error: the SPC4 will

set this flag if the plausibilization of Request-SA was negative (Request SA differs from

the SA received ; that is, the call is from an unauthorized station). The SPC4 responds

with Service Access Point Blocked [RA] in the PA-Mode or No Service Activated

[RS] in the Profibus-Mode (SD1-Response). This flag will also be set if Request-SA =

7FH, that is, if the SAP is inactive. The SPC4 responds with No Service Activated

[RS] (SD1-Response). This bit is set as User Error [UE] if the SAP was locked. The

SPC4 responds with User Error [UE] (SD1-Response).

SPC4 WKF B1 T2

Bit 5

Bit 6

Bit 7

Figure 5.1: Control Byte

RR = No Resource

The SPC4 will set this bit if, after receipt of the message header, the content of the

Buffer Available bit = zero; that is, the FLC has made no resources available or the

queue is full. In both cases, the SPC4 will respond with No-Ressource[RR] (SD1-

Response).

SDN-/DDB-Filter

This bit makes it possible to activate the SDN-/DDB filter

0 = The “Reply-Update-Ptr/SDN-/DDB-Tln-Tab-Ptr“ pointer points to the Reply-

1 = The “Reply-Update-Ptr/SDN-/DDB-Tln-Tab-Ptr pointer points to the station

SAP locked

For the moment, the SAP is not accepting data. If the SPC4 receives data for this SAP,

it will set the event flag User Error (UE) and respond with User Error (SD1-Response).

on-Indication block and with that, to the response to be transmitted. If the pointer = 00H, no response buffer is available, and the SPC4 responds to an SRD request with a short acknowledgement (SC).

table, and the SPC4 is a “subscriber” for this SAP. The SDN-/DDB-Tln list will be evaluated at the access “Subscriber for DDB-Response“ and SDNRequest.

SPC4 User Description Release V1.2 Page 19

WKF B1 T2 SPC4

5.1.3 Request SA

The SA received is compared with this entry. If it differs, the SPC4 will set the event flag No Service Activated (RS) and respond with Service Access Point Blocked [RA] in the PA mode, and with No Service Activated [RS] in the Profibus mode (SD1 Response). In the case of the default-SAP, the addresses 00H 7EH are possible; in the case of all other SAPs, 80H - FEH (expansion bit set); 7FH leads to “No Service Activated” since 7FH is locking the SAP. If this entry = FFH (=all), the call won’t be checked. If an SRD is received with DDB, the bit “SDN-/DDB Filter” will be tested in addition, and if needed, compared further in the DDB-TIn list, before there is a response or the event flag is set.

5.1.4 Request SSAP

The SSAP received is compared with this entry. If it differs, the SPC4 will set the event flag No Service Activated (RS) in the PA mode, and Service Access Point Blocked (RA) in the Profibus mode, and respond with No Service Activated (SD1 Response). If Request SA is 00H-7EH, Request-SSAP = FFh will select the DEFAULT SAP. If the expansion bit is set in Request SA, and the Request SSAP = FFH, SSAP will not be checked.

5.1.5 Access Byte

The access byte controls access protection to the matching SAP at receipt. The entry 0H means “no access protection”. If the SPC4 receives a message that doesn’t match the access byte, it will respond with “NO SERVICE ACTIVATED”. The event bit RS will be set. All access violations are filtered to the FLC, the response [RS] (No Service Activated) is transmitted to the requester. The DDB response (subscriber) is an exception; it is not acknowledged negative.

Bit Position Designation

7 6 5 4 3 2 1 0

IND-N RUP-N Access Value Access Byte

Page 20 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

Bit 0-3

Bit 4

Bit 5

Access Value

Access Protection

0H = All 1H = SDN-Low 2H = SDN-High 3H = SDN-Low/High 4H = 5H = SDA-Low 6H = SDA-High 7H = SDA-Low/High 8H = SRD-Low/High DDBREQ DDB-RES-Low/High 9H = SRD Low AH = SRD-High BH = SRD-Low/High CH = DDB-REQ DH = DDB-RES-low EH = DDB-RES-high FH = DDB RES low/high

RUP-N-Valid (Only for DEFAULT SAP)

This bit is set by the application, if in the DP-Mode, valid input data is entered in the Reply-Update-Buffer N. The SPC4 will reset the RUP-N-Valid, after it has exchanged the Reply Update Buffers D and N

IND-N-Valid (Only for DEFAULT SAP)

This bit will be set by the SPC4 if in the DP mode, valid output data is entered in Indication Buffer N . The FLC will reset IND-N-Valid after the FLC has exchanged the Indication Buffers N and U.

Figure 5.2 Access Byte

5.1.6 Reply Update Ptr/ SDN-DDB-TIn-Tab-Ptr

The Reply Update Ptr/ SDN-DDB-TIn-Tab-Ptr pointer points to the Indication Reply Buffer, or to the SDN/DDB-TIn list (see also SDN-/DDB filter). The data buffers have to be above the UMBR_ PTR in the SPC4.

The SDN-/DDB-TIn list has the following structure: SDN-/DDB-Tln List (optional) tab-data-length 8 Bit indicates the length of the SDN-/DDB-Tln list don’t care 8 Bit Request-SA 1 8 Bit 1st entry in the DDB-Tln list Meaning like Request-SA Request-SSAP 1 8 Bit 1st entry in the DDB-Tln list Meaning like Request-SSAP.

........

Request-SA n 8 Bit n entry in the DDB-Tln list Meaning like Request-SA Request-SSAP n 8 Bit n entry in the DDB-Tln list Meaning like Request-SSAP.

Figure 5.3: SDN-/DDB List All SDN messages (except SM TIME; it is always indicated and DDB response messages can be filtered by

the SPC4 via the station table. In this station table, the “Request SA” and the “Request SSAP” are defined per entry. Only if the received SDN-/DDB message with one of the entries is plausible, there will be an indication. The SDN-/DDB filter is active if the bit “SDN/DDB filter” is set in the receive-SAP. The station table is addressed by the pointer “SDN-/DDB-TIn-Tab-Ptr”. If “tab-data-length” = 0, the SDN-/DDB-TIn list is not plausibilized.

SPC4 User Description Release V1.2 Page 21

WKF B1 T2 SPC4

In order to make it possible for the sender to process via the DEFAULT-SAP, “req-ssap=0FFh” and the expansion bit “req-sa” = 0 has to be entered in the station table on the receiver side. In all other cases, the expansion bit “req-sa” = 1 is set.

5.1.7 Special Features for the DEFAULT SAP

When using the DP mode, the following entries are also to be processed in the SAP list.

• • Reply Update Ptr D,N,U:

These 8 bit pointers point to the 1st segment respectively of the Reply Update Buffers D, N and U. In the Reply Update Buffer U, the FLC compiles the input data, and then exchanges the U-Buffer with the Reply Update Buffer N. The SPC4 responds to a request message with the input data from the Reply Update Buffer D. The SPC4 receives new input data by exchanging the D and N buffer. The Reply Update Buffers D, N and U only contain net data.

• • Response Buffer Length:

This value specifies the length of the Reply Update Buffers D, N and U (0 to 246 bytes).

• • Response Status:

specifies the priority of the response messages to the DP master. 2 values are permitted:

- 08H: response low priority

- 0AH: response high priority

• • Indication Buffer Ptr D, N and U:

These 8 bit pointers point respectively to the 1st segment of the Indication Buffers D, N and U. In the Indication Buffer D, the SPC4 enters output data received faultlessly from the master, and then exchanges (possibly not until Sync, see Chapter 2.7) the D-Buffer with the Indication Buffer N. The output data of the FLC is in the Indication Buffer U.The FLC receives new output data by exchanging Indication Buffer U and N. The Indication Buffers D, N and U only contain net data.

• • Indication Buffer Length:

This value specifies the length of the Indication Buffers D, N and U (0 to 246 bytes).

• • Active Group Ident:

This byte encodes the association of the DP slave with 8 groups maximum. Active group ident is ANDoperated bit by bit with the group select byte of a received Global Control Message (GCM). The DP slave is addressed if the bit by bit AND operation supplies a value unequal to zero at at least one position. If the group select byte of the GCM = zero, all DP slaves are addressed.

• • Control Command of a Global Command Message

Here, the SPC4 enters the last received control command of a global control message.

5.2 SM-SAP List

The structure of the SM-SAP entries is analog to the normal SAPs.

Register Meaning Control Byte Bit Information Request SA Request SourceAddress reserved reserved Reply-Update-Ptr/SDN-DDB/-Tln-

Tab-Ptr

Pointer to Reply Buffer

SAPs which are not needed are to be deactivated; for example, with Request SA=7FH.

Page 22 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

SAP Service Transmission

Description

Function Code SM1 SM_SDN 2 SM-SDN messages SM2 SM_SRD_SLOT_DEL 10 SM-SRD-Slot-Del messages SM3 SM_SRD_SLOT_KEEP11 SM-SRD-Slot-Keep messages

SM4 SM_SRD 1 SM-SRD messages SM5 SM_Time 0 SM-Time messages

Figure 5.4 SM SAP list The use of the SM-SAPs depends on the control octet. No SAP expansions are used, analog to the use of

the DEFAULT-SAP. The SPC4 recognizes from the message received (CO field) which SM service is to be executed, and assigns it autonomously to the matching SAP (see table). Like all other messages, the services SM_TIME and SM_SDN are transferred to the Indication Queue; no resources are needed for transmission (slave).

5.3 Indication Queue

5.3.1 Description

If the SPC4 receives a message, it will enter the message header in the indication queue, and then check the free length in the queue (this is possible, because one segment always has to remain free). If at least one segment (8 bytes) is free (in addition to the spec. free segment), it will continue receiving and enter the data in the queue as long as free memory is available. When receiving a request message (call), the SPC4 plausibilizes the corresponding message headers with the values specified for it from the SAP list. The Indication Queue is managed as circular buffer with read- (IND-RD) and write pointers (IND-WR). The SPC4 is responsible for the write pointer, and the FLC for the read pointer. The pointer IND-WR-PRE makes fast slave reaction possible (for DP, for example). An indication interrupt will be generated (if corresponding parameter was assigned) after the correct receipt of the request message, and not at the end of the next message to another station.

BEGIN-PTR

IND-RD

IND-WR

Indication Queue

Indication Block n-1

Indication Block n

Indication-Block

Response Header (2 Byte)

Request Header (6 Byte)

Request Buffer

(max. 246 Byte)

resp-buf-ptr (8 Bit) indic-status (00 valid, CFH invalid)

req-data-length rem-adr loc-adr co-code rem-sap loc-sap

Figure 5.5: Structure of the Indication Queue If a message is received without SAP expansion (rem SAP, loc SAP), the SPC4 will enter 0FFh in the

corresponding cell.

SPC4 User Description Release V1.2 Page 23

WKF B1 T2 SPC4

Page 24 Release V1.2 SPC4 User Description

5.3.2 Structure of the Indication Block

SPC4 WKF B1 T2

SPC4 User Description Release V1.2 Page 25

WKF B1 T2 SPC4

Response Header

Byte 0 resp-buf-ptr This pointer points to the relocated response buffer (in the area Reply-On-

Indication blocks, see Memory Area Distribution). It is recopied by the SPC4 from the SAP list

Byte 1 indic-status Here, the SPC4 enters the status 00 for a ‘valid indication’.

Request-Header (Message Header of the Requester)

Byte 2 req-data-

length

Byte 3 rem-adr Here, the SPC4 enters the SA received. The remote station, which is to

Byte 4 loc-adr Here, the SPC4 enters DA received. Byte 5 co-code This value specifies the function code of the request message. Here, the

This value specifies the length of the entered net data in the request buffer (0 to 244 Bytes with SAP expansion, 0 to 246 bytes without SAP expansion).

maintain data traffic with the respective SAP of the local station {sentence not quite clear in original}. It can be entered in the SAP lists under req-sa as filter.

complete control octet, as received from the bus, is entered. Function Code

Request FDL-Status with Reply x9H Send Data with no Acknowledge low x4H Send Data with no Acknowledge high x6H Send Data with Acknowledge low x3H Send Data with Acknowledge high x5H Send and Request Data low xCH Send and Request Data high xDH SM_Time x0H SM_SRD x1H SM_SDN x2H SM_SRD_SLOT_DEL xAH SM_SRD_SLOT_KEEP xBH Send and Request Data with DDB x7H DDB-Response low y8H DDB-Response high yAH x: Frame Type 1; that is, Bit 6=1 and FCB/FCV according to message entry y: Frame Type 0; that is, Bit 6=0 and station type1 according to message entry

Bit 7 (b8) of the control octet received is only evaluated for SM time messages; for all other request messages, bit 7 (b8) of the control octet is don´t care

Byte 6 rem-sap Here, the SPC4 enters the service access point (SSAP) of the remote

station. This field is only valid if the expansion bit in rem-adr is set (the two upper bits of rem-sap have to be ‘0’ ). If a message is received without SAP expansion (rem-SAP, loc-SAP), the SPC4 will enter 0FFh .

Byte 7 loc-sap Here, the SPC4 enters the service access point (DSAP) of the local station.

This field is only valid if the expansion bit in rem-adr is). If a message is received without SAP expansion (rem-SAP, loc-SAP), the SPC4 will enter 0FFH .

Request Buffer contains the received message Byte 8 data 0 Byte 0 of the net data Byte

data 0+x Byte x of the net data

8+x Figure 5.6: Indication Block

Note: For PROFIBUS, the station-type is bit 5 (b6) und bit 4 (b5), for PA bit 7 (b8) is relevant in addition.

Page 26 Release V1.2 SPC4 User Description

SPC4 WKF B1 T2

5.4 Reply on Indication Blocks

5.4.1 Function

The FLC has to load response data in the buffers of the Reply-on-Indication blocks. If response data is requested, the SPC4 will fetch the reply update pointer from the corresponding SAP lists, and transmit the loaded data from the reply buffer. If the request is processed, the SPC4 will indicate {index} the request by entering the status (valid indication) in the response buffer, setting the write pointer to the next free segment and generate the interrupt IND. A request is processed and will be indicated if:

• an SM message, an SDN- or a DDB response message was received faultlessly.

• an SDA- or SRD message was received faultlessly, the response has been transmitted and the next

request message to another station or (with toggeled FCB/FCV bits) to its own station address was received correctly.

If the SPC4 receives an SRD- or a DDB request message with net data length = 0, and if the response data length also = 0, the SPC4 will not enter this message in the indication queue(empty polling). With a bit in the responder status (byte 2), the FLC can control how often the loaded data is transmitted from the indication reply buffer. If Bit (4):single update reply is set in “resp-status” of the indication reply buffer, a loaded response in the indication reply buffer is transmitted only once. If this bit = log. “0”, the SPC4 will again transmit the buffer to this SAP with each call message (multiple update reply). The less significant nibble (lower 4 bits) indicates whether the request is transmitted high priority or low priority.

5.4.2 Structure of the Reply-on-Indication Blocks

Area of Reply-on-Indication Blocks

WRAP AROUND

-PTR1

Indication Reply Buffer

Indication Block

Byte 1

Byte 2

Net Data

Buffer of Responder

resp-buf-ptr

Reply-Update-PTR (SAP List)

resp-buf/data-length resp-status

(08h,18h: low priority 0Ah,1Ah high priority)

Figure 5.7: Structure of Reply-on-Indication Block

The response buffer is attached to the area ‘Reply on Indication Blocks’ and contains the response buffer length, the response status and the pure net data of the response message.

SPC4 User Description Release V1.2 Page 27

+ 67 hidden pages

SIMATIC SPC4 User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual