The Sequel - Oh Blimey I bought a CNC Lathe (Beaver TC 20)

[awemawson]

We're On Line !!

Thanks to a user (Pea Ell Sea) on the Siemens support forum I've found that the value for parameter #5010  needs to be 00000100. This value of 4  brings up "PLC-Prog" on the Sinumerik 820T input screen and the STEP5 program goes 'online' and reports PLC Type as S5 135 PLC.

One hurdle surmounted after days of trying 

The next mountain to climb is to learn more about STEP5, so that I can have a look at the PLC program and hopefully see things in real time.

Decided not to plough on immediately in case I break something - take the dogs for a walk and have a good think then lots of 

[PekkaNF]

OH, happy day!

Very good. S5-135 CPU was breifly pretty familiar to me. We had to use because it had some math functions for I/O that cheper models were lacking. If I remember right, there were few versions of it. Ladder and all that is all standard, fun starts with time-base functions and math, it was very feasible to have some programs on short time base and then push some longer loop.

Pekka

[awemawson]

Oh EXCELLENT Pekka, I now appoint you the official resident expert - can I down load your brain please 

[PekkaNF]

Uuh...if I remember anything. I'm trying to learn how to weld. This should sort it out.

[awemawson]

I hope you're not using that Single Malt for weld preparation 

[PekkaNF]

No. That is old military stable, mostly industrial grade alcohol and some confiscated Cognac. Tastes like an alcohol. Not clean enough for cleaning and not tasty enough for consumption. Perfect for Finns.

Pekka

[PK]

We have this on the wall at work.

[tom osselton]

I hope you're not using that Single Malt for weld preparation 

I just thought it was medicinal for the welders flash!

[awemawson]

I've been unable to work in the workshop all yesterday due to a plague of flies - literally thousands of  them, but I think I've now got them down to manageable numbers, with just the odd one or two pingng off fluorescent light tubes. I think something must have died on the roof.

So now back in and working I've been doing a bit more investigation of what I can see in the PLC via STEP5. The PLC program comprises 'blocks' of instructions, arranged as 'organisational blocks', 'program blocks', 'function blocks', 'sequence blocks', and 'data blocks'. One of the myriad of STEP5 facilities is to download these various block either by their reference numbers, or all together as one file. Trying the latter approach (as I don't yet know the reference numbers' seems to start off OK, loads of data being transferred, then everything locks up, STEP5 freezes, Program Manager shows it's using 100% of the CPU time, and the only way to stop it is to use Program Manager. When PM stops the program the entire operating system crashes  - yes this is repeatable 

So what blocks do I know should be there - apparently all the PLCs have OB 1, which is the interface between the operating system in the 820T controller and the  user program. So I set it up to down load OP 1 - and it did it ! But I can't find how to read the file I've downloaded !

OK what else can I do - well there are various internal things in the PLC that can be brought up on the screen - not yet familliar enough to know what it all means but I suppose it's a bit more progress - have a few screen shots !

[russ57]

Is it downloading to a file or memory?

Russ

[awemawson]

Theoretically to a file, but I'm having difficulty deciding if it actually has 

I have the .pdf version of a manual for STEP5 V7.0 but mine is V7.23 - probably much the same apart from details. I've given up scrolling up and down screens cross referencing stuff in the manual, and knuckled down and printed it out this afternoon. Only 513 pages or an entire ream of A4 paper !

I find it much easier with a paper manual that I can stick  Post-It notes on to temporarily mark my passage through the jungle.

One issue is that all the documents I've found so far start off getting you to construct the logic of a program, program it and upload it, but include very little about the reverse process starting from an existing but undocumented program already in a PLC !

But applying PK's poster regarding persistence (which I've printed out!), we'll get there eventually or I'll !now the reason why not!

[PekkaNF]

.....
One issue is that all the documents I've found so far start off getting you to construct the logic of a program, program it and upload it, but include very little about the reverse process starting from an existing but undocumented program already in a PLC !
....

Because trying to make sense of BU is very hard.

99.99% professionals have source code and then try fiqure out what has been changed in the code on PLC and when circuit has been found zoom in to FB/PB "What it does and why"?

To get there you use compare -function and cross reference of I/O, but hard to do if you don't have commented source code.

If I had to do it I would find the outputs that drive the tool cahnger (if that had a problem). Cross reference the outputs one at the time, then find the blocks that drive those outputs and then check which inputs make up the logic.

Trying to understand the whole big tamale is a big project.

Pekka

[awemawson]

Oh yes Pekka, unless I'm VERY lucky this is definitely gong to be a long haul now I have my teeth into it.

A bit more poking about confirms that I have managed to download three 'blocks' from the PLC and can examine them and potentially edit my local copy. I don't think I can modify the code in the 820T PLC yet as A/ some is in EPROM and B/ the rest (all 18K of it) is at this point sacrosanct until I undersatand it better.

OK what have I got? Well I have 'OB 2' - (organization block #2) which is quite short having only a few lines and is apparently the interrupt service routine for high priority interrupts, but VERY interestingly refers to the 'W-Axis' in plain text, conditionally calling up 'FB 99' to service this interrupt. And FB 99 also refers in plain text to the W-Axis.

Why all the excitement about the W-Axis when this lathe hasn't got that option?  Well it's not the axis that gets me excited, but that fact that some of the code  obviously includes plain text giving a clue as to its function, which will help enormously.

As an aside I'm sure that I've read in one of the commissioning guides for the 'GEN2' lathes (mine is 'GEN1') that the commissioning Engineer was instructed to run a program that examined the options required by the particular customer, and create the PLC program by assembling blocks, so I assume that blocks are enabled or disabled in fact from the W-Axis one I've found.

Having now printed the documentation I've decided to 'start over' with the set up of the file structure on STEP5 to isolate my 'project' from the various examples etc, and thus get a clearer idea of what is stored where.

[PekkaNF]

Looks vaquelly familiar.

OB 1 "Cyclic" calls PB:s (ladder)
OB 2 is intterrupts, you don't want to saturate this file with may simultaneous calls
OB 10-18 calls programs on certain time base, we used them on FB:st that had exacting time requiremets like counters, positioners, servos etc.

OB31 "cyle time monitor" is a lot of fun if your CPU gets loaded! It is really easy to exceed cycle time if you have too much junk on too fast loop.


You know these OB calls? p. 97

https://cache.industry.siemens.com/dl/files/150/1086150/att_1992/v1/948then.pdf

And one thing to know that there are two flags set and used routinely trought the program to enable/disable piece of code "permanently":
"FALSE" in case of M0.0
"TRUE" in case of M0.1

Just in case you wonder what these are.

pekka

[awemawson]

Thanks for that Pekka, that's a useful document that I will add to my reading list !

I have a rather bad photocopy scan in pdf format of a Siemens guide to programming this particular PLC - I'm trying in vain to find a better copy that is in 'pdf searchable' format rather than just images. It's this document if you happen to have a source:

6Zb5-410-0BX02-0BA0  (or 0BA1)

[awemawson]

I started the day intending to lower the baud rate on the STEP5 to 820T controller link, to try and resolve this locking up issue.

820T end no issues, parameters 5011 & 5013 set to 11000110 equating to 4800 baud, all else unchanged.

At the PC end however something very odd is happening. I set up the COM2: using MODE in a dos box, then hop into STEP5, which refuses to go 'on line'. Back to the DOS box only to find that COM2: has reverted to 9600 but at 7 data 1 stop. Device manager shows the correct setting. Now as I understand it there can really only be three things changing the port settings:

1/ Me using the MODE command
2/ Device Manager
3/ STEP5 perhaps using a configuration file that I've not yet discovered

But the really odd thing is, if I revert back to 9600, No Parity, 8 data 2 stop everything works, STEP5 goes on line to the 820T controller and when I come out of STEP5 the com port is still as I set it.

Not managed to resolve that conundrum yet 

So per force continuing at 9600 I discovered that I can display a directory of all the blocks in the PLC. If I try to download PB202, which is the first, and biggest block, (and the only program block in fact), the interface locks up as it did when I told it to download 'all blocks'. If I tell it to down load the next listed block FB11 I get I get an error 'last segment not completed', but every other block I have managed to download to the local file and can open them for display and editing. However there is not much meat in them, I think the action is mainly happening in the elusive PB202.

Now when the interface locks up, I can only stop STEP5 running by using Task Manager to terminate it, and doing so brings down the whole operating system requiring a re-boot of Windows XP-Professional. However looking at Task Manger I notice that there is a service "IASTORDATAMGRSVC.EXE" that seems to be using 100% of CPU time.

Googling about I find that this service is not part of Windows but is part of "Intel(R) Rapid Storage Technology" and apparently isn't needed, but if I try to uninstall it using 'Programs and Features' in Control Panel I get my hand slapped telling me that it's controlling my hard disk and if I do I'll loose data and won't be able to re-boot 

. . . oh what fun . . . .

[russ57]

So somehow the download is writing to disk in a way that the controller doesn't like..

Did you work out how to control the download location?
If so. Try either writing to a separate disk (usb?) or even, assuming it's still possible, a ram disk.

Is @@ valid? I think it wasn't in some file systems.




Russ

[awemawson]

Russ, STEP5 is very much in charge here !

The @ signs are inserted by STEP5 to pad out to the 8.3 dos name convention, and it's writing ok to the same file for the other blocks from the PLC. This leads me to think that either the PLC program in the PLC is corrupt in some way, or that the the RS232 data link is giving problems. The PB202 block is the longest one - maybe the software hand shaking isn't working properly. This doesn't explain the FB11 'last segment not completed' error, which is quite repeatable, as FB11 is shorter than most of the blocks that I have transferred successfully.

In an ideal world I'd like to slow the interface down such that handshaking is no longer needed (ie both ends can easily cope with the slow data rate without needing to pause for breath), then crank the rate up until failure, but something at the PC end is stopping me being in control of the Com2: settings

[russ57]

Did you get your analyser running? I must I'd be surprised if you were getting flow controlled at that speed.

It could be a corrupt block on the controller as you suggest.
That would mean step 5 hangs waiting for more data that never comes.

Re com settings, I agree with your analyis that step 5 is setting it. I'd search the entire installation for 9600 and see if it is a config somewhere.

Russ

[awemawson]

Yes I have the analyser able to run in 'monitor mode' - it's fairly old technology and gobbles up data into a buffer, and though you can see characters coming in, you have to stop the capture routine before you can have a good look at what you've captured.

I'm planning another session this afternoon - obviously the last bit of the transfer will be the interesting bit when it has just locked up, but by heck things don't half get confusing 

[russ57]

Been there... Actually yesterday, at work, looking for missing responses.

Throw in Bluetooth, packet encryption, Android and 4g network none of which take kindly to a request to explain what is going on.

Russ

[mc]

Would it be worth investing in a Saleae compatible logic analyser, such as https://www.ebay.co.uk/itm/24MHz-8-Channel-USB-Logic-Analyzer-Saleae-8-CH-Logic-Analyzer-for-MCU-ARM-FPGA/112657150662 (plenty other sellers available)?

The newer genuine Saleae analysers are analogue, and a lot more expensive, but these basic digital only ones are handy for this kind of thing, and work with the Saleae software (the original Saleae interfaces were identical electronics to these cheap ones, but in a fancy case). Only limitation to storing the captured data is disc space, and the software includes various analysers/decoders - https://www.saleae.com/

[awemawson]

Thanks for the link Moray, but I think it might complicate things even more than they are. I only have access to signals at the RS232 +/- 12 range so at the very least I'd need to build a simple level shifter for each CCIT circuit.

Having just now hooked up the Tektronix 834 RS232 analyser I've realised that it is actually reporting 'Framing Errors' on quite a few (but not all) characters in both directions ie from both the STEP5 PC (DCE) and the 820T (DTE).

Now this may well be a red herring, as of course we have also got the set up on the 834 analyser as  well as both ends of the link which have to match. Theoretically they all do match !

. . . but I've been driven out of the workshop again by a plague of flies  - this time far fewer than before and hopefully just the 'tail end charlies' of the last batch but I can't concentrate when they literally drop down the back of my neck into my shirt !

[mc]

I never realised this was running at full 12V signal levels.

If you did rig up a basic level shifter, it would mean you could see exactly what's going on with the signal timing, which may reveal what's causing problems.


PS. A beekeeping suit would solve your immediate fly problem, and keep us entertained!

[awemawson]

I PS. A beekeeping suit would solve your immediate fly problem, and keep us entertained!

Bee .... off