Simulate S5 PLC with SINEC H1 comms

[jondownloads]

Zuviel Werbung?
-> Hier kostenlos registrieren

[Excuse me, but I don't speak German]

Hi,
I'm working on a SCADA migration. The old SCADA talks to a whole lot of PLCs, both S7 and S5. We don't have PLCs to test the SCADA so in order to perform the factory acceptance tests I'm trying to set a simulation environment.

S7 related work it's almost done, thanks to NetToPLCSim and STEP7 PLCSim.

I'm trying to address the S5 simulation problem now:
-It's there something similar to NetToPLCSim for S5? (Preferably free and open source)
-A plain SINEC H1 protocol simulator would work too. Is there any SINEC H1 communication simulator? (Preferably free and open source)

Thanks, Jon.

 

[jondownloads]

Given that no free/open source alternative seems to be available...

Could anyone suggest me a non-free SIEMENS S5 PLC simulator with communications (at least SINEC H1) included?

My first aim is to use it to set a simulation environment for factory acceptance testing. (I'd like to be able to set least 3 simultaneous connections against the PLC simulator.)

Thanks, Jon.

 

[jondownloads]

Zuviel Werbung?
-> Hier kostenlos registrieren

Hi, again.

I don't know if this question has already been addressed in this forum. I tried the following query in google:

http://www.google.es/#sclient=psy&h...gc.r_pw.&fp=a901d61e7ea32e22&biw=1440&bih=685

And used google translator (I don't speak german) in order to guess if my question had already been answered. But it's kind of hard and I guess some threads went unnoticed despite my efforts. I guess this thread is pretty the same, but it doesn't provide much information:

http://www.sps-forum.de/showthread.php?t=9469

I already tried Ibh Softect's demo version for SoftPLC S5 (along with S5/S7 for Windows demo) but couldn't get the communications working. It seems that online functions are not available for demo versions:

http://www.ibhsoftec-sps.de/english/Selection_PLC.htm

I haven't tried MHJ's software jet, I just started "playing" with it. But the manual is in german so I don't really know if I'll figure out if it fits my needs.

http://www.mhj-online.de/de/index.php?cat=c4&information&alt_content=811

I also found this one. Not tried it jet tough.

http://www.isa.uniovi.es/genia/english/download/index.htm

And this one too.

http://www.autoware.com/english/s5100.htm (but I think that the PLC model doesn't fit 'cause those PLCs don't have SINEC H1 comms.)


I'm looking for a (SINEC H1) communicable software simulator for SIEMENS S5 PLC.

I would appreciate it if anyone could provide some feedback on the tools I listed or suggest another software worth considering. It would be great.

Thanks, Jon.

 

[jondownloads]

Hi,
I tried to contact tech. support people for all the products I listed in my previous post. This is the feedback received so far:

-SoftPLC S5 ( http://www.ibhsoftec-sps.de/english/Selection_PLC.htm ):

"Our SoftPLC S5 does not support H1."



-WinSPS S5 ( http://www.mhj-online.de/de/index.php?cat=c4&information&alt_content=811 ):

"the Software-PLC in WinSPS-S5 can only be connected by WinSPS-S5.
It can not connected by a other software."



-ABC Soft-PLC Simatic S7/S5 for simulation and test ( http://www.abcit.eu/en/Products/Software/Pages/Soft-PLC.aspx ):

"Our Soft-PLC does not support SINEC H1.

The following data couplings are supported:
-Socket Interface
o Send / Receive via TCP and UDP
o Fetch / Write
-RFC1006 interface (ISO on TCP)
o Send / Receive via TCP
o Fetch / Write"


Hope it helps, Jon.

 

[tnt369]

why not using hardware?

buy a (used) s5-rack with cpu, powersupply and a cp143 ethernet card.
for example in ebay. the costs should be less then 500 euro.
if you need more then one connection you can use several
cp143 in one rack, but i´m not sure.
it should also be possible to configure several h1 connections in one
cp143.

 

[Question_mark]

Zuviel Werbung?
-> Hier kostenlos registrieren

Not available, and at least never for free ..

Hallo,

if you need more then one connection you can use several
cp143 in one rack, but i´m not sure.

You can use several CP 143 in a S5 Rack, but that depends on the S5 Rack and CPU.

it should also be possible to configure several h1 connections in one
cp143.

Sure, as far as i remember, you can establish up to 64 connections, depending on the capabilities of CP143 and S5 CPU.

buy a (used) s5-rack with cpu, powersupply and a cp143 ethernet card. for example in ebay. the costs should be less then 500 euro.

Nice idea, but you should be aware about additional costs ..

e.g. software for programming the CP143 and so on ..

-It's there something similar to NetToPLCSim for S5? (Preferably free and open source)

NACK, although im working with H1 protocol since for at least about 20 years, there is no S5 H1 Simulator available. There is no company in the market, which target is to support devices form the stoneage of PLC technology.

Regards

Question_mark

 

[jondownloads]

Thanks for your responses.

Well, our main goal is to improve factory acceptance testing to shorten site acceptance testing.

Buying hardware was discarded because, even if CP143 cards are not too expensive, SIMATIC S5-155 CPUs seem to be quite expensive. I guess that many old automation systems rely on them and spare CPUs will get more and more expensive.

So we thought software simulation could be a good alternative.

PD. May be PLC rental could be an option ;-)

 

[kaputt]

Hi!

A 155 has got a lot of power that I don't think you'll need.
I assume you want to poll values from some DB's, and a simple 928 (135U) or a 942 (115U) should do the job.
If you could specify what you intend to put in the PLC, I recon you could get good advices in this forum.

Regards
Kaputt

 

[Thomas_v2.1]

Zuviel Werbung?
-> Hier kostenlos registrieren

If you don't want to simulate the complete S5 PLC program, and you have some time in programming you could do something like this:
You take nettoplcsim and write your own "nodaveserver.dll" which implements the H1 protocol, or simply the parts you need for testing. The Plc data is read out of Step7 Plcsim instead of a S5 Plc. You could convert the datablocks of the S5 program to S7 datablocks and load them into plcsim.

The S7 protocol as basically comparable with the H1 protocol. The S7 packs ISO on top of TCP (RFC1006), Sinec H1 ist directly on OSI layer 3 without TCP.
For some details of the Sinec H1 protocol you should take a look into the corresponding wireshark dissector source code (which is written by a Siemens engineer as far I know).

But I think it will be a little more difficult to program, because you cannot use your operating systems network library functions for TCP/UDP sockets for this.

The easiest and most reliable way would be, to get an used S5 for testing.

 

[jondownloads]

I assume you want to poll values from some DB's, and a simple 928 (135U) or a 942 (115U) should do the job.
If you could specify what you intend to put in the PLC, I recon you could get good advices in this forum.

You're right. I'm not really interested in the automation logic implemented in the PLC. It's just a SCADA migration. AFAIK the automation process in the PLC dumps several values to several DBs and the SCADA retrieves them using SINEC H1 protocol.

I'm new to SIEMENS technology, I just have a few hints on S7 basic programming using STEP7, no more. So I guess I made lots of wrong assumptions...

I guess I need a S5 CPU big enough to be SINEC H1 communicable, but not bigger, e.g. 928 (115U). A rack. And a CP143. Am I right?

Thanks, Jon.

 

[jondownloads]

You take nettoplcsim and write your own "nodaveserver.dll" which implements the H1 protocol, or simply the parts you need for testing. The Plc data is read out of Step7 Plcsim instead of a S5 Plc. You could convert the datablocks of the S5 program to S7 datablocks and load them into plcsim.

The S7 protocol as basically comparable with the H1 protocol. The S7 packs ISO on top of TCP (RFC1006), Sinec H1 ist directly on OSI layer 3 without TCP.
For some details of the Sinec H1 protocol you should take a look into the corresponding wireshark dissector source code (which is written by a Siemens engineer as far I know).

Hi Thomas,
I already thought on something like that. I even took a look to Wiresharks dissector.

Besides the 'time' problem, I just see another problem... the dissector addresses packet types and packet structures, but says nothing about protocol's state machine, am I right?

Do you know we're could I get information on that topic? Is there a public SINEC H1 protocol specification? I guess that if it's not too complicated I could reverse engineer it using Wireshark. But I'd prefer a good document instead ;-)

Thanks, Jon.