PSDIRECT

CitectSCADA Driver for Siemens

S5 and S7 PLCs

User information and design

PSDIRECT driver for CitectSCADA

Driver version history

Version Modified By Details
2.00 JFP 2.0 is the Stable version after Initial development
2.01 JFP Fixed problem with S5 LONGS
Fixed S7 I PI & PE addresses
Improved some sections & troubleshooting
2.2 JFP • Added extra DCB validity checks everywhere & made sure of
potential string overflows

• Compiled against the CTDDK V6 (don’t seem to be any major

changes)

• Added support for Siemens S7 "STRING" Data type (new

feature, not supported by S7NT)

2.2.1 JFP Added S7-200 support to backend

PSDIRECT driver for CitectSCADA

Contents
1 User information.......................................................................................................... 5

1.1 Application notes for PSDIRECT CitectSCADA Front-end Interface.....................5

1.2 Introduction ...........................................................................................................5

1.3 Advantages over the traditional CitectSCADA Drivers..........................................5

1.4 Advantages over the Siemens Softnet Solutions ..................................................6

2 Structure of the driver ................................................................................................ 7

3 Setup guide .................................................................................................................. 8

3.1 Step 1 Install the PSDIRECT CitectSCADA front-end driver ................................8

3.2 Step 2 – Install the Back-end Driver......................................................................8

3.2.1 Step 3 – Install “Siemens H1 ISO transport” (Not used for TCP/IP).................................................... 8

4 Setting Up the driver................................................................................................. 11

4.1 Setting Up using the serial MPI...........................................................................13

5 Quick start Simple CitectSCADA configuration ................................................... 14

6 Frequently asked questions & troubleshooting ................................................... 15

7 Reference: Required components.......................................................................... 18

7.1 CitectSCADA ......................................................................................................18

7.2 Operating Systems .............................................................................................18

7.3 Recommended System.......................................................................................18

7.4 Network Card ......................................................................................................18

8 Reference: Communications Forms ...................................................................... 19

8.1 Boards Form .......................................................................................................19

8.2 Ports Form ..........................................................................................................19

8.3 I/O Devices Form ................................................................................................20

8.4 Driver Caching ....................................................................................................20

8.5 I/O Devices form settings ....................................................................................20

8.6 Reference: Data types ........................................................................................20

8.6.1 Reference – Tag Addressing.................................................................................................................... 20

PSDIRECT driver for CitectSCADA

8.7 Driver reference ..................................................................................................23

8.8 Driver generated error codes ..............................................................................24

8.9 Parameters, options, and settings.......................................................................24

8.9.1 Standard Parameters .............................................................................................................................. 24

8.9.2 Driver Specific Parameters ...................................................................................................................... 25

9 Analysis & Trouble Shooting .................................................................................. 26

10 Using the Special Debug addresses ...................................................................... 27

10.1 For the S5 PLC the Status addresses are as follows..........................................27

11 Migration from S7NT driver systems ..................................................................... 28

11.1 Communication forms .........................................................................................28

11.2 Back-end Configuration ......................................................................................28

11.2.1 Backend IO devices................................................................................................................................. 28

11.2.2 Backend IO Blocks ................................................................................................................................ 28

12 Communication Optimisation ................................................................................. 30

12.1 How to Measure Driver Performance..................................................................30

12.2 Optimisation Techniques ....................................................................................30

13 Using the Stress test example project ................................................................... 31

14 Setting Up Heartbeat monitoring ............................................................................ 32

15 S7 200 Setup .............................................................................................................. 34

PSDIRECT driver for CitectSCADA

1 User information

1.1 Application notes for PSDIRECT CitectSCADA Front-end Interface

Type Detail
Manufacturer www.ProSCADA.com
Device name Siemens S5 and S7 PLCs
Communications method Direct DLL interface into driver poll cache MMF

The following CitectSCADA Drivers may be replaced by this Driver

S7NT – Siemens Softnet systems

S7NTSP Siemens misaligned real addressing

SINEC Siemens TF Systems for S5

Applicom – Layer 4 for S5

1.2 Introduction
In large applications where CitectSCADA has to talk to many Siemens PLC’s, a need has
arisen to have a higher performance Siemens Driver interface. Simatic Net has a lot of
limitations on the number of PLCs it can connect to and also the performance of the
Siemens API has been an issue. CitectSCADA also needed a way to optimise the way
that it communicates to the PLCs, particularly if the user attempted to poll large
configurations of Function block instance DB’s directly (User Defined types).

The PSDIRECT CitectSCADA direct interface driver is a front-end / back-end driver,

meaning that the driver consists of two parts:

The back-end server polls the data from the PLC’s at configurable intervals. The
back-end puts the data in a memory cache.

The front-end is a native CitectSCADA driver that reads the data from the cache
instantly with 0 delay (does not poll the PLC’s).

1.3 Advantages over the traditional CitectSCADA Drivers

This has the following advantages:

1. The Polling of the data is completely de-coupled from the rate at which the clients
are requesting it, which means the clients cannot choke up the IO server with
requests - no matter how badly the system is configured.

2. With a traditional CitectSCADA Driver, all polling is Dynamic & client driven. With
this driver each block of data has an individual poll time. This allows each block
of data to be optimised to poll as SLOW as is acceptable for that sub-application.
This then leaves more resources available for other data that needs to be faster.
For example: poll analog’s at 5 second interval, set-points & run-hours at 30 second
PSDIRECT driver for CitectSCADA

interval. Operator perception of speed is associated to digital status and alarm

inputs. These can be polled at 0.5 seconds intervals.

3. The data is already available when a client polls it and data is displayed immediately
without delay. For example popup screens open instantly with data from the cache.

4. The back-end polls raw blocks of data from the PLC. The front-end can then request
any data type from this one polled block. This results in substantial efficiencies
when you have many mixed data types in close address proximity. For example:
Siemens Instance DB’s (User Defined types) like the PID loop DB’s are very
complicated structures containing floats, words & bits. The CitectSCADA S7NT
driver would generate a poll for each data type whereas this driver would read the
information in one network poll block of bytes to be stored in the cache, the Front
end driver then processes a CitectSCADA Driver request for each data type from
the same cached data.

5. Communications can be configured and debugged outside CitectSCADA.

1.4 Advantages over the Siemens Softnet Solutions

This section refers to the Siemens Ethernet back-end.

To setup Siemens Simatic Net on a PC and to test the communication can be very tedious.
Multiple IO servers have to be used to communicate to more than 20 PLC effectively.

The PSDIRECT driver will take 5 minutes to install. The driver works with any standard
10MB, 100MB or 1GB Ethernet card. To date more than 50 PLCs on a single system have
been tested with one standard 100Mb card. Multiple Ethernet cards can be used to
communicate to PLCs, however there are no real performance or reliability gains. The
driver works equally well sharing CitectSCADA, Windows workgroups, & Siemens ISO thru
1 Ethernet card. A good Ethernet switch handles different link speeds & network node
isolation & redundancy.

The PLC’s are the bottlenecks & the total Ethernet bandwidth used by the Ethernet card is
< 5% typically. This driver maximises the communication to all the PLC’s on you network
by implementing a multithreaded parallel polling strategy.

This driver supports up to 64 PLC’s on one Network. It has been proven on a system with
50 PLC’s & 80 000 IO.
PSDIRECT driver for CitectSCADA

2 Structure of the driver

The different protocol levels are displayed in the table below:

Citect32.EXE

PSDirect.DLL (standard Citect driver)

<xxx>STSR.DLL (depends on protocols)

Driver Poll Cache Memory mapped file

SIXSPOLL.EXE (back end polling)

Siemens H1 ISO Transport OR TCP/IP

The flow of information in the driver starts at the network protocol “Siemens H1 ISO
Transport”. This protocol is supplied with the driver. No Siemens hardware or software is
required at the CitectSCADA side.

The Polling of Blocks of data from the PLC is performed by the hidden application
<xxx>SPOLL.EXE. This application is started whenever client applications request data.
On start-up, the last configuration file used is opened. The application copies the
configuration file into a memory mapped file (MMF/CACHE) and then updates all polled
data to the MMF.

The tag interface DLL SIXSTSR.DLL converts IO address strings into internal references to
find the data in the MMF.

The PSDirect.DLL is a standard CitectSCADA Array block driver which reads the tags using
Native PLC address references. This means you can configure an IO Server with a
minimal “Comms” project and run different tag projects on the Display Clients as per normal
CitectSCADA conventions.
PSDIRECT driver for CitectSCADA

3 Setup guide

3.1 Step 1 Install the PSDIRECT CitectSCADA front-end driver

This is provided as a standard CitectSCADA Driver install package, just run the Setup.exe
provided and make sure you choose the correct install directory for the version of
CitectSCADA.

**Note After installing, It is recommended that you copy

CitectSCADA\Bin\PROTDIR.DBF to both the user\<project>\Include AND the main or
Comms Projects. (ref KB Q2546)

3.2 Step 2 – Install the Back-end Driver

Install the Siemens Ethernet Driver by running the setup.exe provided.

The recommended install location is the Citect\Bin Directory.

Recommended Program Group on the Start menu is “CitectSCADA”.

3.2.1 Step 3 – Install “Siemens H1 ISO transport” (Not used for TCP/IP)
*This step is optional, depending on the protocols used to talk to the PLC’s, if you are
using TCP/IP you DO NOT Require the ISO transport – Please go to Section 4 Setting up
the driver.

Now you need to install the low level “Siemens H1 ISO transport”

This installation is only required for the Siemens Ethernet Driver.

1. Open the “Settings | Control Panel”

2. Open the “Local Area Network Properties” Settings

3. Go to the “Protocols” tab

4. Press “Add”

5. Press “Have Disk”

6. Enter or browse to the following path “<Install disk>\ISO\WIN2000 & XP\”

PSDIRECT driver for CitectSCADA

7. Press “OK”
PSDIRECT driver for CitectSCADA

8. You will see a prompt “ISO transport for Siemens H1”

9. Press “OK”

10. Close and restart the computer

PSDIRECT driver for CitectSCADA

4 Setting Up the driver

Run the “Siemens Industrial Ethernet Driver Configurator”

The Default configuration file will open, this includes 3 PLC’s an S5, S7 & TI.

Since you will probably be using an S7 select the S5 PLC & press delete, do the same for
the TI PLC

The S7 example configuration is setup to poll M0-M99; this address exists in all S7 PLC’s
so it should poll correctly without setting up a Step 7 program on the PLC.

Before setting addresses etc. please set the protocol type in the channel settings

• Open the channel settings to set the protocol – press the button
PSDIRECT driver for CitectSCADA

You have a choice between TCP/IP and ISO. If ISO is chosen then the ISO transport must
be installed (supplied with the driver).

• Set the PLC’s address, for ISO this is a 12 digit Hexadecimal MAC address, for
TCP/IP this is of the form 0.0.0.0

• Now press ok to go back to the main device settings

The read TSAP setting defaults to “R=0;S=2” which means read the CPU in Rack 0 Slot 2.
This is Correct for an S7-300. On a S7-400 with 2 slot power supply, meaning the CPU is
in Slot 3, this should be R=0;S=3. **Note the Slot is the slot number of the CPU, NOT the
CP 443 card!

***For the S7-200 PLC set the read TSAP to “CP243” because the S7-200 does not comply
with the rack & slot system.

Now “Reload” the configuration by pressing the button. This is IMPORTANT; always
reload any configuration change changes. The configurator works on the configuration file
on disk, the reload command loads that into memory, briefly interrupting the polling as it
does so

Now check that you have communications. The transmit and receive counters at the
bottom of the window should increment

The Status of the M0 block should change to a

PSDIRECT driver for CitectSCADA

4.1 Setting Up using the serial MPI

The Serial S7 Driver uses a different Backend driver to the Ethernet however the
configuration is almost identical. The main difference is the Channel settings where you
setup the com port & baud rates. The Local MPI address is normally 1, if you have 2
SCADA’s on the network then you need to set SCADA to 1 & SCADAB to 2 (No PLC may
then use 2) & enable the Multi master setting.
PSDIRECT driver for CitectSCADA

5 Quick start Simple

Simple CitectSCADA configuration
Follow the following steps to configure a CitectSCADA application to the sample above.

** There is an example CitectSCADA project installed with the PSDIRECT Front end driver
in “C:\Program Files\Citect\CitectSCADA\PSDIRECT Sample”

Read more about it in The Appendices at the end of this document. The following is a
simple Fresh setup.

Create a new CitectSCADA Project

DO NOT create a Boards object

Add a Port & Call it “p1” (set address to 0, all other fields blank incl. the board)

Add an IO device call it “TEST” the same as the driver configuration on “p1”

Set the address to “S7;Ethernet” or “S7;MPI” for serial

Set the Protocol to “PSDIRECT1”

Add a Tag with IO device “TEST” & IO Address “M0” data type set to INT.

Put the tag on a mimic; compile the application and start CitectSCADA.

Verify the correct data is displayed on the mimic.
PSDIRECT driver for CitectSCADA

6 Frequently asked questions & troubleshooting

Q: What do the Icons in the configurator mean ?

A:

The block is healthy & contains current data

Communications failure

The block is currently not in use, it is off poll, all the blocks on a backup
server should be in this state

This block is newly configured & is not currently being polled. You need
to reload the configuration

Q: I am unable to get communication, what are the most common problems?

A: If using ISO protocol Check that the siemens ISO transport is installed, if you see
the message in the bottom window “failed to open ISO channel 1” then the ISO
transport is not correctly installed OR there may be a problem in the registry and the
driver is not using the correct Ethernet card.

The read TSAP setting defaults to “R=0;S=2” which means read the CPU in Rack 0
Slot 2. This is Correct for an S7-300. On a S7-400 with 2 slot power supply,
meaning the CPU is in Slot 3, this should be R=0;S=3. **Note the Slot is the slot
number of the CPU, NOT the CP 443 card!

If you have 2 CitectSCADA’s communicating to a S7-300 the third CitectSCADA

connection will fail. By default the S7-300 has 8 communication channels – 2 for
step 7, 2 for SCADA, 4 for PLC-PLC, This configuration can be changed in later
model CPU’s

Q: Why do I see messages like “No- Address Error DB15,W248” in the bottom window
of the configurator ?

A: This means that Citect is reading that address however this address is not
configured for polling.

• It is Crucial to Fix this issue, before doing any other testing

• Note that this issue may occur with I & Q addresses where you have many small
non-contiguous poll blocks in the backend. What is occurring is that Citect is
aggregating address blocks. The only possible solution is to use the small
blocksize version of the front end driver- this means changing the Citect IO device
protocol from PSDIRECT1 to PSDIRECT6. This change may still not eliminate the
reporting of the errors however Citect will get valid data.

• You only see these errors when Citect tries to access the data, so seldom used
addresses may not be noticed.

• There are 2 Semi automatic methods of solving this

PSDIRECT driver for CitectSCADA

o By selecting Menu>Options>Learn addreses, the configurator uses those

error messages to stretch existing blocks or add new ones.

o By selecting Menu>Options>Import Addresses. The configurator can add /

stretch blocks by using a VARIABLE.DBF or VARIABLE.RDB file. This
works better than the learn address method because you get ALL the
address's in the project. If you open a UNITS.DBF file it will add IO Devices
to the backend.

***Note this only changes the edited version you need to “reload” to make it
active. Then you should see fewer address errors, you then need to Learn
addresses again. Read more

Q: How do I update the configuration after making changes ? Or why do newly added
blocks show a status

A: Save the file then Select File|Reload off the menu, or press

Q: I have problems reading Direct S7 IO (I,Q,PI etc.) what do I do ?

A: You need to make sure that the poll blocks exactly match the configuration in the
PLC. The PLC WILL NOT allow you to poll across an address for which no IO
cards exist. You need to break this up into smaller blocks. **Note Citect Does not
recommend writing directly to outputs for safety reasons.

Q: How do I setup the IO server to enable redundant CitectSCADA IO Servers ?

A: Set the INI file parameter “AlwaysReturnNoError” = 0 (this is default)

The poll block ST0->ST200 must be defined in the driver poll configuration

Now if the driver loses communication to the PLC the Unit status will go bad &
CitectSCADA’s redundancy system will switch over to the backup IO Server

**Note the “AlwaysReturnNoError”=1 is intended for debugging only. When set you
will see correct values only if the driver is successfully polling, if not INVALID data
may be displayed & no redundancy failovers will occur.

Q: My communications are Slow, WHY ?

A: Please Note the following, typical performance achievable

• This driver polls as fast as the PLC allows, the PLC is the bottleneck(slow side), the
figures below are per PLC, the driver performance scales linearly per PLC.

• S7-315 CPU typically achieves 15-20 polls per second (We believe it is crippled)

• S7-416 CPU typically achieves up to 150 polls per second (10 x faster). This is with
2 IO Devices talking to the same PLC.

• A Vipa PLC typically achieves up to 40 polls per second with default settings, if
communications resources are increased this can reach 100+
PSDIRECT driver for CitectSCADA

• The driver has a Built in Limit of 100 polls per second per IO Device, so in some
cases you can get better performance by splitting your data into 2 IO Devices.
However we do not recommend this as, the spare PLC resources should be
reserved for Writing data & PLC-PLC communications & other Citect IO servers.

Q: The communications are Slow, how do I make it faster ?

A: read the section about optimisation & try some of the following modifications at the
PLC side.

• Try to increase the PLC scan cycle by moving code to the Idle processing OB’s OR
process half the code each scan & thereby doubling the scan cycle.

• Try Increasing the PLC process time dedicated to communications this is in the
CPU Properties seen below

Q: How do I configure communications to an S5 PLC ?

A: This is more complicated than an S7 Please read the Driver help file for Full
instructions. In addition there are example PLC programs in the backend
distribution in the PLC directory.

Q: I keep getting an error “Nio-niomap() different from map popup box ?

A: You are using more than one IO Channel device on the IO server, please put all IO
Devices including different PLC types under one single IO Channel object.

Q: I have redundant PLC’s can I configure redundancy at a lower level than the Citect
level ? i.e. use a single Citect IO device but 2 IP addresses in the backend.

A: Yes simply configure the second IP addresses & rack & slot in the Backup fields
PSDIRECT driver for CitectSCADA

7 Reference: Required components

7.1 CitectSCADA

CitectSCADA V5.41 or higher.

CitectSCADA V5.50 has the most installations at this time.

CitectSCADA V6.0 has been successfully tested

7.2 Operating Systems

Windows NT4 SP4 or later

Windows 2000 (Pro or Server)

Windows XP SP1

Windows 2003 Server

Windows 9x, Millennium NOT SUPPORTED for ISO protocol

7.3 Recommended System

P3 or higher with recommended memory for the Operating system

Windows NT4 SP4 – 128MB

Windows 2000 Pro – 256MB

Windows 2000 Server – 512MB

Windows XP Pro SP1 – 512MB

7.4 Network Card

Any NDIS compatible card should work. Named brands are recommended for best
performance.

*** NOTE NO SIEMENS SOFTWARE OR HARDWARE REQUIRED

***NOTE When using the ISO protocol DO NOT install any siemens software on the
machine.

***NOTE Some problems have been encountered with Broadcom cards, recommend Intel
PSDIRECT driver for CitectSCADA

8 Reference: Communications Forms

8.1 Boards Form

This driver does not require a BOARDS object for later versions of Citect. Some people
have reported problems omitting the board on this driver if they use other drivers that
require boards. Adding The Board object WILL NOT cause problems, however you may
see messages at startup complaining about it.

8.2 Ports Form

Note: Unlike the S7NT driver, only 1 port is required on the IO server; performance is just
as good with only 1 because it is reading instantly from a cache. Please note this includes
the case where you have both S7 & S5 PLC’s only use Channel. If you use Both the
Ethernet & Serial drivers put the serial devices on a separate port.

Field Default Allowable values

Port Name This field is user defined and is not used by the driver.
Port number 0 Any value, other than “”
Board name Leave blank Board is not required
Baud rate Leave blank
Data bits Leave blank
Stop bits Leave blank
Parity Leave blank
Special Opt Leave blank
Comment This field is user defined and is not used by the driver.
PSDIRECT driver for CitectSCADA

8.3 I/O Devices Form

The Address AND Protocol refers to the Address format of the tags & also specifies the
type, the combination is used to decide which Driver DLL to load & what address format to
Use. The following table lists the allowable combinations.

PROTOCOL Address Comment

PSDIRECT1 S7;ETHERNET Siemens Industrial Ethernet S7 PLC’s
PSDIRECT1 S7;MPI Siemens Serial MPI
PSDIRECT2 S5;ETHERNET Siemens Industrial Ethernet S5 PLC’s
PSDIRECT3 Conet OmniFlex Conet with timestamping
PSDIRECT4 TI Texas Instruments H1
PSDIRECT5 IEC;<common addr> IEC 870-5-101, with common address
PSDIRECT6 S7;ETHERNET Same as PSDIRECT1 with 32 bit
blocksize. S7NTSP replacement
PSDIRECT6 S7;MPI Same as PSDIRECT1 with 32 bit
blocksize. S7NTSP replacement

8.4 Driver Caching

This driver has its own cache, it is therefore not necessary to cache data on CitectSCADA
side the recommended cache enabled setting is FALSE. This will make it at least 300 ms
faster than the defaults.

8.5 I/O Devices form settings

Field Default Allowable values
Name Set to the same as the Device name in the Driver Configurator
Number Must be unique, but is not used by the driver.
Address See above Specifies addressing & back-end driver
Protocol PSDIRECT<n> See table above
Port name Refers to the port previously defined in ‘ports’ form.
Comment This field is user defined and is not used by the driver.
Enable Caching FALSE
Cache time Not used – no cacheing300 but set cache to FALSE

8.6 Reference: Data types

Note: This driver is designed to mimic other CitectSCADA drivers & should supply all the
same addresses & data types as the equivalent CitectSCADA driver does.

8.6.1 Reference – Tag Addressing

This driver supports many different Addressing formats depending on the device in use.

8.6.1.1 Siemens S7 Addressing

The S7 addressing is designed to be compatible with that used by the Standard Citect
S7NT Driver.
PSDIRECT driver for CitectSCADA

CitectHMI/SCADA Data
Address Format Type
Digital, Byte, INT, BCD, LONG,
DB<no>,<index>[.<bitno>] LONG_BCD, REAL, STRING
Digital, Byte, INT, BCD, LONG,
DI<no>,<index>[.<bitno>] LONG_BCD, REAL, STRING
A<index>[.<bitno>] INT, BYTE, Digital
Q<index>[.<bitno>] INT, BYTE, Digital
E<index>[.<bitno>] INT, BYTE, Digital
I<index>[.<bitno>] INT, BYTE, Digital
Digital, Byte, INT, BCD, LONG,
M<index>[.<bitno>] LONG_BCD, REAL, STRING
PA<index>[.<bitno>] INT, BYTE, Digital
PQ<index>[.<bitno>] INT, BYTE, Digital
PE<index>.<bitno> INT, BYTE, Digital
PI<index>.<bitno> INT, BYTE, Digital
T<index>(10ms) BCD (PLC s5time format)
T<index>(100ms) BCD (PLC s5time format)
T<index>(1s) BCD (PLC s5time format)
T<index>(10s) BCD (PLC s5time format)
Z<index> BCD
REAL (PLC s5time format - See note 1
TDB<no>,<index > below)
REAL (PLC s5time format - See note 1
TDI<no>,<index > below)
REAL (PLC s5time format - See note 1
TM<index > below)
Siemens STRING data type (See
SDB<no>,<index> note 5 below)
S7-200 V memory area see
V<index>[.<bitno>] S7200

Syntax:
The syntax is defined as follows (case insensitive)
DB<no> <index>
DI<no> <index>.<bit no>
<area>
Where:
DB or DI data block or instance block
<no> number of the data block or instance block
<area> A output
Q output
E input
I input
M bit memory
PE peripheral input
PI peripheral input
PA peripheral output
PSDIRECT driver for CitectSCADA

PQ peripheral output
<index> element number relative to start of block
<bitno> bit within the element number
NOTE:

1. Addressing format T, TDB, TDI, TM: When one of these address formats is used,
the Sseven driver will convert a time value (from CitectHMI/SCADA Real to
Siemens S5Time or vice versa) using the smallest time base it can fit in. Range: 0 -
9990.00 seconds. (0 <= Values < 0.01 will be truncated to 0 and Values > 9990.01
will generate an Alarm). Precision may suffer in the conversion, e.g. 10.01 will be
converted to 10.00 (1100 S5Time format).

2. Addressing: DB, DI, A, E, M, PA , PE, TDB, TDI, and TM are using byte
addressing. T, C, and Z are using word (two bytes) addressing. They are the same
as in STEP7.

3. STRING data type: CitectHMI/SCADA STRING data type is not the same as
Siemens' STRING data type. It is equivalent to Siemens' CHAR Array data type. A
NULL terminator (Siemens' BYTE data type, value = 0) is required. If Siemens'
STRING needs to be accessed accessed, use the SDB Address.

4. the TDB & TM S5 timer data types are supported, however note the following
caveat. If the tag data type is INT the value returned is in seconds, the address in
the PLC is a 16 bit int and arrays function normally. If the data type is REAL the
value is also in seconds & sub seconds but addresses must be on 4 byte
boundaries – skipping blank word addresses in the PLC CitectSCADA S7 Drivers.

5. S7 STRING data type is supported using the SDB address. There is a serious
limitation however, ONLY 1 STRING is supported per DB, or at least block size
apart. The Citect array size should be < the S7 Max string length. The values may
be written from Citect & the string length byte will be set by the driver. The string
will only read up to the max string length.

The following addresses are not supported:

T Siemens Timer

C Siemens Counter
*Note: Siemens Timer & counters in TM & TDB memory IS supported

**An Additional Address the SW addresses is available for status & debugging please read
Using the Special Debug addresses
PSDIRECT driver for CitectSCADA

8.6.1.2 Siemens S5 Addressing

The Siemens S5 Addressing is designed to emulate the “SIEMENS.DBF” protocol. This
may differ from the TF/Sinec or applicom addressing. The address format is almost
identical to that used in the Step 5 programming software.

Data
Types Address Format CitectHMI/SCADA Data Type
DATA BCD / DIGITAL / INT / LONG / LONGBCD /
WORDS D<data block>:<word> REAL / STRING
DIGITALS D<data block>:<word>.<bit> DIGITAL
DATA BCD / DIGITAL / INT / LONG / LONGBCD /
WORDS DX<data block>:<word> REAL / STRING
DIGITALS DX<data block>:<word>.<bit> DIGITAL
Timer TDB<data block>:<word> INT,REAL

EXAMPLES:

Data Type DIGITAL

Address D010:001.14

Comment Digital - Block Number 10 : Word Number 1.Bit Number 14

Data Type INT

Address D0010:002

Comment Data Word - Block Number 10 : Word Number 2

8.6.1.2.1 Note on converting SINEC addresses

The Sinec TF system has an extra layer of abstraction that names memory objects to TF
names. Normally in CiTect projects these memory variables are arrays of 16 bit words. To
convert these addresses :

• Look in the TF configuration and find the Data block address of each TF array

• Search & replace the VARIABLE.DBF file with <TF array name> replace with
D<dbn>:<add DB offset to TF array index>.<bit>

8.7 Driver reference

Detail
Driver name PSDIRECT
Maximum array size PSDIRECT1 1008 Bits
Maximum array size PSDIRECT6 32 Bits
PSDIRECT driver for CitectSCADA

8.8 Driver generated error codes

PROSCADA_ERR_NO_TAGS 0x100

PROSCADA_ERR_BAD_OID 0x101

PROSCADA_COMMS_ERROR 0x102

PROSCADA_BAD_DATA_TYPE 0x103

PROSCADA_UNSUPORTED_CITECT_TYPE 0x104

PROSCADA_BAD_IOADDRESS 0x105

PROSCADA_BAD_SIGNALCOND 0x106

PROSCADA_BAD_HWOPT 0x107

PROSCADA_DLL_LOAD_FAIL 0x108

PROSCADA_WRITE_FAIL 0x109

PROSCADA_ISO_NOT_CONNECTED 0x10A
• Backend is not connected to the PLC – comms fail, unit offline

PROSCADA_ADDRESS_ERROR 0x10B
• Address does not exist on backend

PROSCADA_UNDEFINED_PROTOCOL 0x10C
• The Unit address settings were not recognised

PROSCADA_HEARTBEAT_FAILED 0x10D
• PLC is in Stop mode OR heartbeat monitoring is enabled but the variable is
not changing.

PROSCADA_BACKEND_NOT_RUNNING 0x10E
• The backend driver SIXSPOLL.EXE has stopped running

8.9 Parameters, options, and settings

8.9.1 Standard Parameters
Parameter Default Allowable values
Block (bits) 1008 8-1008 (max 126 character strings)
PSDIRECT6=32
Delay (mS) 30000 1000-60000
MaxPending 8 Not critical with this driver, it replies instantly
Polltime (mS) Not used
Timeout (mS) Not used
Retry Not used
WatchTime (Sec) 10 (rate at which offline IO devices are checked)
PSDIRECT driver for CitectSCADA

8.9.2 Driver Specific Parameters

Parameter Default Allowable values
AlwaysReturnNoError 0 0 Should be selected for Backup
failover & displaying #COM on screen.
It is useful to set this to 1 when testing
with no PLC then you can use the
learn address feature even if you have
no PLC.
ValueIfCommsErr 0 Value to display on screen if
Communications to PLC fail set to
something like ‘888” to make it
obvious
HeartBeatAddress_<devname> No Hb The S7 driver continues polling
normally when the PLC is in Stop
mode resulting in frozen values on the
screen. To force #COM when the
PLC is in stop mode requires
configuration of Heartbeat monitoring
read more about it in Heart beat
monitoring section of this document

To add these parameters to the CITECT.INI file use the following format

[PSDIRECT]

AlwaysReturnNoError=1

**Note setting the AlwaysReturnNoError to 1 like this is only useful for testing or
engineering purposes.
PSDIRECT driver for CitectSCADA

9 Analysis & Trouble Shooting

Things to do on a call out to the IO server:

Check to see if there are any popup dialogs from CitectSCADA or the Driver
indicating a problem, if so write down the message displayed.

Open the kernel & View the Driver’s page

Check the “Driver Errors” & “Timeouts” counters

If these two counters are incrementing then CitectSCADA variables are addressing
variables not configured in the back-end driver.

Check which IO devices (PLC’s) are offline in CitectSCADA

Open the CitectSCADA kernel and go to the IO Servers page

The statuses on the left indicate what is happening on this IO server, the statuses on
the right indicate the status of the IO Server currently in use.
PSDIRECT driver for CitectSCADA

10 Using the Special Debug addresses

This driver is a cached Front End / Back End driver, so the standard CitectSCADA driver
statistics are not very useful. This section describes the Special Tag addresses available
for debugging purposes. All data types are INT

ST2 Conn State 0 means trying to connect to PLC, 2 means Connected

ST24 Reconnections Increments every time the driver attempts to reconnect after
the connection a failed. If this is going up, you have a bad
network

ST26 Poll recs per sec Poll rate for this PLC - useful for checking optimisation.
The rate in mission control should be the sum of these.

ST28 Disconnect Req’s Increments when PLC sends Disconnect Request. This
Means that your Network is OK but the CP143 setup is not.
The PLC is refusing connection requests.

10.1 For the S5 PLC the Status addresses are as follows

ST1 Conn State 0 means trying to connect to PLC, 2 means Connected

ST12 Reconnections Increments every time the driver attempts to reconnect after
the connection a failed. If this is going up, you have a bad
network

ST13 Poll recs per sec Poll rate for this PLC - useful for checking optimisation.
The rate in mission control should be the sum of these.

ST14 Disconnect Req’s Increments when PLC sends Disconnect Request. This
Means that your Network is OK but the CP143 setup is not.
The PLC is refusing connection requests.
PSDIRECT driver for CitectSCADA

11 Migration from S7NT driver systems

This is a brief summary of the steps required to migrate an existing S7NT system to the
PSDIRECT Ethernet driver.

11.1 Communication forms

No Boards form required

Delete all but 1 ports set all fields to blank, address to “0”

In IO devices (UNITS.DBF)
• Make sure name is less than 11 characters (limitation of backend)
• Set port name to the 1 port
• Set Protocol to “PSDIRECT1” or “PSDIRECT6” for S7NTSP
• Set Address to ”S7;Ethernet”

11.2 Back-end Configuration

11.2.1 Backend IO devices
The Back-end configuration may be edited in bulk using excel & File Save As *.CSV. Save
the default configuration to .CSV, and then edit it in Excel and copy data from the
UNITS.DBF file above.

From the Options Menu Select “Import Variables”

In the file dialog select the user\<comms project> directory and open UNITS.DBF

If you have a redundant system it will have imported 2 devices per PLC, delete all
duplicates.

Make sure each Device has a ST0 to ST200 IO block THIS IS NOT A PLC
ADDRESS – it is used by the front end to check unit status.

You will need to manually set the Address’s for each PLC

Remember to Save & Reload to make the configuration active

11.2.2 Backend IO Blocks

Each Citect tag must be contained inside a backend poll block. The data type of each
block is “BYTE” any Citect data type tag can be read from these blocks. If Citect attempts
to read from a address that is not currently polled you will get an NIO* IO address error in
the bottom window of the configurator. There are 2 methods of semi automatically creating
these blocks.

1. From the Options menu select “Import Variables”

• In the file dialog select the user\<root project> directory and open
VARIABLE.DBF or _VARIABL.RDB
• Remember to Save & Reload to make the configuration active
2. After creating the Backend devices you can remove any address errors by selecting
“Learn Addresses” from the options menu. This only functions while Citect is running
and the Address errors are flooding the bottom window.
PSDIRECT driver for CitectSCADA

• Note that to make the new added, or stretched blocks active you need to save &
reload the configuration.
• When this is done there may still be address errors, select “Learn Addresses”
again & reload again.
• This process is not perfect you may still have to edit some manually

To achieve optimum performance you may still need to optimise the poll times of each
block (see next section). You should at least sort the poll blocks in excel to tidy up.
PSDIRECT driver for CitectSCADA

12 Communication Optimisation

12.1 How to Measure Driver Performance

Create a minimal backend configuration with 1 poll block, 1 variable and a poll time of
0.0 seconds

Note how many polls per sec you get in the configurator status at the bottom

After measuring the speed, you can calculate the update time of your full
configuration. e.g. If you get 10 pps (Pollblocks per second), you can have
• 1 poll block updating 10 times a second or
• 10 pollblocks updating at 1.0 seconds
• 5 pollblocks updating at 1.0 seconds + 10 pollblocks updating at 2 seconds
If you configure more pollblocks, no errors will occur but you are not actually achieving your
configuration update time. In this case the driver just processes each block in turn. This is
not a problem most of the time but as you add more blocks your system will slow down & if
you need faster update on a specific block, changing its polltime will achieve little.

12.2 Optimisation Techniques

To make a limited bandwidth system appear faster, you have to slow down the updating of
less critical data to give more bandwidth to the critical data. (Increasing the poll rate of a
block when the system is already at full stretch will have no effect) The basic principle is -
poll only the data that the operator needs for a given picture & at the minimum rate he is
prepared to accept. It is usually better to set slow poll times at the start of a project which
leaves plenty of room to expand, this sets a lower expectation and if you need more speed
later you have spare bandwidth resources.

Set points, Outputs, controls or any value that never changes in the PLC (only
changes when modified from CitectSCADA) can be setup so that they hardly use any
channel bandwidth at all. Set the polltime to a large value like 60 seconds. If a value
is written the driver automatically forces the block to update so the user does not
notice the slow poll times.

Prioritize your data; find out how fast the data changes in the PLC. Do not poll faster
than necessary especially while you are constructing your system. You can always
speed up certain blocks later once your system is fully configured. Generally analog
values can be polled slower e.g. 5 sec but Digital Inputs may need 1 sec.
PSDIRECT driver for CitectSCADA

13 Using the Stress test example project

An example CitectSCADA project installed with the Front end driver in

C:\Program Files\Citect\CitectSCADA\PSDIRECT Sample\PROSCADA_test.ctz

To use this setup you need

• An S7 PLC 400 or 300 with Ethernet CP card

• Step 7 with siemens NCM to configure the PLC CP card

• A CitectSCADA machine networked to the PLC, NO SIEMENS SOFTWARE

Required

Probably the easiest protocol to use is TCP/IP

• Setup the PLC with an IP address and ping to test from the CitectSCADA

• NO Step 7 program is required or if one exists it MAY NOT modify m0-m511 OR

simply put the PLC in STOP mode.

• Set the backend driver’s channel protocol to TCP/IP

• Set the device “S7PLC” ‘s IP address

• File|reload the configuration

• Check that you have transmits & receives and the status of the blocks goes good

• Import the project into CitectSCADA, compile & run

• Open test page 1

The stress test writes huge amounts of data and reads it back comparing it to that written,
any mismatches increment the error counters.
PSDIRECT driver for CitectSCADA

14 Setting
Setting Up Heartbeat monitoring
The S7 driver continues polling normally when the PLC is in Stop mode resulting in frozen
values on the screen. To force #COM’s when the PLC is in stop mode requires
configuration of the Heartbeat monitoring feature..

For each IO device (Unit) configured, a parameter of the following form is entered into the
Citect.INI file

HeartBeatAddress_<devname>=<address>

Where <devname> is the name of the IO device in CitectSCADA and in the backend driver

And <address> is a PLC address of a variable that MUST change very 5 seconds at least if
the PLC is running. A simple way of achieving this is to increment an integer in OB1 of the
PLC scan cycle. ** The address format here is the same as the OPC server so you specify
W for Integer & D for longs etc.

Examples

HeartBeatAddress_S7PLC=MW0

HeartBeatAddress_PumpHouse=DB100,W44

HeartBeatAddress_Furnace2=DB130,D44 (long integer)

PSDIRECT driver for CitectSCADA
PSDIRECT driver for CitectSCADA

15 S7 200 Setup
1/ Run the Micro Win Ethernet Wizard
2/ We recommend that the CP243 be installed in position 0
3/ Set the CP243’s Ethernet address
4/ Configure a New connection & set it as follows

In the backend configuration set the Read TSAP field to “CP243”

You can poll the following

M0-M32 (S7-200 has very small M area)

DB1,0->x is equivalent to the "V" mem area e.g. VW8 == Citect block type INT address DB1,8
I0 len 2
Q1 len 1