Slide 1
WW TSS-09Advanced DAServer Troubleshooting
Presented by:Dan Scott
October 2013
@InvensysOpsMgmt / #SoftwareRevolution
/InvensysVideos
social.invensys.com
© 2013 Invensys. All Rights Reserved. The names, logos, and taglines identifying the products and services of Invensys are proprietary marks of Invensys or its subsidiaries.All third party trademarks and service marks are the proprietary marks of their respective owners.
Presented by:Dan Scott
October 2013/Wonderware
/company/Wonderware
Introduction
• Troubleshooting
• DAServer Diagnostics
• Log Viewer and Log Flags
• Utilities
Slide 3
• Utilities
• Network Analyzers
• OPC Analyzers
SMC Log Viewer
Always check the logger
Use Log Flags
DASSendDASReceiveDASTraceDASVerbose
Slide 4
DASSendDASReceiveDASTraceDASVerbose
DAServer Diagnostics
Client Groups
All SuiteLink itemswill be shown in theDDESLPlugInClient Group
Quality is goodfor all items.
Quality is goodfor one or moreitems and badfor one or moreitems.
Find whichdevice groupsindividualitems belongto.
Slide 6
OPC Groups willbe shown by thegroup namecreated by theOPC Client.
Quality is goodfor one or moreitems and badfor one or moreitems.
Quality is badfor all items.
DAServer Diagnostics
Device GroupsList of DeviceGroups
All device groupslisted here areconfigured in theDAServer. The<Default> groupdoes not need to becreated.
The <Default>group usuallycontains itemsadvised from anOPC Client .
An OPC Client canaccess anyconfigured DeviceGroup byconfiguring anAccess Path in theClient.
Slide 7
All device groupslisted here areconfigured in theDAServer. The<Default> groupdoes not need to becreated.
The <Default>group usuallycontains itemsadvised from anOPC Client .
An OPC Client canaccess anyconfigured DeviceGroup byconfiguring anAccess Path in theClient.
DAServer Diagnostics
Messages
Lists messagesbeing sent to thePLC
Displays the numberof items and errorsin each message.
Detailed messageview.
Slide 8
Displays the numberof items and errorsin each message.
Displays the statusof the message.
DAServer Diagnostics
Transactions
• Diagnostic Backlog Size must greater than 0 to view Transactions.
• Shows Write Transactions.
• Demand Read and Refresh transactions are also displayed.
• Subscriptions are not displayed.
• Generally used to troubleshoot performance and write issues.
TransactionsCompletedSuccessfully
In Progress
View TransactionitemsWrite result willgive a descriptionof the error whichcorresponds tothe Result code.
Slide 9
Transactions
• Diagnostic Backlog Size must greater than 0 to view Transactions.
• Shows Write Transactions.
• Demand Read and Refresh transactions are also displayed.
• Subscriptions are not displayed.
• Generally used to troubleshoot performance and write issues.Complete: atleast one baditem
Complete: allitems bad.
Demand Writes: the Quality/Results column shows the write complete code.All zeros (00000000) indicates success.
Connection Issues
• Ping
Use to determine if the end device can be reached across the network.
• Winsock Errors
Error values from the Windows Socket API
• Port IssuesUse Portqry to determine if specific ports are listening
Slide 10
• Ping
Use to determine if the end device can be reached across the network.
• Winsock Errors
Error values from the Windows Socket API
• Port IssuesUse Portqry to determine if specific ports are listening
Connection Issues
Ping
Tests basic connectivity to an end device
Using Ping
Open a command prompt.Type “ping <ip address of end device>”
Ping is successfulPing is unsuccessful
Slide 11
Open a command prompt.Type “ping <ip address of end device>”
Connection Issues
Winsock Errors
• When a DAServer or other application makes calls to the Windows Sockets API anerror may be returned.
• Winsock is an Application Programming Interface (API) that developers use to maketheir programs network-enabled.
Slide 12
Connection to PLC Port.ModbusPLC at IP Address 10.2.68.141 closed, error code =10053. The DAServer will create new socket connection to send next message.
• An example of a logger message indicating a Winsock error:
Connection Issues
Winsock Errors
Connection to PLC Port.ModbusPLC at IP Address 10.2.68.141 closed, error code = 10053. TheDAServer will create new socket connection to send next message.
WSAECONNABORTED – Software caused connection abort.An established connection was aborted by the software in your host computer, possibly due to adata transmission time-out or protocol error.
Slide 13
Some common Winsock errors:WSAECONNREFUSED (10061) – Connection refused. No connection could be made becausethe target actively refused it.
WSAETIMEDOUT (10060) – Connection timed out. A connection attempt failed because theconnected party did not properly respond after a period of time, or the established connectionfailed because the connected host has failed to respond.
WSAECONNABORTED – Software caused connection abort.An established connection was aborted by the software in your host computer, possibly due to adata transmission time-out or protocol error.
Connection Issues
Winsock Errors
Good sources of information regarding Winsock errors:• Microsoft – Description of Winsock errors
http://msdn.microsoft.com/en-us/library/windows/desktop/ms740668(v=vs.85).aspx
• Sockets.com – Description of Winsock errors and possible causes.http://www.sockets.com
Some common Winsock errors continued:WSAECONNRESET (10054) – Connection reset by peer. An existing connection was forciblyclosed by the remote host.
Slide 14
Good sources of information regarding Winsock errors:• Microsoft – Description of Winsock errors
http://msdn.microsoft.com/en-us/library/windows/desktop/ms740668(v=vs.85).aspx
• Sockets.com – Description of Winsock errors and possible causes.http://www.sockets.com
Connection Issues
• The DAServer specifies an IP address and a port number when it makes a connection to
a PLC. The PLC must be listening on this port number.
Port Issues
• Typically, a PLC has a specific port listening for connections.
Slide 15
• Firewalls between the DAServer and the PLC must not be blocking this port.
• The DAServer specifies an IP address and a port number when it makes a connection to
a PLC. The PLC must be listening on this port number.
Connection IssuesPort Issues
PC
Connect to port 502
PC
Connect to port 502
PC
Connect to port 502
Slide 16
PLC
Port 502 Listening
Firewall
Block Port 502
PLC
Port 502 Listening
PLC
Port 502 Not Listening
Connection Issues
Port Issues – Using Portqry
• Name or IP address to query.
• Single port to query.
• Run Portqry from the DAServer node.
Slide 17
• Single port to query.
Port 502 is listening
Result
Connection Issues
Port Issues – Using Portqry
Port 502 is not listening
Result
Not Listening indicates Portqry reachedthe PLC but the PLC is not listening onthe port number specified.
Slide 18
Not Listening indicates Portqry reachedthe PLC but the PLC is not listening onthe port number specified.
Connection Issues
Port Issues – Using Portqry
Port 502 is filtered
Result
Filtered indicates Portqry did notreceive a response from the target portand the target port is being filtered. Afirewall may be blocking the portnumber specified.
Slide 19
Filtered indicates Portqry did notreceive a response from the target portand the target port is being filtered. Afirewall may be blocking the portnumber specified.
Connection IssuesPort Issues - Common Port Numbers
• ControlLogix PLCs
• AB PLC-5
• GE PLC
44818
2222
18245
• The standard port numberfor Modbus TCP is 502.
• Some Modbus devicesallow a user configurableport number.
• The Modbus TCP DAServeralso allows the user toconfigure a port other than502.
• Port 135 is used to initiateDCOM communication.
• Once the OPC Client andServer are able tocommunicate, they willnegotiate new portnumbers.
Slide 20
• Modbus TCP
• Siemens
502
102
• The standard port numberfor Modbus TCP is 502.
• Some Modbus devicesallow a user configurableport number.
• The Modbus TCP DAServeralso allows the user toconfigure a port other than502.
• Suitelink 5413
• Port 135 is used to initiateDCOM communication.
• Once the OPC Client andServer are able tocommunicate, they willnegotiate new portnumbers.
• DCOM 135
Connection Issues
Port Issues – Resources
Portqry can be downloaded from:http://www.microsoft.com/en-us/download/details.aspx?id=17148
Description of the Portqry.exe command-line utility:http://support.microsoft.com/kb/310099
Using PORTQRY for troubleshooting:http://blogs.technet.com/b/askds/archive/2009/01/22/using-portqry-for-troubleshooting.aspx
Slide 21
Portqry can be downloaded from:http://www.microsoft.com/en-us/download/details.aspx?id=17148
Description of the Portqry.exe command-line utility:http://support.microsoft.com/kb/310099
Using PORTQRY for troubleshooting:http://blogs.technet.com/b/askds/archive/2009/01/22/using-portqry-for-troubleshooting.aspx
Performance
Common parameters that affect performance
• Number of device groups per PLC object.
• Number of outstanding / queued messages.
• Block I/O Size
• Optimization Parameters
• Contiguous PLC Addresses
• PLC Response Time
• When to use more Device Groups
• When to use fewer Device Groups
• The number of messages that canbe sent to a device before a reply isreceived.
• Make sure the PLC supports thenumber of outstanding messagesconfigured in the DAServer.
• The number of PLC items in asingle poll.
• Higher values = Better performance
• Make sure the PLC supports theblock sizes configured.
• Some DAServers supportconfigurable optimizationparameters.
• Generally, reading contiguous PLCaddresses allows the DAServer tosend less polls to the PLC.
• Less Polls = Better Performance
• Use System Tags and Log Flags todetermine latency.
Slide 22
• Number of device groups per PLC object.
• Number of outstanding / queued messages.
• Block I/O Size
• Optimization Parameters
• Contiguous PLC Addresses
• PLC Response Time
• The number of messages that canbe sent to a device before a reply isreceived.
• Make sure the PLC supports thenumber of outstanding messagesconfigured in the DAServer.
• The number of PLC items in asingle poll.
• Higher values = Better performance
• Make sure the PLC supports theblock sizes configured.
Performance
Multiple device groups per PLC object?
• Consider multiple device groups if some items need to be updatedat a fast rate while others don’t.
• Multiple device groups per PLC object can dramatically increasemessages sent to the PLC
• Increasing messages sent to the PLC can dramatically decreaseperformance.
Slide 23
Multiple device groups per PLC object?
• Consider multiple device groups if some items need to be updatedat a fast rate while others don’t.
• Multiple device groups per PLC object can dramatically increasemessages sent to the PLC
• Increasing messages sent to the PLC can dramatically decreaseperformance.
PerformanceNumber of device groups per PLC object – Test 3 Device Groups
• 3 Device Groups
• Desired updateinterval is 501 to 573milliseconds.
• Use WWClient toadvise 178 items ineach device group.
• PLC addresses arenot contiguous.
Slide 24
• 3 Device Groups
• Desired updateinterval is 501 to 573milliseconds.
• Use WWClient toadvise 178 items ineach device group.
• PLC addresses arenot contiguous.
PerformanceNumber of device groups per PLC object – Test 3 Device groups
534 Total items split evenlybetween 3 Device Groups
300 messages being sentto the PLC.
Slide 25
Less than 2 items per pollmessage.
PerformanceNumber of device groups per PLC object – Test 3 Device Groups
$SYS$MaxIntervaldisplays the currentupdate interval inmilliseconds for allitems in thecorresponding devicegroup
Slide 26
$SYS$MaxIntervaldisplays the currentupdate interval inmilliseconds for allitems in thecorresponding devicegroup
PerformanceNumber of device groups per PLC object – Test 1 Device Group
532 Total items advisedthrough 1 Group. SamePLC items as the 3 grouptest
100 messages being sentto the PLC.
Slide 27
100 messages being sentto the PLC.
More than 5 items per pollmessage.
PerformanceNumber of device groups per PLC object – Test 1 Device Groups
$SYS$MaxIntervaldisplays the currentupdate interval inmilliseconds for all itemsin the correspondingdevice group
Slide 28
$SYS$MaxIntervaldisplays the currentupdate interval inmilliseconds for all itemsin the correspondingdevice group
PerformanceOutstanding Message Configuration
Increasing the number of outstanding messages can increase performance.
The PLC must support thevalue entered here.
Slide 29
Example: Outstanding Messages = 1Advise 500 items = 5 polls to the PLC
12:00:00.000 Poll 400001 through 40012212:00:00.015 PLC responds12:00:00.015 Poll 400123 through 40024412:00:00.030 PLC responds12:00:00.030 Poll 400245 through 40036612:00:00.045 PLC responds12:00:00.045 Poll 400367 through 40048812:00:00.060 PLC responds12:00:00.060 Poll 400489 through 40050012:00:00.075 PLC responds
PerformanceOutstanding Message Configuration
Total time to poll all items
75 ms
Slide 30
Example: Outstanding Messages = 1Advise 500 items = 5 polls to the PLC
12:00:00.000 Poll 400001 through 40012212:00:00.015 PLC responds12:00:00.015 Poll 400123 through 40024412:00:00.030 PLC responds12:00:00.030 Poll 400245 through 40036612:00:00.045 PLC responds12:00:00.045 Poll 400367 through 40048812:00:00.060 PLC responds12:00:00.060 Poll 400489 through 40050012:00:00.075 PLC responds
Total time to poll all items
75 ms
Example: Outstanding Messages = 4Advise 500 items = 5 polls to the PLC
12:00:00.000 Poll 400001 through 40012212:00:00.000 Poll 400123 through 40024412:00:00.000 Poll 400245 through 40036612:00:00.000 Poll 400367 through 40048812:00:00.015 PLC responds (400001 through 400122)12:00:00.015 Poll 400489 through 40050012:00:00.015 PLC responds (400123 through 400244)12:00:00.015 PLC responds (400245 through 400366 )12:00:00.015 PLC responds (400367 through 400488 )12:00:00.030 PLC responds (400489 through 400500)
PerformanceOutstanding Message Configuration
Total time to poll all items
30 ms
Slide 31
Example: Outstanding Messages = 4Advise 500 items = 5 polls to the PLC
12:00:00.000 Poll 400001 through 40012212:00:00.000 Poll 400123 through 40024412:00:00.000 Poll 400245 through 40036612:00:00.000 Poll 400367 through 40048812:00:00.015 PLC responds (400001 through 400122)12:00:00.015 Poll 400489 through 40050012:00:00.015 PLC responds (400123 through 400244)12:00:00.015 PLC responds (400245 through 400366 )12:00:00.015 PLC responds (400367 through 400488 )12:00:00.030 PLC responds (400489 through 400500)
Total time to poll all items
30 ms
Test 18000 items
PerformanceOutstanding Message Configuration
1 Outstanding Message
829 ms
4 Outstanding Messages
360 ms
Slide 32
PerformanceOptimization Parameters – ABCIP DAServer
No Optimization
The DAServer uses the mostbasic communication methodavailable by using the tag namefor communication with thecontroller
ABCIP DAServer
Optimize for Read
All tags are accessed bypredefining messages in thecontroller, therefore optimizingblocks of information from thecontroller.
This option is most effective witha large number of tags oncontinuous scan.
Optimize for Startup time
All tags are accessed from thePLC processor using the device’smemory location table.
This option provides the bestoverall performance.
Optimize User Defined DataTypes
The DAServer will attempt togroup requests for a UDT’selements into a request for thewhole structure.
Slide 33
No Optimization
The DAServer uses the mostbasic communication methodavailable by using the tag namefor communication with thecontroller
Optimize for Read
All tags are accessed bypredefining messages in thecontroller, therefore optimizingblocks of information from thecontroller.
This option is most effective witha large number of tags oncontinuous scan.
Optimize for Startup time
All tags are accessed from thePLC processor using the device’smemory location table.
This option provides the bestoverall performance.
Optimize User Defined DataTypes
The DAServer will attempt togroup requests for a UDT’selements into a request for thewhole structure.
PerformanceOptimization Parameters – SIDirect DAServer
Cyclic Services
Cyclic services have a reliable updatefrequency and need less bus access.The DAServer tries to register asmany items in the cyclic services aspossible.
SIDirect DAServerCyclic Services
If you know how many services thePLC can handle, you can distributethe available cyclic services amongdifferent device groups by using the“Limit cyclic services to:” parameter.
Otherwise, you can use the“Maximum available” services.
Optimization – S7 SAPI
This mode is implemented to keepthe server compatible with older S7PLCs.
This mode is the less-preferredoptimization mode.
Optimization – Block read
This mode always registers a wholebyte array containing some items.
This mode is best if you frequentlyactivate/deactivate items that havesimilar addresses. This mode causesless activations/deactivations on theprotocol.
Optimization – Auto
This mode is best when you do notfrequently activate/deactivate items.
Slide 34
Cyclic Services
Cyclic services have a reliable updatefrequency and need less bus access.The DAServer tries to register asmany items in the cyclic services aspossible.
Cyclic Services
If you know how many services thePLC can handle, you can distributethe available cyclic services amongdifferent device groups by using the“Limit cyclic services to:” parameter.
Otherwise, you can use the“Maximum available” services.
Optimization – S7 SAPI
This mode is implemented to keepthe server compatible with older S7PLCs.
This mode is the less-preferredoptimization mode.
Optimization – Block read
This mode always registers a wholebyte array containing some items.
This mode is best if you frequentlyactivate/deactivate items that havesimilar addresses. This mode causesless activations/deactivations on theprotocol.
PerformancePLC Response Time
Check Ping response time
Roundtrip Time
How long it takes to sendand receive the datapacket.
Statistics
• Packets Sent• Packets Received• Packets Lost
• Minimum round trip time• Maximum round trip time• Average round trip time
Slide 35
Roundtrip Time
How long it takes to sendand receive the datapacket.
Statistics
• Packets Sent• Packets Received• Packets Lost
• Minimum round trip time• Maximum round trip time• Average round trip time
PerformancePLC Response Time
Slow ping time? Use Tracert
Tracert
Traces the route betweenthe source and thedestination.
Shows how many hops ittakes to get to thedestination. Also displaysthe amount of time eachhop takes.
Tracert
Hop number
Round trip time for eachpacket. 3 packets are sentto each hop.
The IP address of each hop.
Slide 36
Tracert
Traces the route betweenthe source and thedestination.
Shows how many hops ittakes to get to thedestination. Also displaysthe amount of time eachhop takes.
Tracert
Hop number
Round trip time for eachpacket. 3 packets are sentto each hop.
The IP address of each hop.
PerformancePLC Response Time – Performance Example
Test Setup:• Computer running DASMBTCP located in Lake Forest, CA• DASMBTCP configured for 2 PLCs, 1 topic per PLC with an update rate of
100ms.• DASMBTCP set to 1 outstanding message.• wwClient advising 10000 integer items through DASMBTCP to 2 PLCs.• 82 poll messages being generated for each PLC.
Slide 37
PLC-1• Located in Lake Forest, CA• Ping time = 1ms• Time to update all items = <500ms
PLC-2• Located in Wyomissing, PA• Ping time = 85ms• Time to update all items = 7000ms
Log Flags
• DASSend
• DASReceive
• DASTrace
• DASVerbose• Displays protocol-specific diagnostic messages.
• Displays protocol messages received from the PLC.
• Displays protocol messages sent to the PLC.
Slide 38
• Modifies other log flags to provide more detailedmessages.
Message 4 sent for READ_4X_REG: 400001=>400001. SentMessageSize=1, MessagesToSendSize=0, MaxQueuedMsgs=1Message 4 sent for READ_4X_REG: 400001=>400001. SentMessageSize=1, MessagesToSendSize=0, MaxQueuedMsgs=1PoLL message 4 sent by PLC for READ_4X_REG: 400001=>400001. SentMessageSize=0, MessagesToSendSize=0,MaxQueuedMsgs=1PoLL message 4 sent by PLC for READ_4X_REG: 400001=>400001. SentMessageSize=0, MessagesToSendSize=0,MaxQueuedMsgs=1Message sent to PLC Port.ModbusPLC (0 d 0 0 0 6 ff 3 0 0 0 1 )Message received from PLC Port.ModbusPLC (0 d 0 0 0 5 ff 3 2 2 f2 )Message sent to PLC Port.ModbusPLC (0 d 0 0 0 6 ff 3 0 0 0 1 )Message received from PLC Port.ModbusPLC (0 d 0 0 0 5 ff 3 2 2 f2 )
Troubleshooting ExamplesMissing Data for some PLC items
The PLC Port.ModbusPLC reported receiving an ILLEGAL DATA ADDRESS from the DAServer. PLC errorcode 02The PLC Port.ModbusPLC reported receiving an ILLEGAL DATA ADDRESS from the DAServer. PLC errorcode 02
• Check SMC Logger
• Turn on log flags (DASSend, DASReceive, DASTrace, DASVerbose)
Message sent to PLC Port.ModbusPLC (1 e1 0 0 0 6 ff 3 4e 15 0 c )Message received from PLC Port.ModbusPLC (1 e1 0 0 0 3 ff 83 2 )Message sent to PLC Port.ModbusPLC (1 e1 0 0 0 6 ff 3 4e 15 0 c )Message received from PLC Port.ModbusPLC (1 e1 0 0 0 3 ff 83 2 )
Slide 39
Message sent to PLC Port.ModbusPLC (1 e1 0 0 0 6 ff 3 4e 15 0 c )Message received from PLC Port.ModbusPLC (1 e1 0 0 0 3 ff 83 2 )Message sent to PLC Port.ModbusPLC (1 e1 0 0 0 6 ff 3 4e 15 0 c )Message received from PLC Port.ModbusPLC (1 e1 0 0 0 3 ff 83 2 )
1 e1 Transaction ID
Hex Description Value
01e1 hex = 481 decimal0 0 Protocol ID 0000 = Modbus protocol0 6 Number of bytes to follow 0006 = 6 bytes to follow
ff PLC Unit ID
Hex Description Value
FF = 255 decimal3 Modbus Function Code 03 = Read holding register4e 15 Starting Address (0-based) 4E15 = 19989 decimal (PLC address 419990)0 c Number of registers to read 000C = Read 12 registers (419990 to 420001)
1 e1 Transaction ID
Hex Description Value
01e1 hex = 481 decimal0 0 Protocol ID 0000 = Modbus protocol0 3 Number of bytes to follow 0003 = 3 bytes to follow
ff PLC Unit ID
Hex Description Value
FF = 255 decimal83 Modbus Function Code 83 = Read holding register Exception2 Exception Code 02 = Illegal Data Address
Troubleshooting ExamplesMissing Data for some PLC items
We have verified through the protocol that there is an illegal data address when pollingaddresses 419990 through 420001. To find the specific illegal data address we can:
• Set the holding register readblock size to 1.
• Use wwClient to advise419990 through 420001
Slide 40
• Use wwClient to advise419990 through 420001
• Locate the bad addresses• wwClient• Diagnostics
Troubleshooting ExamplesChecking for correct data values
• Check the Tagname configuration in InTouch to determine theitem name and access name.
• Check the access name to determine the DAServer and topic.
• In this example, the DAserver is “DASMBTCP,” the topic is “plc”and the item name is “400002”
• Check the name of the Port and PLC object name. (Will be usedlater when analyzing log file)
Scenario: Customer indicates that InTouch is displaying a value of2449 for Pump1 RPM and believes this value is incorrect.Scenario: Customer indicates that InTouch is displaying a value of2449 for Pump1 RPM and believes this value is incorrect.
Slide 41
• Check the Tagname configuration in InTouch to determine theitem name and access name.
• Check the access name to determine the DAServer and topic.
• In this example, the DAserver is “DASMBTCP,” the topic is “plc”and the item name is “400002”
• Check the name of the Port and PLC object name. (Will be usedlater when analyzing log file)
Troubleshooting ExamplesChecking for correct data values
Item name = 400002DAServer = DASMBTCPTopic = PLCPort object name = PortPLC object name = ModbusPLC
Item name = 400002DAServer = DASMBTCPTopic = PLCPort object name = PortPLC object name = ModbusPLC
Slide 42
Item name = 400002DAServer = DASMBTCPTopic = PLCPort object name = PortPLC object name = ModbusPLC
Item name = 400002DAServer = DASMBTCPTopic = PLCPort object name = PortPLC object name = ModbusPLC
Value matches InTouch
Use wwClient to advise item
Troubleshooting ExamplesChecking for correct data values
Value matches InTouchand wwClient
Check the value in DASMBTCP Diagnostics
Slide 43
Value matches InTouchand wwClient
Troubleshooting ExamplesChecking for correct data values
Message sent to PLC Port.ModbusPLC (c 6c 0 0 0 6 ff 3 0 0 0 14 )Message 3180 sent for READ_4X_REG: 400001=>400020. SentMessageSize=1, MessagesToSendSize=0, MaxQueuedMsgs=1Message received from PLC Port.ModbusPLC (c 6c 0 0 0 2b ff 3 28 3 9c 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 919 91 9 91 9 91 9 91 9 91 9 91 )PoLL message 3180 sent by PLC for READ_4X_REG: 400001=>400020. SentMessageSize=0, MessagesToSendSize=0,MaxQueuedMsgs=1
Message sent to PLC Port.ModbusPLC (c 6c 0 0 0 6 ff 3 0 0 0 14 )Message 3180 sent for READ_4X_REG: 400001=>400020. SentMessageSize=1, MessagesToSendSize=0, MaxQueuedMsgs=1Message received from PLC Port.ModbusPLC (c 6c 0 0 0 2b ff 3 28 3 9c 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 919 91 9 91 9 91 9 91 9 91 9 91 )PoLL message 3180 sent by PLC for READ_4X_REG: 400001=>400020. SentMessageSize=0, MessagesToSendSize=0,MaxQueuedMsgs=1
• Turn on log flags (DASSend, DASReceive, DASTrace, DASVerbose)
Slide 44
• Make sure the Transaction ID matches for the Send and receive
• Verify the Send message: PLC ID = FF (255), Function code 3 = read holding registers, Starting
address = 0000 (400001), Number of registers = 0014 (20)
• Find the correct send message. Verify the Port object name, PLC object name and item name.
Troubleshooting ExamplesChecking for correct data values
Message received from PLC Port.ModbusPLC (c 6c 0 0 0 2b ff 3 28 3 9c 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 919 91 9 91 9 91 9 91 9 91 9 91 )Message received from PLC Port.ModbusPLC (c 6c 0 0 0 2b ff 3 28 3 9c 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 91 9 919 91 9 91 9 91 9 91 9 91 9 91 )
ff PLC Unit ID
Hex Description Value
FF = 255 decimal
3 Modbus Function Code 3 = Read holding register
Slide 45
3 Modbus Function Code 3 = Read holding register
28 Number of data bytes to follow 28 = 40 decimal
039c Data for Register 0 (400001) 039C = 924 decimal
0991 Data for Register 1 (400002) 0991 = 2449 decimal
Result: InTouch is displaying the correct value from the PLC.
Other ToolsWireshark
• Network protocol analyzer
• Captures and logs network traffic
• Analysis and Statistics
• Logs can be saved for later analysis
Slide 46
• Network protocol analyzer
• Captures and logs network traffic
• Analysis and Statistics
• Logs can be saved for later analysis
Other ToolsWireshark
Filter by IP address of PLC.
Select packet for details.
Packet details.
Slide 47
Packet bytes.
Other ToolsOPC Analyzer / OPC Sniffer
• Captures and logs communication between OPCservers and clients
• Use to troubleshoot issues which require more datathan the OPC server and client logs provide.
• Logs can be saved for later analysis
Slide 48
• Captures and logs communication between OPCservers and clients
• Use to troubleshoot issues which require more datathan the OPC server and client logs provide.
• Logs can be saved for later analysis
Other ToolsOPC Analyzer / OPC Sniffer
Select OPC Server
Shows OPC methods
Sent by OPC Client
Sent by OPC Server
Slide 49
Sent by OPC Server
ResourcesWonderware• Tech Notes, Tech Articles, Tech Alerts, Documentation, Downloads
http://wdn.wonderware.com
Portqry• Download
http://www.microsoft.com/en-us/download/details.aspx?id=17148• Description of the Portqry.exe command-line utility:
http://support.microsoft.com/kb/310099• Using PORTQRY for troubleshooting:
http://blogs.technet.com/b/askds/archive/2009/01/22/using-portqry-for-troubleshooting.aspx
Slide 50
Winsock• Microsoft – Description of Winsock errors
http://msdn.microsoft.com/en-us/library/windows/desktop/ms740668(v=vs.85).aspx• Sockets.com – Description of Winsock errors and possible causes.
http://www.sockets.com
Portqry• Download
http://www.microsoft.com/en-us/download/details.aspx?id=17148• Description of the Portqry.exe command-line utility:
http://support.microsoft.com/kb/310099• Using PORTQRY for troubleshooting:
http://blogs.technet.com/b/askds/archive/2009/01/22/using-portqry-for-troubleshooting.aspx
Resources
Modbus• Technical Resources, Modbus Specifications
http://www.modbus.org/tech.php
Network Tools• Wireshark
http://www.wireshark.org• Sysinternals
http://technet.microsoft.com/en-us/sysinternals/bb795532
Slide 51
OPC• OPC Foundation
http://www.opcfoundation.org
Modbus• Technical Resources, Modbus Specifications
http://www.modbus.org/tech.php