PROFINET IO. Measurements of telegram- sequences. with Ethereal. PNCC Burgdorf. Device Designation and their Rolls. PROFINET IO-Device:

Transcription

1 PROFINET IO s of telegram- sequences 1 with 1 Device Designation and their Rolls IO-Controller IO-Supervisor PROFINET IO-Controller: Data exchange of IO signals to assigned field devices Device containing the control program PROFINET : Field Device attached to the IO-Controller PROFINET IO-Supervisor: HMI and Diagnosis Station Ethernet Switch 2 PC with Ethernet interface Monitors the Ethernet frames 2

2 Open source tool Downloadable from From Version.1.1 decoding of PN-IO included 1. Install WINCAP to capture the frame on windows 2. Install ethereal on your PC 3. Ready for use Start / Stop Ethernet Interface Storage file 3 Display capture filter Save Load display filter 3 most important buttons Start new capture Define capture filters Open stored capture Store capture file Define display filters Selected display filter 4 Define a new display filter Apply the selected display filter 4

3 capture Select network interface Select capture filter 5... and Start 5 capture filters If you are interested in PROFINET IO frames the following filter may apply: only PROFINET frames: ether proto x8892 only IP frames from the IO-Controller with IP address host all PROFINET frames (Ethertyp and IP) ether proto x8892 or host all PROFINET frames without the cyclic data and time frames 6 (ether proto x8892 and ether[14:2]>xfbff) or host For more details see manual at 6

4 display Display Filter Sequence of frames in the storage file The selected frame is decoded 7 The selected frame in Hex 7 display filters Display and capture filters have not the same syntax! only PROFINET frames: eth.type == x8892 only IP frames from the IO-Controller with IP address ip.addr == all PROFINET frames (Ethertyp and IP) eth.type == x8892 ip.addr all PROFINET frames without the cyclic data and time frames 8 pn_rt.frame_id > xfbff ip.addr

5 Define PROFINET colors Import file: PROFINET colors.ini 9 Apply to use directly Save to make permanent 9 with PROFINET colors 1 1

6 topology: Managed IO-Controller We do NOT see the exchanged frames on normal switches! A special managing function in the switch is needed to see the frames transmitted on the other frames! topology: Sandwich IO-Controller Hub We see all exchanged frames. This setup modifies the real-time behavior of 12 the installation! 12

7 Structure of a passive TAP 13 s with a passive TAP is an additional load on a Ethernet link and may perturbate the normal data exchange! 13 topology: Integrated IO-Controller The device of the IO-Controller is a PC. It is possible to have two applications on one operating system: 14 IO-Controller (Monitor) 14

8 PROFINET and ISO/OSI-Model ISO/OSI 7b PROFINET IO Services PROFINET IO Protocol PROFINET CBA acc. to IEC Type 1 7a 6 Connectionless RPC empty DCOM Connection oriented RPC empty 5 4 UDP(RFC 768) 3 IP (RFC 791) TCP(RFC 793) 2 Real-Time Enhancements acc. To IEC IEEE82.3,Full-Duplex,IEEE82.1Q,Priority Tagging 1 IEEE Base TX, 1 Base FX Structure of an Ethernet frame PRE SFD DA SA TYPE DATA PAD FCS 7 Bytes 1 Byte 6 Bytes 6 Bytes 2 Bytes Bytes 4 Bytes TYPE x8 x86 x81 x8892 Protocol IP ARP VLAN PN-RT Meaning IP Header Adressresultion Virtual LAN Header 16 PROFINET Real-Time 16

9 Structure of a VLAN frame PRE SFD DA SA TYPE DATA PAD FCS 7 Bytes 1 Byte 6 Bytes 6 Bytes 2 Bytes Bytes 4 Bytes TYPE = x81 PRIORITY VLAN-ID 2 Bytes 3 Bits 1 Bit 12 Bits 4 Bytes are added in the header. The type field is nor twice in the frame! A switchmayremovethisvlan field. The priority defines who goes first trough the switch. PROFINET-RT has highest priority = 6! Structure of a TYPE = x8892 PROFINET frame PRE SFD DA SA TYPE DATA PAD FCS 7 Bytes 1 Byte 6 Bytes 6 Bytes 2 Bytes Bytes 4 Bytes FrameID RT-Data Cycle-Counter Data Status Transfer Status 2 Bytes Bytes 2 Bytes 1 Byte 1 Byte FrameID x xff x1 x7fff x8 xbfff xc xfbff xfc xfcff xfd xfdff xfe xfefc xfefd xfeff xff xffff Meaning Time Synchronization RT Class 3 Frames (IRT) RT Class 2 Frames (RT) RT Class 1 Frames (RT) Acyclic transmission high Reserved Acyclic transmission low DCP reserved Hint: colors as defined in 18 18

10 Structure of a TYPE = x8892 PROFINET frame FrameID 2 Bytes Cycle-Counter RT-Data One bit represents a time increment of 31,25µs; Big-Endian Format Bytes 2 Bytes Meaning Provider: Increments the CycleCounter (within the send cycle) and fits it in the frame. Consumer: Checks the CycleCounter during rceiption to identify take overs. Cycle-Counter Data Status 1 Byte Transfer Status Transfer Status 1 Byte Meaning Transmitted ok Data Status Meaning Reserved X State 19 Primary, leading channel in a redundant system X DataValid Data are valid X ProcessState Process is running X ProblemIndicator Set if there is no problem 19 Example with 2 2

11 Structure of an IP/UDP frame PRE SFD DA SA TYPE DATA PAD FCS 7 Bytes 1 Byte 6 Bytes 6 Bytes 2 Bytes Bytes 4 Bytes Display Filters: ip IP-Header 2 Bytes IP-Data udp UDP-Header 8 Bytes UDP-Data dcerpc RPC-Header 8 Bytes PROFINET IO Service PDU Structure of a PROFINET Service PDU DCE RPC Header Bytes => opnum Opnum Meaning Connect 1 Release 2 Read 3 Write 4 Control PROFINET IO Service PDU ARBlock 58 Bytes Write Header 64 Bytes IOCRBlock > 42 Bytes Write data?? Expected Submodule Block > 8 Bytes Display Filter: dcerpc.opnum == Control Block 32 Bytes 22 22

12 Set-up phases IO - Controller IO - Device Distribution of IP addresses The IO-Controller distributes the IP addresses to all s based on their names. Set-up of Application relations The IO-Controller sets-up the AR to all IO- Devices Cyclic exchange of IO data The IO-Controller sends outputs and receives the inputs from the IO-devices Alarm handling The IO-Controller is ready to receive alarm messages from the s Phase 1: Distribution of IP address Source Destination Protocol Info :e:cf::: PN-DCP Ident Req, Xid:x1, NameOfStation IO Controller verifies that his name is not already in use Broadcast ARP Who has ? Gratuitous ARP Broadcast ARP Who has ? Gratuitous ARP Broadcast ARP Who has ? Gratuitous ARP IO Controller verifies that his IP address is not already in use :e:cf::: PN-DCP Ident Req, Xid:x2, NameOfStation PN-DCP Ident Ok, Xid:x2, NameOfStation, Dev-Options(5), TypeOfStation, Dev-ID, Dev-Role, IP The name of the IO Device is verified Broadcast ARP Who has ? Tell The IO Controller verifies, that the IP address of the IO Device is not already in use PN-DCP Set Req, Xid:x1, IP, End-Trans PN-DCP Set Ok, Xid:x1, Response(Ok), Response(Ok) The IO Device is given his IP address Broadcast ARP Who has ? 24 Tell ARP is at 8::6:6b:f6:23 The IO Controller verifies if the IO Device has now its IP address assigned 24

13 Phase 2: Set-up of AR Source Destination Protocol Info PNIO-CM Connect request, ARBlockReq, IOCRBlockReq, IOCRBlockReq,... (1 blocks) PNIO-CM Connect response, OK, ARBlockRes, IOCRBlockRes, IOCRBlockRes,... (5 blocks) Establish the Application Relation with specification of the Connection Relation PNIO-CM Write request, Api:, Slot: /1, 7 bytes PNIO-CM Write response, OK, Api:, Slot: /1, 7 bytes PNIO-CM Write request, Api:, Slot: 1/1, 3 bytes PNIO-CM Write response, OK, Api:, Slot: 1/1, 3 bytes Write Parameters for the different moduls PNIO-CM Control request, IODBlockReq, Command: "Parameter End" PNIO-CM Control response, OK, IODBlockRes, Command: "Done The IO Controller signals that he is ready PNIO-CM Control request, IOXBlockReq, Command: "Application Ready" PNIO-CM Control response, OK, IOXBlockRes, Command: "Done The IO Device signals that he is ready also 25 Phase 3: Exchange of cyclic IO data Source Destination Protocol Info PNIO RTC1, FrameID: xc, DataLen: 4, Cycle: 4948 (Valid,Primary,Ok,Run) PNIO RTC1, FrameID: xc8, DataLen: 4, Cycle: (Valid,Primary,Ok,Run) Normal state PNIO RTC1, FrameID: xc8, DataLen: 4, Cycle: 4416 (Valid,Primary,Ok,Run) PNIO RTC1, FrameID: xc, DataLen: 4, Cycle: 1472 (Valid,Primary,Ok,Stop) IO Device is stopped 26 26