Siemens S7-1200 TELECONTROL User manual

EtherNet/IP Scanner
for SIMATIC
S7-1200/ S7-1500/ EtherNet/IP
https://support.industry.siemens.com/cs/ww/en/view/109782314
Siemens
Industry
Online
Support

Siemens AG
Division Digital Factory
Postfach 48 48
90026 NÜRNBERG
Germany
V1.1.0
Ⓟ04/2021 Subject to change
Copyright © Siemens AG 2021.
All rights reserved
2
©Siemens 2021 All rights reserved
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal
safety, as well as to prevent damage to property. The notices referring to your
personal safety are highlighted in the manual by a safety alert symbol, notices
referring only to property damage have no safety alert symbol. These notices
shown below are graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper
precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper
precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not
taken.
NOTICE
indicates that property damage can result if proper precautions are not
taken.
If more than one degree of danger is present, the warning notice representing the
highest degree of danger will be used. A notice warning of injury to persons with a
safety alert symbol may also include a warning relating to property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by
personnel qualified for the specific task in accordance with the relevant
documentation, in particular its warning notices and safety instructions. Qualified
personnel are those who, based on their training and experience, are capable of
identifying risks and avoiding potential hazards when working with these
products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the
catalog and in the relevant technical documentation. If products and
components from other manufacturers are used, these must be
recommended or approved by Siemens. Proper transport, storage,
installation, assembly, commissioning, operation and maintenance are
required to ensure that the products operate safely and without any
problems. The permissible ambient conditions must be complied with. The
information in the relevant documentation must be observed.

Siemens AG
Division Digital Factory
Postfach 48 48
90026 NÜRNBERG
Germany
V1.1.0
Ⓟ04/2021 Subject to change
Copyright © Siemens AG 2021.
All rights reserved
3
©Siemens 2021 All rights reserved
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining
trademarks in this publication may be trademarks whose use by third parties for
their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the
hardware and software described. Since variance cannot be precluded entirely, we
cannot guarantee full consistency. However, the information in this publication is
reviewed regularly and any necessary corrections are included in subsequent
editions.
Security information
Siemens provides products and solutions with industrial security functions that
support the secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it
is necessary to implement –and continuously maintain –a holistic, state-of-the-art
industrial security concept. Siemens’ products and solutions only form one element
of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems,
machines and networks. Systems, machines and components should only be
connected to the enterprise network or the internet if and to the extent necessary
and with appropriate security measures (e.g. use of firewalls and network
segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken
into account. For more information about industrial security, please visit
https://www.siemens.com/industrialsecurity.
Siemens’ products and solutions undergo continuous development to make them
more secure. Siemens strongly recommends to apply product updates as soon as
available and to always use the latest product versions. Use of product versions
that are no longer supported, and failure to apply latest updates may increase
customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial
Security RSS Feed under https://www.siemens.com/industrialsecurity.

Table of contents
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
4
©Siemens AG 2021 All rights reserved
Table of contents
Legal information......................................................................................................... 2
1Preface................................................................................................................ 5
2Introduction........................................................................................................ 7
2.1 Description ........................................................................................... 7
2.2 EtherNet/IP........................................................................................... 8
2.3 Function principle ................................................................................. 9
2.4 Scope of delivery................................................................................ 10
3Commissioning................................................................................................ 11
3.1 Preparation......................................................................................... 11
3.2 Connecting the hardware components .............................................. 11
4Configuration/Engineering ............................................................................. 13
4.1 Creating and managing projects ........................................................ 13
4.2 Creating the EtherNet/IP IO system................................................... 15
4.2.1 Creating an Adapter description......................................................... 16
4.2.2 EDS files............................................................................................. 17
5Operating.......................................................................................................... 29
5.1 Start the application............................................................................ 29
5.2 Troubleshooting.................................................................................. 30
5.2.1 Physical check.................................................................................... 30
5.2.2 Network Settings ................................................................................ 32
5.2.3 SIMATIC Program.............................................................................. 34
6LCCF_EnetScanner block............................................................................... 36
6.1 Parameters......................................................................................... 36
6.1.1 Block status messages....................................................................... 38
6.1.2 Technical data.................................................................................... 41
6.2 What’s next?....................................................................................... 44
7Appendix .......................................................................................................... 45
7.1 Service and support ........................................................................... 45
7.2 Industry Mall....................................................................................... 46
7.3 Links and literature............................................................................. 46
7.4 Change documentation...................................................................... 46

1 Preface
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
5
©Siemens AG 2021 All rights reserved
1 Preface
Purpose
This document contains information about the LCCF_EnetScanner function block
for SIMATIC S7-1200 and S7-1500. It will explain its usage and parameterization
as well as provide some basic background information about the implemented
services defined by the ODVA®.
Core content
The following core issues are covered in this document:
•Purpose of the function block
•Parameterization
•Data exchange with EtherNet/IP adapters
Required basic knowledge
General knowledge in communications over Ethernet, programming and
configuring the S7-1200 or S7-1500 with the TIA Portal is assumed and will not be
part of this document. It is also assumed that the terms Server and Client and their
meaning are familiar to the reader. Furthermore, the reader shall be proficient in
the technology of PROFINET as several concepts will be referred to.
Delimitation
The document does not describe:
•How to setup Ethernet networks
•How to assign IP addresses and the split into subnets
•How to configure the controllers in this example
•How to configure the LCCF_EnetAdapter function block for SIMATIC S7
•How to take network traces and/ or analyze network traffic
Basic knowledge about the above topics is assumed.

1 Preface
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
6
©Siemens AG 2021 All rights reserved
Validity
This document is valid for the following components
•TIA Portal
•SIMATIC S7 Controller
The following hardware and software are used throughout this document.
Table 1-1: used components
Name
Part number
Version
SIMATIC S7-1215C
6ES7 215-1AG40-0XB0
V4.2 (or above)
SIMATIC S7-1512C
6ES7 512-1CK00-0AB0
V2.6 (or above)
ET200SP MF
6ES7155-6MU00-0CN0
V5.0 (or above)
TIA Portal STEP7 Prof.
V15.1 Update 4
MFCT
V1.0
In this application example the S7-1500 is operated as EtherNet/IP Scanner, while
the S7-1200 is operated as EtherNet/IP adapter.
The application example for the LCCF_EnetAdapter function block can be
downloaded using the SIOS ID: 109782315
https://support.industry.siemens.com/cs/ww/en/view/109782315

2 Introduction
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
7
©Siemens AG 2021 All rights reserved
2 Introduction
2.1 Description
Although, according to the number of installed nodes PROFINET is the largest
Ethernet based fieldbus in the world, EtherNet/IP is at number 3. Especially in
several regions of the world EtherNet/IP has a dominating role. SIMATIC controller
inherently don’t have support for field devices using EtherNet/IP.
In this application example a possible solution is demonstrated and explained, how
such EtherNet/IP field devices can still be used with SIMATIC controller. Here
SIMATIC controller applies to both S7-1500 and S7-1200.
In this example the S7-1200 will be operated as such EtherNet/IP field device
together with the ET200SP MF interface module. The S7-1500 shown in the below
schematic is operated as the device controlling the field devices.
NOTE
The roles of the S7-1200 and S7-1500 can be exchanged without changes in the
description as the LCCF_EnetScanner function block exists for both systems.
Figure 2-1: simplified setup
SIMATIC S7-1500
(EtherNet/IP Scanner)
SIMATIC S7-1200
(EtherNet/IP fielddevice)
SIMATIC ET200SP MF
(EtherNet/IP fielddevice)
Ethernet
As mentioned above the ET200SP MF and the S7-1200 controller are operated as
field devices providing sensor signals to the S7-1500 controller and accepting
control signals from the S7-1500.
The real setup also contains a SCALANCE X208 switch for easier connectivity.
However, the switch is not necessary as a line topology (as shown above) is also
possible.

2 Introduction
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
8
©Siemens AG 2021 All rights reserved
2.2 EtherNet/IP
Even though in the above schematic setup the cables are named with PROFINET/
IE, any other Ethernet based protocol can co-exist on the same network. Especially
if such protocol uses IP as networking protocol and either TCP or UDP as transport
protocol.
EtherNet/IP is such a protocol. It is Ethernet based (IEEE 802.3) and uses IPv4 as
networking protocol as well as TCP and UDP as its transport protocol. EtherNet/IP
is an open standard maintained by the ODVA® (Open DeviceNet Vendor
Association). Yet it should not be mixed up with so called TCP native/ socket
communications.
EtherNet/IP is a best effort approach to achieve higher performance and lower jitter
compared to regular TCP communications while maintaining maximum
interoperability to the other TCP or UDP based communication protocols.
The IP in the name EtherNet/IP is not to be mixed up with IPv4. It is an
abbreviation for CIP (Common Industrial Protocol). This CIP is embedded into the
payload of the TCP or UDP packets used to exchange data between two or more
devices.
The devices creating an EtherNet/IP network are called:
•Scanner, which are scanning the network. They are collecting the information,
such as sensor data, from the other field devices. In PROFINET terms this
would be equivalent to a Controller or a Master on other networks
•Adapter, which are providing such sensor data to the Scanner. The adapters
translate the EtherNet/IP protocol into a proprietary intra device protocol. The
adapt the protocols. The PROFINET equivalent term is Device or Slave on
other networks.
As the Open User Communication allows a SIMATIC programmer to create the
payload for packets send via UDP or TCP, the SIMATIC can implement the
necessary features and functions to provide EtherNet/IP as loadable function block.
This functionality can be used with any Open User Communication capable
interface of the SIMATIC, such as integrated PROFINET ports as well as Industrial
Ethernet CMs and CPs.

2 Introduction
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
9
©Siemens AG 2021 All rights reserved
2.3 Function principle
The application example demonstrates the necessary steps to configure the
SIMATIC S7-1500 to operate as EtherNet/IP Scanner with the help of the
LCCF_EnetScanner function block.
The communication will use both transport protocols mentioned above. The
Scanner is configured to exchange data with two Adapters. One adapter is the
ET200SP MF in EtherNet/IP fieldbus mode. The second adapter is represented by
the S7-1200 using the also available LCCF_EnetAdapter function block.
This is schematically shown on the next page’s figure.
Figure 2-2: schematic functional principle
SIMATIC S7-1200
(EtherNet/IP fielddevice)
SIMATIC ET200SP MF
(EtherNet/IP fielddevice)
SIMATIC S7-1500
(EtherNet/IP scanner)
The communication is established by the Scanner using a TCP connection. After
registering the Scanner with the Adapters, a transport connection is negotiated with
each of the Adapters. Once this is successfully done, the transport connection is
opened, and the data exchange takes place using UDP datagrams.
There are two more terms associated with EtherNet/IP.
•Originator: is the device, which initiates the transport connection. This is
typically the Scanner.
•Target: is the device, which accepts the transport connection. This is typically
the Adapter.
In this application example the transport connection uses UDP transport and
unicast communications. With EtherNet/IP the target may also vote for a multicast
connection. The target would then send the sensor data to many devices (incl. the
originator) instead of only to the originator.
NOTE
In this application example the terms Adapter and Target as well as Originator
and Scanner are used as synonyms. This is correct for this application example.
In other scenarios this might not hold true anymore.

2 Introduction
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
10
©Siemens AG 2021 All rights reserved
2.4 Scope of delivery
The application example consists of the document and a TIA Portal project. It also
contains the MFCT project for an exemplary configuration of the ET200SP MF as
well as an EDS file for each of the field devices.
The program in the TIA Portal program can be easily adopted into a “S7-1200 as
Scanner” scenario, as the LCCF_EnetScanner function block uses the identical
parameterization.
The parameterization for the Scanner will consist of the two adapters. It will be
explained which settings from the EDS files are mapped into the configuration of
the LCCF_EnetScanner block.

3 Commissioning
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
11
©Siemens AG 2021 All rights reserved
3 Commissioning
3.1 Preparation
As preparation for the application example to function, the above-mentioned
hardware components should be placed into a rack or on a solid table to prevent
slip or fall.
WARNING
Risk of electric shock
To operate this application example the connection of the above hardware to
electrical power is required. Disregarding local regulations and common sense
may cause an electric shock and because of that injury or death.
Always follow the rules for working with electrical equipment. If in doubt, have
someone familiar with these rules and regulations set up the hardware for you.
Further download the TIA Portal project and make sure you have the MFCT
installed and properly functioning. Another good idea is to have a text editor, such
as Notepad on your computer, as several values will be taken from the EDS files,
which are in turn text files.
3.2 Connecting the hardware components
As mentioned above please observe electrical guidelines and rules when
connecting power to the components, which is the first step to take.
Secondly setup the Ethernet cables. There are two options to do that.
The first option is the Line topology as shown below:
Figure 3-1: Line topology setup
SIMATIC
S7-1500
PN PN
L+ M
SIMATIC
ET200SP MF
PN PN
L+ M
SIMATIC
S7-1200
PN PN
L+ M
PROFINET / IE
NOTE
The line topology is an easy to setup topology. Although it does not allow
network debugging as easy on a protocol level.

3 Commissioning
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
12
©Siemens AG 2021 All rights reserved
Another topology is the star topology, which in the application example is used. It is
shown in the next schematic.
Figure 3-2: Star topology setup
SIMATIC
S7-1500
PN PN
L+ M
SCALANCEX208
PN PNPN PN PN PNPN PN
L+ M
SIMATIC
ET200SP MF
PN PN
L+ M
SIMATIC
S7-1200
PN PN
L+ M
PROFINET / IE
NOTE
The star topology is using a network switch as the center point. If the used switch
allows port mirroring/ port spawning network protocol analysis is much easier.
In this document some network traces will be shown to illustrate the explained
mechanisms.
Network traces are taken used the application Wireshark®.

4 Configuration/Engineering
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
13
©Siemens AG 2021 All rights reserved
4 Configuration/Engineering
4.1 Creating and managing projects
To follow along with this application example the TIA Portal project should have
been downloaded from SIOS.
NOTE
A new TIA Portal project may also be created as it allows to adopt the hardware
platform accordingly.
However, it is not part of this document to explain the setup of the hardware
being used as EtherNet/IP Scanner.
Table 4-1: Configuration instructions
Step
Instruction
Result
1.
Start TIA Portal
2.
Retrieve the downloaded TIA Portal
project
(EnetScanner.zap15_1)
This will extract the compressed TIA
Portal archive into a folder of your
selection.
3.
Open the contained SIMATIC S7-1500
controller
You will see the function block
LCCF_EnetScanner in the program
folder as well as two data blocks.
•EnetIoSystem
•InstScanner
You will also see a Cyclic Interrupt OB.

4 Configuration/Engineering
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
14
©Siemens AG 2021 All rights reserved
Step
Instruction
Result
4.
Open the existing OB
“taskEnetScanner” with a double-click
on it.
The block opens in the editor.
5.
Place a call to the LCCF_EnetScanner
onto the network.
TIA Portal will request an instance DB.
Type in the name of the existing
instance DB or select it from the
drop-down list.
As the result the block call is placed
with the instance DB.
In this example the instance DB is
named “InstScanner”

4 Configuration/Engineering
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
15
©Siemens AG 2021 All rights reserved
Step
Instruction
Result
6.
Assign the interface you want to use to
the actual parameter of the block call
NOTE
It is recommended to use the TIA Portal maintained global constants for the
interface identifier. Otherwise the function block may not work properly.
However, any Open User Communication (OUC) capable interface may be used,
including Industrial Ethernet CM or CP extension cards.
At this point the LCCF_EnetScanner function block is not operable. The
configuration of the EtherNet/IP field devices needs to be done and an area to for
the sensor and control data needs to be declared.
4.2 Creating the EtherNet/IP IO system
Similar to PROFINET or PROFIBUS there is a managing device in an EtherNet/IP
network. In this application example it is realized by the S7-1500. The managing
system is called the Scanner.
For the Scanner to know, which managed devices, called Adapters, are in the
scope, it requires some information. These information are describing the
parameters of the data exchange. They contain as minimum:
•Addressing information of the Adapter
•Update rates for both Inputs and Outputs
•Amount of data to be exchanged
As for EtherNet/IP there is no graphical way to configure the EtherNet/IP IO system
in TIA Portal the LCCF_EnetScanner function block accepts the configuration in
the form of an array of Adapter descriptions. The descriptions are best stored in a
global DB. In this application example the DB is called “EnetIoSystem”, which
stores the array with the adapter descriptions in it.

4 Configuration/Engineering
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
16
©Siemens AG 2021 All rights reserved
Figure 4-1: Datablock “EnetIoSystem”
In this chapter the application example explains how this configuration is created
and where to get the information from.
4.2.1 Creating an Adapter description
The above shown data block contains an array of type
LCCF_typeEnetAdaptConfig. This type contains all the relevant information the
LCCF_EnetScanner function block needs to operate the herein described
Adapters.
As mentioned before, it contains addressing information, which are most important.
One of these addresses is the IPv4 address the Adapter can be reached at.
Figure 4-2: IP address of an adapter
The address is stored using the system provided datatype IP_V4. The Adapter
configuration shown above is the configuration of the ET200SP MF. It has the IP
address 192.168.74.46, which is also shown in the below IP address overview.
Table 4-2: IP addresses
Role
System
IP address
EtherNet/IP Scanner
S7-1500
192.168.74.12
EtherNet/IP Adapter
ET200SP MF
192.168.74.46
S7-1200
192.168.74.45

4 Configuration/Engineering
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
17
©Siemens AG 2021 All rights reserved
Further addressing information are necessary. They will be retrieved from an
electronic data sheet (EDS), which is like a GSD file known from PROFINET and
PROFIBUS systems.
4.2.2 EDS files
The EDS file format is standardized by the ODVA® and is text based and human
readable. It contains several clusters of information. These clusters are called
segments. They are identified by their name and marked by ‘[‘ and ‘]’ characters
(squared brackets)
Figure 4-3: EDS file for ET200SP MF
Throughout this document the marked areas will be called sections. The sections
contain assignments to items.
The Adapter description required for the LCCF_EnetScanner function block, is
mostly taken from such EDS files. In the following this document explains, which
sections and items are relevant to LCCF_EnetScanner and therefore, necessary to
enter into the adapter description.
After that the procedure is repeated for the second adapter

4 Configuration/Engineering
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
18
©Siemens AG 2021 All rights reserved
Device parameters
The device describing parameters are relevant for the Scanner, as it uses this
information to verify the real existing device against the configured device. In case
there is a mismatch the operation of this device is not started.
Such information is:
•vendorIdentifier, in the EDS file called “VendCode” is an ODVA® assigned
number to the manufacturer of this device
•productType, in the EDS file called “ProdType” is a standardized number
identifying the type of the device
•productCode, the “ProdCode” called number identifies this product together
with its type and vendor ID.
•revisionMajor, the major revision number, together with the minor revision
number serves the purpose of compatibility check
•revisionMinor, as above serves the minor revision number the purpose of a
compatibility check.
They can be found at the section [Device] as shown in the below figure.
Figure 4-4: EDS file [Device] section
For the application example the transfer into the configuration inside the
EnetIoSystem data block looks like this:
Figure 4-5: [Device] section parameters
Further parameters are taken from different other sections of the EDS file.

4 Configuration/Engineering
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
19
©Siemens AG 2021 All rights reserved
Data sizes and update times
In the [Params] section, several parameter sets are defined, which are used later in
the EDS file.
The relevant information for the configuration of the EnetIoSystem are here
•Update interval
•Size of Inputs and Outputs
Figure 4-6 [Params] section RPI and Output Data size
In the above shown figure the parameter, marked with 1 describes the RPI called
“Requested Packet Interval” or update rate in µs.
The update rates in the range between 2.000µs (2ms) and 20.000.000µs (20s) are
valid for this device. The default setting is 10.000µs (10ms).
The parameter marked with 2, describes the size of the Output data in Bytes. The
valid range is in between 0 Bytes and 496 Bytes, where the default is equal to the
maximum size.
NOTE
The maximum size of 496 Bytes is a limitation given by the ODVA® specification
for EtherNet/IP. It is introduced for compatibility reasons to ControlNet, which is
another network using the same communication mechanisms defined in CIP as
EtherNet/IP.
Further down in the [Params] section you will find the other relevant information for
the Input data size and the configuration data size. They are shown in the below
figure.
1
2

4 Configuration/Engineering
EtherNet/IP Scanner
Entry-ID: 109782314, V1.1.0, 04/2021
20
©Siemens AG 2021 All rights reserved
Figure 4-7: [Params] section Input Data and Configuration Data size
Same as in the previous figure the with 1 marked area shows a relevant parameter.
In here the size of the Input Data is defined. The valid range is between 0 and 500
Bytes.
The second marked area contains the size of the configuration data. The
configuration may not exist. Therefore, the minimum size is not provided. The
configuration data may not exceed 1 Byte in maximum.
NOTE
The values for RPI and I/O sizes from the EDS file provide a valid range. The
user can choose any value in between the minimum and maximum possible
value.
The above retrieved values are to be entered into the appropriate positions of the
adapter description as shown on the next page.
This application example will use the values in the below table
Table 4-3: Configured values for ET200SP MF
Parameter name
valid range
chosen value
RPI
2ms –20s
50ms
Output Size
0 –496 Bytes
20 Bytes
Input Size
0 –500 Bytes
20 Bytes
Configuration Size
None –1
None
NOTE
The Output direction is also called the “Originator To Target” direction (short OT
direction), while the Input direction is called the “Target To Originator” direction
(short TO direction).
1
2