Open Source PLC protocols?

Ozpeter · Apr 30, 2018

Are there any open source PLC communications protocols that would allow writing to the inputs of an Rx3i PLC? The reason I want this is for hardware simulation and testing of a PLC program.

And no, Modbus/TCP doesn't work as you cannot write to inputs, only read from them.

cardosocea · Apr 30, 2018

Ozpeter said:
And no, Modbus/TCP doesn't work as you cannot write to inputs, only read from them.

Is this a limitation of the PLC? Or a supposed limitation of Modbus? As I understsand it Function 5 and 6 are supposed to write coils and registers respectively in Modbus.

Ozpeter · Apr 30, 2018

cardosocea said:
Is this a limitation of the PLC? Or a supposed limitation of Modbus? As I understsand it Function 5 and 6 are supposed to write coils and registers respectively in Modbus.

This is a Modbus limitation

Steve Bailey · Apr 30, 2018

Use Modbus and write to %Q or %R memory in the Rx3i. Then in ladder logic you can copy the %Q or %R data to %I. The normal input scan happens just prior to logic execution, so place the rung that copies the data at the beginning of your program.
Another option is to use a 90-30 instead of Rx3i. That PLC supports the SNPX protocol which is publicly documented. SNPX permits writing to %I. The Rx3i does not support SNPX. SNPX is serial, not ethernet.

Ozpeter · Apr 30, 2018

Steve Bailey said:
Use Modbus and write to %Q or %R memory in the Rx3i. Then in ladder logic you can copy the %Q or %R data to %I. The normal input scan happens just prior to logic execution, so place the rung that copies the data at the beginning of your program.

Trying not to sound flippant, but been there done, that and trying to avoid it again

I am trying to avoid modifying the target PLC program. Especially as the inputs I want to simulate are scattered across the input table and are not collected nicely in one spot, which makes maintenance of such a scheme very labor intensive.

Mark- · Apr 30, 2018

Steve Bailey said:
The Rx3i does not support SNPX. SNPX is serial, not ethernet.

Does the RX3i support SRTP? The Ethernet version of SNP-X.

Steve Bailey · Apr 30, 2018

Does the RX3i support SRTP? The Ethernet version of SNP-X.

Yes it does.

Ozpeter · Apr 30, 2018

Mark- said:
Does the RX3i support SRTP? The Ethernet version of SNP-X.

I believe that the RX3i does support SRTP and while it is technically proprietary I have just found a security researcher's paper from last year called "Leveraging the SRTP protocol for over-the-network memory acquisition of a GE Fanuc Series 90-30" which has a section on documenting SRTP. So this may be where I am headed.

Unfortunately they don't provide any source code because hackers could get online to a PLC and do something (which I think is a bit strange as I can do the same with Modbus/TCP - except write to the inputs!!!)

Mark- · Apr 30, 2018

Ozpeter said:
I believe that the RX3i does support SRTP...

While not open source, PeakHMI supports SRTP. Perhaps it can work for you.

Ozpeter · Apr 30, 2018

Mark- said:
While not open source, PeakHMI supports SRTP. Perhaps it can work for you.

Thanks for the suggestion, but I am actually looking to rolling a solution into my own code, rather than dealing with a separate product.

Mark- · Apr 30, 2018

Ozpeter said:
Thanks for the suggestion

The protocol is not too complicated and IIRC Wireshark dissects SRTP. You can use the demo version of PeakHMI to capture reads and writes.

harryting · Apr 30, 2018

Ozpeter said:
Trying not to sound flippant, but been there done, that and trying to avoid it again

I am trying to avoid modifying the target PLC program. Especially as the inputs I want to simulate are scattered across the input table and are not collected nicely in one spot, which makes maintenance of such a scheme very labor intensive.

I must be missing something here, all the PLC I ever with doesn't allow Input to be "faked" through communication, for what I think is very obvious reasons.

Steve Bailey · Apr 30, 2018

I don't think you will be able to avoid modifying the PLC. If you are able to roll your own communications driver that can write to the inputs, you will either have to suspend scanning the I/O modules or make sure you write to inputs that aren't assigned to modules. Otherwise the values the CPU gets from the modules will overwrite what you send from your simulation.
The suggestion I made in post #4 works around that fact by having your simulation write to an intermediate memory location and then passing the intermediate value to the actual input point after the normal I/O update and before the logic scan.

Ozpeter · Apr 30, 2018

Steve Bailey said:
I don't think you will be able to avoid modifying the PLC. If you are able to roll your own communications driver that can write to the inputs, you will either have to suspend scanning the I/O modules or make sure you write to inputs that aren't assigned to modules. Otherwise the values the CPU gets from the modules will overwrite what you send from your simulation.

I'm testing on a PLC that consists of only the CPU and PSU with zero other physical I/O modules or data links (EG EGD) connected to the system. So writing to I/O with something like SRTP will work.

Mickey · Apr 30, 2018

I am not a GE user but most PLC programming software allow you to "force" an input on.

Open Source PLC protocols?

Ozpeter

Member

cardosocea

Member

Ozpeter

Member

Steve Bailey

Lifetime Supporting Member + Moderator

Ozpeter

Member

Mark-

Lifetime Supporting Member

Steve Bailey

Lifetime Supporting Member + Moderator

Ozpeter

Member

Mark-

Lifetime Supporting Member

Ozpeter

Member

Mark-

Lifetime Supporting Member

harryting

Lifetime Supporting Member

Steve Bailey

Lifetime Supporting Member + Moderator

Ozpeter

Member

Mickey

Lifetime Supporting Member

Similar Topics