john paley
Member
Maybe you guys remember a thread I started a few weeks ago about some worms---integer bytes being transposed when sent over a Porfibus network from a Siemens S7-400 to a n AB controllogix processor.
Well, I have since found out that the profibus didn't do it--the siemens PLC does it. They're just opposite from the rest of the world with integers. Siemens uses byte sized (8 bits) addresses in their PLC's and have to use two consecutive memory addresses to store an integer--and they just do it reverse of the rest of the world--when loaded, the MSB goes in the first byte and the LSB goes in the second--how silly.
The thing that tipped me off is this--the PLC reads two status words (16 bit words) each from drives in the system over the profibus and transfers them to four consecutive memory addresses (8 bits each). Status bits 8 thru 15 go in address 0, 0-7 go in 1, 24 thru 31 go in 4, and 16 thru 23 go in 3. The bytes of the two words from a SIEMENS drive, are transposed in a SIEMENS PLC--they don't even handle their own data in the same way.
I was confused for a little while over this, as I was trying to ascertain the spicific nature of a poorly translated drive fault message to my Controller from the Siemens system. Bits 0-7 in the drive are in the second address of the PLC and 8 -15 are in the first. It was easy once I realized the bytes were backwards, but it was a pain in the a__ getting to that point--do all europeans do things bass ackwards??
While I'm bangin Siemens, listen to what else they did. They have an output module on this profibus--16 outputs. The outputs share common power for the output bits in groups of four. So one group of these four outputs energizes solenoids on one winding spindle, and another group of four does the same for the opposite spindle. The designer decided to interrupt the common power per spindle (4 outputs) via a limit switch so the solenoids only operate when the turret is in a specific position. That's OK for reasons of safety BUT----There's always a but----the removal of the common power causes an output module alarm (called "no load voltage" of all things), which in turn causes a red flashing Profibus light on the PLC front. This is not good--we have a perpetual red flahing profibus light--and it is a "normal" machine condition, as only one group of solenoids may be in position to operate at once. Very bad practice, in my opinion, but I guess I could be wrong. So if there's a machine problem, the floor electrician sees the red light and the first thing he does is start screwing around with the controller--trying to put out the light--when there's really nothing wrong with it. (I guess I could hang signs all over the damn thing that say "IGNORE ALL WARNINGS") By the way, this control system was done by siemens for the OEM of the machine. If the factory guys do **** like that, it worries me what else they did, or didn't do, that I don't know about yet--I wish Siemens would've have just stayed in Europe
To all you siemens Guru's out there--you can keep it.
Well, I have since found out that the profibus didn't do it--the siemens PLC does it. They're just opposite from the rest of the world with integers. Siemens uses byte sized (8 bits) addresses in their PLC's and have to use two consecutive memory addresses to store an integer--and they just do it reverse of the rest of the world--when loaded, the MSB goes in the first byte and the LSB goes in the second--how silly.
The thing that tipped me off is this--the PLC reads two status words (16 bit words) each from drives in the system over the profibus and transfers them to four consecutive memory addresses (8 bits each). Status bits 8 thru 15 go in address 0, 0-7 go in 1, 24 thru 31 go in 4, and 16 thru 23 go in 3. The bytes of the two words from a SIEMENS drive, are transposed in a SIEMENS PLC--they don't even handle their own data in the same way.
I was confused for a little while over this, as I was trying to ascertain the spicific nature of a poorly translated drive fault message to my Controller from the Siemens system. Bits 0-7 in the drive are in the second address of the PLC and 8 -15 are in the first. It was easy once I realized the bytes were backwards, but it was a pain in the a__ getting to that point--do all europeans do things bass ackwards??
While I'm bangin Siemens, listen to what else they did. They have an output module on this profibus--16 outputs. The outputs share common power for the output bits in groups of four. So one group of these four outputs energizes solenoids on one winding spindle, and another group of four does the same for the opposite spindle. The designer decided to interrupt the common power per spindle (4 outputs) via a limit switch so the solenoids only operate when the turret is in a specific position. That's OK for reasons of safety BUT----There's always a but----the removal of the common power causes an output module alarm (called "no load voltage" of all things), which in turn causes a red flashing Profibus light on the PLC front. This is not good--we have a perpetual red flahing profibus light--and it is a "normal" machine condition, as only one group of solenoids may be in position to operate at once. Very bad practice, in my opinion, but I guess I could be wrong. So if there's a machine problem, the floor electrician sees the red light and the first thing he does is start screwing around with the controller--trying to put out the light--when there's really nothing wrong with it. (I guess I could hang signs all over the damn thing that say "IGNORE ALL WARNINGS") By the way, this control system was done by siemens for the OEM of the machine. If the factory guys do **** like that, it worries me what else they did, or didn't do, that I don't know about yet--I wish Siemens would've have just stayed in Europe
To all you siemens Guru's out there--you can keep it.