Some help with PPI protocol?

[abondy]

ppi protocol

I have captured some of the communication between a PC and a Siemens S7-200 when read and writing to VD0 with Step7-microWIN 32 software.

The PC outputs:
68 1B 1B 68 02 00 6C 32 01 00 00 00 00 00 0E 00 00 04 01 12 0A 10 02 00 04 00 01 84 00 00 00 6B 16
and after E5 and 10 02 00 5C 5E 16 the PC receives from th PLC:
68 19 19 68 00 02 08 32 03 00 00 00 00 00 02 00 08 00 00 04 01 FF 04 00 20 98 76 45 12 D6 16

The data in VD0 is 16#98764512 and I can see it in the received message near the end.

My question is: Can anyone explain or point me to a document that explains the information in the DATA part of the telegrams?

I realize that:
68 .. .. 68 are the "Start Delimiter"
.. 1B 1B .. is the length
the destination = 02
the source is = 00
and the checksum and the ED "end delimiter",
but what is explanation of the data from 68 1B 1B 68 02 00 .............
....to.... 68 16.

Thanks
AB

 

[abondy]

siemens ppi

Posted for 6 months, 104 reads and no one has any suggestions or help about Siemens PPI protocol.

Guys I need your help or suggestions

Always Thankful,

Andy

 

[Gabriele Corrieri]

siemens ppi protocol description

Hi Andy

we of PlcForum.IT community have to start on these days a new online project finalized to make an OCX component to link S7-200 cpu's.

Let me if you're interested to join us ...

Our community speak always in italian language but if you want I can traduce some posts ... with my very poor english.

Best Regards

Gabriele Corrieri

 

[onebit]

siemens ppi source code

if you stil need it I can give you some points

 

[abondy]

checksum crc siemens s7-200

Onebit,

Thanks for your offer.

Yes, I still need some help (info).

Namely, the code following the destination and source bytes, the meaning of 6C in some telegrams and 7C in others.
Also, the code for the type of PLC memory being addressed ( eg 01 84) for V type memory and so on.

I guess what I am asking for are the definitions of bytes sent to and received from the PLC, and also the '10 02 00 5C 5E 16' type of messages both sent or received.

Also, what is the reply from the PLC when there is a checksum error.
We normally see an E5 when the message is received correctly, but when there is and error, there appears to be a '10 DST SRC xx CS 16 message returned form the PLC. (DST-destination, SRC - source, CS - Checksum)

Thanks for any assistance you may give me.

Andy

 

[onebit]

what is ppi protocol

Hi Andy,
I'm so sorry, I sent you answers last week by this forum and didn't check if my information appears in the forum. May be I did something wrong and as result my answer didn’t appear in this forum. I'll answer you again as soon as possible. By the way, you can contact me by e-mail. All information about me is in my web site www.bitman.ca. May be you can find an answer on you question there.

Best regards

Vladimir

 

[Dirk]

fcs check profibus pa

Hello,

I have some problems with the PPI protocol too.
My Problem is to build the checksum. I tried a lot of difference methods (CRC16, CRC32, CCITT,etc) , but I just didn't get the right FCS.
I also tried to take all the bytes instead of everything after the start delimiter.

Can anyboby tell me, how the FCS is builded?

Thanks, Dirk

 

[abondy]

ppi s7 protocol

Dirk,

The checksum is very simple. Just add all the bytes from after the "68 .. .. 68" header to the last byte of the data (just before the FCS).
For example:

68 15 15 68 02 00 6C 32 01 00 00 CC C1 00 08 00 00 F0 00 00 01 01 00 03 C0 EB 16
....................^--------------------------------------------------------------------------------^

The sum of all the hex digits from the first 02 up to just before the EB - is 3EB and least significant byte = EB (1 byte)

Regards,
Andy

 

[wilson_150]

ppi protocol description

Hello,

I have some problems to get complete PPI protocol info/spec. Please help on this.

Thanks!

 

[AndrewDo]

ppi/pc protocol

Hi Abondy,
I have the same interest of PPI description. I get some COM Port records, when PLC and Microwin connected. I also know the basic of frame as u but I can't go far to determine of other frame and data inside. Do you still study it? Do you have any news? Can you share It? (please send me Email mailto:trading_4e@yahoo.com.sg, If something you can't post)
Thanks[/url]

 

[MarekK]

ppi protocol 68

Hi,

If any one have some knowlage abut Siemens PPI protocol or any one want to know something please let me know.
At this moment I understand a bit.

MK
mkrzyzowski(at).wp.pl

 

[MarekK]

ppi 68 1b 1b 68

68 1B 1B 68 02 00 6C 32 01 00 00 00 00 00 0E 00 00 04 01 12 0A 10 02 00 04 00 01 84 00 00 00 6B 16
------------------------
SD2 frame. Look on WIKI -> Profibus DP.
68 1B 1B 68 02 00 = Frame like you wrote.
6C = 6C,7C,5C - query
32 - S7200
01 - Query
0000 - always 0000
0000 - transaction id
000E - Length 1
0000 - Length 2
04 - Read request
01 - Variables count
120A - Var address frame header
10 - 10
02 - Byte
0004 - 4 elements
0001 - V area
84 - V
000000 - With all above means READ.VD0
6B - Check sum
16 End delimiter
----------------------
Next is bla bla bla. Look on WIKI
Then...
----------------------
68 19 19 68 00 02 08 32 03 00 00 00 00 00 02 00 08 00 00 04 01 FF 04 00 20 98 76 45 12 D6 16
SD2 frame like before
but
68 19 19 68 00 02 - header
08 - Answer
32 - S7200
03 - Response, OK, no errors
0000 - always 0000
0000 - transaction id, the same like in Request!!
0002 - Length 1
0008 - Length 2, data length
0000 - no errors
04 - Read request
01 - Variables count
FF - OK1
04 - B or W or DW (not bit)
0020 - number of bits in resp. 0x20=0d32->32/8[b/B]=4B in response.
98 76 45 12 - Read variable
D6 -Check sum
16 - End delimiter
--------------------
Last lines with request described before means VD0 = 98765412
--------------------
That's it.
I do not describe it better. I do not want to. I spend many many hours on it and I still working. I am looking for someone to share knowledge with each other.
MK