PLC batch read-write transmission method based on MQTT and S7 protocol
Patent Information
- Application Number
- CN202211109321.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-09-13
- Publication Date
- 2026-11-03
- Estimated Expiration
- 2042-09-13
AI Technical Summary
In existing technologies, the data reading and writing transmission methods of Siemens PLCs are complex and lack universality. OPC Servers require host computer resources, are complex to operate, have high technical barriers, and are difficult to popularize.
By adopting the open-source S7 protocol, constructing an XML file structure and a multi-threaded mechanism, and using MQTT to transmit PLC data, batch reading and writing are achieved, reducing coupling and resource consumption.
It enables efficient batch reading and writing of PLC data, reduces program coupling and resource consumption, improves scalability and flexibility, and simplifies the operation process.
Smart Images

Figure CN117742714B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of IoT sensing technology in industrial internet digital workshops, specifically a batch read / write transmission method for remote PLCs based on MQTT and S7 protocols. Background Technology
[0002] As the manufacturing industry continues to develop towards intelligence and digitalization, intelligent manufacturing has become a hot topic. PLCs, with their advantages of stable operation and programmable logic control, play a crucial role in this field. In intelligent manufacturing production scenarios, the reading and writing of PLC data directly impacts the ability to centrally manage and control the production process. In typical industrial production scenarios, PLCs directly control the operation of lower-level production equipment, while upper-level systems can control and adjust the entire production process by acquiring and writing data from the PLC. Since Siemens PLCs are widely used in industrial settings and have a high market share, current methods for reading and writing Siemens PLC data are complex and lack universality. They mainly fall into two categories: The first is based on OPC technology, which requires installing an OPC Server on the host computer, making operation complex and requiring significant host computer resources, thus limiting its portability. The second method involves installing dedicated communication programming on the PLC, but this method has a certain technical threshold and cannot be widely adopted. Summary of the Invention
[0003] In view of this, the present invention proposes a method for implementing host computer reading and writing PLC data using the open source S7 protocol, which directly utilizes existing S7 related functions to realize the host computer's batch reading and writing of PLC data.
[0004] The technical solution adopted by the present invention to achieve the above objectives is as follows:
[0005] A PLC batch read and transmission method based on MQTT and S7 protocols includes the following steps:
[0006] 1) Construct the XML file structure for reading PLC data and write the PLC parameter information into the XML file;
[0007] 2) Parse the XML file and check the completeness of the parsing results. If the results are complete, proceed to step 3); otherwise, return to step 1.
[0008] 3) Allocate a new thread for the parsing results of the XML file. In the new thread, use the parsing results of the XML file to read all the PLC data into memory in byte order.
[0009] 4) Deserialize the byte sequence in memory to obtain the PLC's raw data;
[0010] 5) Use MQTT to transmit raw PLC data.
[0011] The structure of the XML file is as follows:
[0012] An XML file has one and only one root node. All first-level child nodes of the root node are used as the basis for dividing the XML file into multiple data blocks. Each data block corresponds to a continuous segment of data points in a PLC. Each data block is divided into a three-level nested structure. The first level is the device tag, whose attributes contain necessary information for PLC connection, including: PLC IP address, PLC CPU type, PLC name, and fixed parameters for PLC connection. The second level is the data block tag, whose attributes contain the address block of the target address to be monitored in the PLC, the starting address of the bytes to be read from this address block, and the number of bytes. The third level is the data point tag, whose attributes include detailed information about all the data points being operated on, including the specific address of the data point, the specific type of the data point, the ordinal number of the data point, and the specific meaning of the data point.
[0013] Step 3) specifically includes:
[0014] Based on the parsing results of the XML file, a new thread is created. This thread calls the byte reading method provided by the S7 protocol to read data from the PLC at the starting address. When the number of bytes to be read is greater than N bytes, the S7 protocol needs to be called multiple times until all bytes have been read.
[0015] Step 4) specifically includes:
[0016] 4.1) Convert the specific address into an offset of the byte list, and extract all bytes of the data according to the number of bytes occupied by each data type;
[0017] 4.2) Rearrange the bytes and then deserialize the rearranged byte sequence into the original data in the PLC.
[0018] Step 5) specifically includes:
[0019] The raw data is encapsulated into a Key-Value format using a function, where the Key represents the PLC's IP address and the Value is the data in the PLC. This triggers the corresponding MQTT topic, transmitting the data to the remote client.
[0020] A PLC batch writing method based on MQTT and S7 protocols includes the following steps:
[0021] 1) Construct the structure of the XML file for writing data to the PLC, and write the PLC parameter information and the data to be written into the XML file;
[0022] 2) Parse the XML file and check the completeness of the parsing results. If the results are complete, proceed to step 3); otherwise, return to step 1.
[0023] 3) Allocate a new thread for the parsing results of the XML file. In the new thread, use the parsing results of the XML file to write the data into the PLC bit by bit.
[0024] The nested structure of the XML file is as follows:
[0025] An XML file has one and only one root node. Using all first-level child nodes of the root node as the basis for data block division, the XML file is divided into multiple data blocks. Each data block corresponds to a PLC. Each data block is divided into a three-level nested structure. The first level is the device tag, whose attributes contain necessary information for PLC connection, including: PLC IP address, PLC CPU type, PLC name, and fixed parameters for PLC connection. The second level is the data block tag, whose attributes contain the address block of the target address to be monitored for that PLC. The third level is the data point tag, whose attributes include detailed information about all data points being operated on, including the specific address of the data point, the specific type of the data point, the ordinal number of the data point, the data to be written to the data point, and the specific meaning of the data point.
[0026] Step 3) specifically includes:
[0027] Based on the parsing results of the XML file, a new thread is created. This thread calls the bit-by-bit writing method provided by the S7 protocol to write the data bit by bit according to the specific address of the data point.
[0028] The present invention has the following beneficial effects and advantages:
[0029] 1. Low coupling: This invention uses XML files to store data, which reduces the coupling of the program. Even if the source code is changed, the data in the XML file can be changed.
[0030] 2. High scalability: This invention uses XML files to configure the access list, which allows for flexible and convenient addition and deletion, resulting in high scalability;
[0031] 3. Low resource utilization: This invention directly uses the S7 protocol package provided by Siemens. No services need to be installed in the host computer development. Furthermore, it reads the required data with the fewest number of reads, greatly reducing resource utilization. Attached Figure Description
[0032] Figure 1 This is an overall flowchart of the present invention;
[0033] Figure 2 A diagram illustrating the data block division of an XML file when reading data from a PLC.
[0034] Figure 3 This diagram illustrates the data block division of an XML file when writing data to a PLC. Detailed Implementation
[0035] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.
[0036] A PLC batch read / write transmission method based on MQTT and S7 protocols includes the following steps:
[0037] PLC Batch Reading and Transmission: This process involves constructing an XML file structure for reading PLC data, writing parameters such as the address of the PLC's soft components into the XML file; parsing the data blocks in the XML file; obtaining the detailed address and the number of bytes to be read from the XML file; and reading the PLC data byte by byte according to the S7 protocol supported by the PLC and the detailed address and number of bytes provided in the XML file. The obtained bytes are then parsed according to other parameters provided in the XML file to obtain the required data. The obtained PLC data is sent to the corresponding topic on the MQTT server. Other clients subscribing to this topic on the server can receive the PLC data. Specifically, the raw PLC data is obtained, encapsulated into a Key-Value format, where the Key represents the PLC soft component address and the Value is the PLC's internal data. This triggers the corresponding MQTT topic to transmit the data.
[0038] PLC Batch Writing: This involves constructing the structure of an XML file for writing data to the PLC. During PLC writing, data is written sequentially according to data type. This is primarily achieved by adding data values to be written within a nested structure. Entity classes are designed to store the data to be written, its type, and the address of the soft component. Each data value, its type, and the soft component address constitute an object of this entity class. These objects are stored using an operation data list. The operation data list is then iterated through to write the data to the PLC's data blocks, thus realizing the batch writing function.
[0039] The aforementioned XML structure determination involves an XML file having one and only one root node. All first-level child nodes of the root node are used as the basis for dividing the XML file into multiple data blocks. Each data block corresponds to a continuous segment of data points in a PLC and also corresponds to a thread, enabling the system to utilize multi-threading characteristics for parallel reading and writing to multiple PLCs. Each data block corresponds to a continuous segment of data points in a PLC: each data block is divided into a three-level nested structure. The first level is a device tag, whose attributes contain necessary information for PLC connection. The second level is a data block tag, whose attributes contain the address block of the target address to be written to the PLC. The necessary information includes: the PLC's IP address, CPU type, name, and fixed parameters for PLC connection. The third level is a data point tag, whose attributes include detailed information about all data points being operated on, including the specific address, type, ordinal number, meaning, and data to be written. The three-level tag structure has a parent-child-grandchild structure.
[0040] The process of writing the parameter information such as the address to be detected of the programmable controller (PLC) into an XML file involves: mapping the designed XML data blocks to each PLC, and mapping the three-level nested structure of the data blocks to the detailed information under the PLC.
[0041] The process of parsing data blocks in an XML file to obtain detailed addresses and parameters such as the number of bytes read from the XML file is as follows: Based on the characteristics of XML files, multiple data blocks are processed in parallel by multiple threads. Each data block has a parent->child->grandchild relationship, and entity classes are set up to store them accordingly. If there are multiple data entries, a list data structure is used to store the instantiation information.
[0042] The process of reading all PLC data in byte sequence according to the detailed address, number of bytes, and other parameter information provided by the XML file based on the S7 communication protocol supported by the PLC is as follows: According to the S7 communication protocol supported by the PLC, one thread performs batch reading of a PLC, and all the read data is stored in a byte list in the form of bytes, stored in memory, and awaits the next operation.
[0043] The software implementation process for obtaining the required data by deserializing the obtained bytes according to other parameter information provided by the XML file is as follows: convert the address provided by the third-level tag attribute of the XML into the offset in the byte list, determine the storage size end of the data in the PLC and the number of bytes occupied by the PLC data, and use the left shift operator of the high-level programming language to deserialize it into the original data in the PLC.
[0044] The obtained PLC data is sent to the corresponding topic on the MQTT server. Other clients subscribing to this topic on the server can receive the collected PLC data. The implementation method is as follows: after the program obtains the data in the PLC soft element, it encapsulates the data into a Key-Value format. The Key value represents the address of the PLC soft element, and the Value value is the data in the PLC. Then, it triggers the corresponding topic on the MQTT server to upload the data to the MQTT software service.
[0045] The XML file structure for PLC writing is as follows: The first nested structure is the device tag, whose attributes contain the necessary information required for PLC connection; the second nested structure is the data block tag, whose attributes contain the address block of the target address to be monitored for the PLC, and the necessary information includes: PLC IP address, PLC CPU type, PLC name, and fixed parameters for PLC connection; the third nested structure is the data point tag, whose attributes contain detailed information about all data points being operated on, including the specific address of the data point, the specific type of the data point, the ordinal number of the data point, the data to be written to the data point, and the specific meaning of the data point.
[0046] Figure 1 This paper demonstrates a PLC batch read / write transmission method based on MQTT and S7 protocols, including the following steps:
[0047] (1) XML file structure design and initialization
[0048] like Figure 2 The diagram shown is a schematic representation of the XML file data block division when reading PLC data in an embodiment of the present invention. Figure 2 In this context, an XML file contains multiple data blocks. Each data block corresponds to a continuous data point in the PLC, and the nesting structure within the data blocks is determined. The attributes of the first-level nested node tag should contain basic information about the PLC, including: IP address, port number, PLC type, PLC number, PLC name, and fixed parameters required by the S7 protocol. The specific content is shown in Table 1.
[0049] Table 1
[0050]
[0051]
[0052] CupType includes various types, such as S7200, S7300, S7400, S71200, and S71500. Each PLC model has a different Rack and Solt, which are also different. For example, for S7200, Rack=0 and Solt=1.
[0053] Under the first level of nested node labels, there is a second level of nested node labels. This level of labels contains information about the data points to be read, including: PLC data block number, start address, and the number of bytes to be read. The data point information is shown in Table 2 below. The third level of label attributes records other information about the data points in address order, such as the actual address of the data point, data type, specific meaning, and sorting sequence. Figure 1 The following table (Table 3) provides a detailed explanation.
[0054] Table 2
[0055] 1 Block PLC data block number 2 BeginAddress Start reading address 3 ReadCount Number of bytes to read
[0056] Table 3
[0057] 1 Address The real address of the data point 2 DataType Data type of data points 3 Desc The specific meaning of data points 4 Pos Sort sequence of data points
[0058] The DataType includes Bit, Byte, Char, Word, Int, DWord, DInt, Real, and String, which occupy 1 / 8, 1, 1, 2, 2, 4, 4, 4, and 256 bytes respectively in the PLC. It should be noted that if the data point data type is Bit, the starting address is determined by moving forward; for example, if the starting address is 1.1, then the starting address can be set to 1.
[0059] like Figure 3 The diagram shown is a schematic diagram of XML file data block division when writing data to PLC in an embodiment of the present invention. It can be seen that when writing, it is only necessary to add the data to be written to the XML file.
[0060] Configuring XML files can decouple programs, reduce the operability for non-programmers, and make programs more flexible and versatile. In addition, configuring XML files can place data point addresses consecutively in a data block, reducing the number of read and write operations and improving read and write efficiency.
[0061] (2) Parsing XML files and implementing dynamic threading mechanism to read and write PLCs
[0062] After configuring the XML file, the data blocks of the XML file are parsed to obtain the detailed address and the number of bytes read. The program checks whether the information provided by the XML file is complete and whether there are any points to be checked. If the information is complete, execution continues; otherwise, the XML file is redesigned. Then, according to the S7 communication protocol supported by the PLC, the detailed address provided by the XML file, and the number of bytes read, the PLC data is read into memory in byte sequence and stored in a list in order. The obtained byte sequence is deserialized according to the other parameter information of the data points provided by the XML file to obtain the required data. The specific reading and deserialization may include the following steps:
[0063] By obtaining data point information from the XML file, a new thread is created to read data points at consecutive addresses from the PLC. This thread calls the byte-reading method provided by the S7 protocol to read data from the PLC at the starting address. Since the S7 protocol's byte-reading method can only read 200 bytes or less at a time, if more than 200 bytes need to be read, the method is called multiple times. Each time, 200 bytes of data are read and stored in a byte list. If the last byte count is less than 200, the actual number of bytes is read and stored in the byte list until all bytes have been read. Because a byte list is obtained, not the PLC's raw data, the bytes need to be deserialized to obtain the raw data from the PLC. Figure 2 The third-level tag attribute description of the data block in the XML file shows detailed information such as the specific address, data type, and other information of each data point. First, the specific address is converted into an offset of the byte list. Based on the number of bytes occupied by each data type, all bytes of that data are extracted. Then, according to the big-endian storage characteristics of the PLC, the bytes are rearranged. Finally, this byte sequence is deserialized into the original data in the PLC. It should be noted that the String type in Siemens PLCs occupies 256 bytes. The first byte stores the total number of characters, and the second byte stores the current number of characters. Therefore, during deserialization, the first two bytes need to be removed; otherwise, garbled characters will appear. Because the number of write operations from the host computer to the PLC is relatively small, the single-point write method provided by the S7 protocol can be used to separate batch writes. The specific operation steps are as follows:
[0064] By obtaining the data point information provided by the XML file, a new thread is opened for writing data. Before writing, it is also necessary to check whether the information provided by the XML file is complete. This thread calls the single-point writing method provided by the S7 protocol. By using the specific address and data type of the data point, different methods are called to write the data into the PLC, and feedback can be provided on the successful writing of data.
[0065] (3) MQTT data transmission
[0066] The acquired PLC data is sent to the corresponding topic on the MQTT server. Other clients subscribing to this topic on the server can then receive the collected PLC data. The specific steps are as follows:
[0067] Obtain the raw data from the PLC, encapsulate it into a Key-Value format using a function, where the Key represents the PLC's IP address and the Value is the data from the PLC. The Value is also a combination of Key-Value format strings, as shown in Table 4 below. Then, trigger the corresponding MQTT topic to transmit the data to the remote client.
[0068] Table 4
[0069] Key Value Specific meaning Address DB1.4.0 The specific address of this data Data 1 The true content of this data DataType Int The data type Desc Switching threshold The specific meaning of this data .
Claims
1. A PLC batch reading and transmission method based on MQTT and S7 protocols, characterized in that, Includes the following steps: 1) Construct the XML file structure for reading PLC data and write the PLC parameter information into the XML file; 2) Parse the XML file and check the completeness of the parsing results. If complete, proceed to step 3; otherwise, return to step 1. 3) Allocate a new thread for the parsing results of the XML file. In the new thread, use the parsing results of the XML file to read all the PLC data into memory in byte order. 4) Deserialize the byte sequence in memory to obtain the PLC's raw data; 5) Use MQTT to transmit raw PLC data; The specific structure of the XML file is as follows: An XML file has one and only one root node. All first-level child nodes of the root node are used as the basis for dividing the XML file into multiple data blocks. Each data block corresponds to a continuous segment of data points in a PLC. Each data block is divided into a three-level nested structure. The first level is the device tag, whose attributes contain the necessary information for PLC connection, including: the PLC's IP address, CPU type, name, and fixed connection parameters. The second level is the data block tag, whose attributes contain the address block of the target address to be monitored in the PLC, the starting address of the bytes to be read from this address block, and the number of bytes. The third level is the data point tag, whose attributes include detailed information about all the data points being operated on, including the specific address, type, ordinal number, and meaning of the data point. Step 3) specifically refers to: Based on the parsing results of the XML file, a new thread is created. This thread calls the byte reading method provided by the S7 protocol to read data from the PLC at the starting address. When the number of bytes to be read is greater than N bytes, the S7 protocol method needs to be called multiple times until all bytes have been read. Step 4) specifically involves: 4.1) Convert the specific address into an offset of the byte list, and extract all bytes of the data according to the number of bytes occupied by each data type; 4.2) Rearrange the bytes, and then deserialize the rearranged byte sequence into the original data in the PLC; Step 5) specifically involves: The raw data is encapsulated into a Key-Value format using a function, where the Key represents the PLC's IP address and the Value is the data in the PLC. This triggers the corresponding MQTT topic, transmitting the data to the remote client.
