Device Siemens S7-300/400 or compatible CPUs (VIPA-SPEED7, VIPA-SLIO, etc.)

PLC-Lab can be connected via Ethernet, NetLink Pro, and Simatic Net to a real Siemens S7-300/400 or compatible CPUs such as VIPA-SPEED7, VIPA-Slio, etc. The virtual system of PLC-Lab can thus be imprinted on a real CPU. The PLC program is located in the real CPU, which can also be connected to the TIA Portal or a different S7 programming software (Simatic Manager, WinSPS-S7) in parallel. This makes it possible, for example, to replace (still) missing system parts with the virtual PLC-Lab system and nevertheless carry out a test of the entire PLC program.

In the following, we will first list the prerequisites for the individual connection types.

If the S7-300/400 to be addressed has an Ethernet or Profinet interface, this interface can be used for communication between PLC-Lab and the CPU. The connection is established via an Ethernet cable from the PC's network card to the CPU. If the PLC has an Ethernet CP, communication is also possible via this CP.

For this type of connection, you only have to set the IP address of the CPU or Ethernet-CP to be addressed and the network card to be used in the PC.

The adapters of the NetLink Pro family can be plugged into the MPI or Profibus interface of an S7-300/400. On the PC side, they are connected to the network card of the PC. This means that they are Ethernet-to-MPI or Ethernet-to-Profibus converters.

The following parameters must be set when using a NetLink Pro:

Parameter Meaning
IP address The IP address of the NetLink Pro to be addressed.
Network Adapter The network adapter of the PC in which the NetLink Pro is plugged in
PG address The bus address of the NetLink Pro in the MPI or Profibus-DP network. This address must be unique. The default PG address is 0
MPI/DP address CPU The MPI or Profibus-DP address of the CPU to be addressed
Maximum MPI address The maximum address possible in the MPI/DP bus. Permitted values are 15, 31, 63, 126
Baud rate MPI/DP The baud rate set in the MPI or Profibus DP. This is usually determined automatically by NetLink Pro. If in exceptional cases it is necessary to switch off the automatic baud rate detection, the baud rate used in the bus configuration must be specified. For MPI this is typically 187.5kBaud
Automatic baud rate determination If selected, the NetLink Pro tries to determine the baud rate of the MPI/DP network automatically (default setting). If this is not possible, the option is deselected and the baud rate of the bus must be set manually.

If the Simatic Manager or the TIA Portal is installed on the PC, the Simatic-Net connection type can also be used. In this case, the Siemens USB adapters (CP5711, USB-MPI adapter) may be used for communication.

Only the MPI/DP address of the CPU to be addressed must be specified in PLC-Lab. The remaining settings can be made via the button marked with "...". When activated, the dialog "Set PG/PC interface" by Siemens is displayed. You then have to set the existing interface adapter and its parameters here. As known from the Simatic-Manager or the TIA-Portal.

If a virtual system in PLC-Lab is to be linked with operands of a real S7-300/400, you have to create a new device within PLC-Lab first. To do this, open a system project in PLC-Lab (or create a new one) and then press the button shown below in the symbol table.

As a result, a dialog appears in which an S7-300 or S7-400 must be selected as device type and a name for the device must be assigned. For this example we will use an S7-300.

In the example the name "314PNDP" was assigned. The "OK" button confirms the entry and opens the next dialog. Because the CPU that is used has a Profinet interface, it can be connected directly to the network card of the PC. Therefore we only have to specify the IP address of the CPU and the network card that is used in the dialog.

In the example, the target CPU has the IP address "192.168.1.179". Confirm the settings of this dialog with OK.

In the symbol table you can now select the new device and create symbols with the operands of the device. In the following example, three operands are created for the device.

There are two inputs and one output. The inputs have the address E0.0 and E0.1 or I0.0 and I0.1 respectively (with English syntax). The output has the address A0.0 or Q0.0. It does not matter if German or English syntax is used for the operands.

You want to change both inputs in PLC-Lab using push-buttons. The output is linked to a lamp object to detect its status. First, place the "Steuerung Ein" push-button, then link it to the operand and adjust the settings.

You can see the settings of the push-button once again in the following image:

In the next step, place the "Steuerung Aus" push-button and the lamp. Note that the OFF push-button must be set as Opener.

The second push-button was created as a copy of the first one. For this, select the first key and then press [CTRL] + [D].

This concludes the virtual layout of the example.

For this example we will use a CPU-314PN/DP. This CPU has 24 integrated digital inputs and 16 integrated digital outputs. The inputs are assigned the addresses I0.0 to I1.7, the outputs the addresses Q0.0 to Q1.7.

In the example, the two inputs E0.0 and E0.1 are described via PLC-Lab. These two inputs are also available physically. This means that the status of the real inputs is dominant. Any influence on the two inputs in PLC-Lab via the two buttons has no effects. To change this, you have to switch off the updating of the process image for these inputs (or the module to which they belong). You can do this in the hardware configuration of the module. The following picture shows the settings.

"TPA1" is set as the process image. This means that updating the process image must be initiated by the programmer. If this is not done, the process image of inputs 0.0 to 2.7 will not be overwritten by the real inputs. The status written by PLC-Lab is thus retained. Once you have adjusted the settings, you have to transfer the new configuration to the CPU for it to be effective.
After the program test with PLC-Lab, you can undo the setting.

Tip: You can find more options for using real inputs in PLC-Lab below in the description of input operands.

The PLC program, for example, consists of only one SR block and is located in network 1 of OB1. The program is created with the Siemens TIA Portal.

The A0.0 is set via the E0.0 to which the on-switch is connected. The E0.1 ("off button") is attached to the R input. You also have to place a negation, since the "Control off" button is designed as a normally closed contact and thus supplies the status '1' in idle state. After transferring the OB1 to the S7-300 and switching it to RUN, you can switch on the monitoring of the OB1 with the following button:

In the next step, you will switch to PLC-Lab and start the simulation. Click the RUN button.

After a few seconds, PLC-Lab displays that the connection to the S7-300 has been established.

You can now start the test of the PLC program.

When testing the PLC program, the OB1 is observed in the Siemens TIA Portal and the virtual system is operated by PLC-Lab.

PLC-Lab can connect to a real S7-300/400 and imprint the virtual system on the CPU. At the same time, the PLC blocks can be monitored via the TIA Portal (or Simatic Manager, WinSPS-S7 V6, etc.) and the PLC program can be tested. A PLC program test is therefore possible without the sensors and actuators being connected to the modules of the PLC. PLC_Lab can be used to easily provide progress conditions or other system behavior.

Inputs can be both read and written. If the inputs are not real (i.e. if they are in the form of modules), then the value written by PLC-Lab is valid in the input. If inputs are written and if they are physically present in the PLC, the real input always overwrites the PLC-Lab status. So the real input is always dominant.

The first solution to this problem is to switch off the updating of the process image of the input module for the duration of the simulation. Such a setting can be seen below:

A second possibility is to set the address of the real input module to an unused input address for the duration of the simulation.

Example: We want to influence inputs E10.0 to E10.7 via PLC-Lab. The input module is set to the unused input byte address 50 in the hardware configuration. After the simulation, the address 10 is set again for the input module.

Please note that changes in the hardware configuration become effective only after the transfer into the CPU.

If both solutions are not possible, then PLC-Lab is to influence data within a data block or unused flags instead of the inputs. These can then overwrite the status of the inputs at the start of OB1.

Example: In the following example, PLC-Lab influences the flag bits M10.0 to M10.7, i.e. the MB10. These flag bits are to overwrite the inputs E0.0 to E0.7, which are real in the PLC. For this reason, in network 1 of OB1, the MB10 is copied to EB0 via a MOVE block and thus the status of the bits E0.0 to E0.7 is overwritten with the bits M10.0 to M10.7.

After the program test with PLC-Lab, simply remove network 1 in OB1 and the real status information from the inputs will be used again.

German Syntax:

  • Bits: E10.3, E21.5
  • Bytes: EB10, EB120
  • Words: EW10, EW20, EW34
  • Double words: ED12, ED44

English Syntax:

  • Bits: I10.3, I21.5
  • Bytes: IB10, IB120
  • Words: IW10, IW20, IW34
  • Double words: ID12, ID44

Within the objects, always specify the device to the operand as well.

Example: Input byte 34 in the device with the designation "3152DP" is to be addressed as operand in an object of PLC-Lab.

Solution: The operand "3152DP.EB34" or "3152DP.IB34" is required.

Tip: For the operands to be used in a system, first add a symbol to the symbol table. Then you can use the symbol instead of the operand in the objects. As a result, you can insert the symbol from the symbol table using drag and drop. Or you can use the autocompletion function (IntelliSense) within the editor for the operands.

Outputs can be both read and written in PLC-Lab. Normally these are read, i.e. the value of the outputs is used to control the virtual system in PLC-Lab. If outputs are written by PLC-Lab, this only affects the PLC if the output is not overwritten by the PLC program. This means that if an output is described in the PLC program, the PLC program overwrites the status written by PLC-Lab.

If an output is influenced by PLC-Lab to write, it should not also be written to by the PLC program.

German Syntax:

  • Bits: A10.3, A21.5
  • Bytes: AB10, AB120
  • Words: AW10, AW20, AW34
  • Double words: AD12, AD44

English Syntax:

  • Bits: Q10.3, Q21.5
  • Bytes: QB10, QB120
  • Words: QW10, QW20, QW34
  • Double words: QD12, QD44

Within the objects, always specify the device to the operand as well.

Example: Output byte 34 in the device with the designation "3152DP" is to be addressed as an operand in an object of PLC-Lab.

Solution: Solution: The operand "3152DP.AB34" or "3152DP.QB34" is required.

Tip: For the operands to be used in a system, first add a symbol to the symbol table. Then you can use the symbol instead of the operand in the objects. As a result, you can insert the symbol from the symbol table using drag and drop. Or you can use the autocompletion function (IntelliSense) within the editor for the operands.

Flags can be both read and written in PLC-Lab.

If a flag is influenced by PLC-Lab to write, it should not also be written to by the PLC program.

German and English syntax:

  • Bits: M10.3, M21.5
  • Bytes: MB10, MB120
  • Words: MW10, MW20, MW34
  • Double words: MD12, MD44

Within the objects, always specify the device to the operand as well.

Example: Flag byte 34 in the device with the designation "3152DP" is to be addressed as an operand in an object of PLC-Lab.

Solution: Solution: The operand "3152DP.MB34" is required.

Tip: For the operands to be used in a system, first add a symbol to the symbol table. Then you can use the symbol instead of the operand in the objects. As a result, you can insert the symbol from the symbol table using drag and drop. Or you can use the autocompletion function (IntelliSense) within the editor for the operands.

PLC-Lab can access the data of DBs both with read and write access.

If DB data is influenced to write by PLC-Lab, it should not also be written to by the PLC program.

German and English syntax:

  • Bits: DB2.DBX10.3, DB5.DBX21.5
  • Bytes: DB2.DBB10, DB33.DBB120
  • Words: DB2.DBW10, DB33.DBW20, DB1.DBW34
  • Double words: DB2.DBD10, DB1.DBD44

Within the objects, always specify the device to the operand as well.

Example: Data byte 34 in the device with the designation "3152DP" is to be addressed as an operand in an object of PLC-Lab.

Solution: Solution: The operand "3152DP.DB34" is required.

Tip: For the operands to be used in a system, first add a symbol to the symbol table. Then you can use the symbol instead of the operand in the objects. As a result, you can insert the symbol from the symbol table using drag and drop. Or you can use the autocompletion function (IntelliSense) within the editor for the operands.