Profinet basics
Profinet is a field bus that communicates over Ethernet, typically at a speed of 100 Mbit/s. For details on Profinet, see https://en.wikipedia.org/wiki/PROFINET
A detailed introduction to Profinet is given in the book “Industrial communication with PROFINET” by Manfred Popp. It is available to Profinet members.
Profinet devices (IO-devices) are controlled by an PLC (Programmable Logic Controller), also known as an IO-controller.
GSD files
A GSD (General Station Description) file is an XML file describing a Profinet IO-Device. The XML-based language is called GSDML (GSD Markup Language).
Note that the GSD file is not used by the P-Net stack or application. It is a machine readable file describing the capabilities, hardware- and software versions etc, and is used by the engineering tool to adjust the PLC settings.
The GSD file describes for example which types of pluggable hardware modules that can be used in the IO-device. The GSD file is loaded into the engineering tool (typically running on a personal computer), and a user can then in the tool describe which modules that actually should be plugged into the IO-device. This is called configuration. Later this information is downloaded to the PLC (IO-controller), in a process called commissioning. At startup the PLC will tell the IO-device what type of modules it expects to be plugged in. If the correct modules not are plugged into the IO-device, the IO-device will send an error message back to the PLC.
Startup description
In the startup of an Profinet IO device (before the IP address has been set) the DCP protocol is used. It is like DHCP, but without using a central server.
The PLC sends a DCP broadcast message, and all IO Devices on the subnet answer with their MAC addresses. The PLC sends a DCP message to the IO Device with a specific MAC address, containing which IP address and station name that the IO Device should use. The IO Device sets its IP address and station name accordingly.
Then the PLC starts the actual configuration of the IO device, using the DCE/RPC protocol that runs on UDP over IP.
After the configuration is done, cyclic data is continuously exchanged between the IO-device and the PLC. This communication runs on Ethernet layer 2, i.e. the MAC addresses are used for routing frames (the IP protocol is not used in those frames).
Nodes classes and device details
Profinet defines three node classes:
Node class | Description | Supported by this software |
---|---|---|
IO-Device | “Slave” | Yes |
IO-Controller | “Master”, often a PLC. | No |
IO-Supervisor | For commissioning and diagnostics, typically a personal computer | No |
Depending on the capabilities, different conformance classes are assigned.
Conformance class (CC) | Description | Supported by this software | Communication profile (CP) |
---|---|---|---|
A | Wireless is only allowed for class A | Yes | CP 3/4 |
B | Class A + SNMP (network topology detection) | Yes | CP 3/5 |
B (PA) | Class B + System redundancy | No | |
C | Class B + IRT communication | No | CP 3/6 |
D | Uses time sensitive networking Ethernet | No | CP 3/7 |
The first digit in the Communication Profile (CP) is the Communication Profile Family (CPF). Profinet and Profibus are CPF 3, while for example Ethercat is CPF 12.
Communication profiles CP 3/1 and CP 3/2 are for Profibus. The CP 3/3 was used for the legacy Profinet CBA.
Real Time Class:
Real Time Class 1 Mandatory for conformance class A, B, C
Real Time Class 2 (legacy) Only for legacy startup mode for conformance class C.
Real Time Class 3 = IRT (Isochronous Real Time) Mandatory for conformance class C
Real Time Class UDP For cross-network real time communication. Optional for conformance class A, B, C
Real Time Class STREAM for conformance class D.
This software supports Real Time Class 1.
MAC addresses
If your device has two Ethernet connectors (ports), then it typically uses an Ethernet switch chip with three data connections:
Port X1 P1 Port X1 P2
| |
| |
| |
+--+-----------------+--+
| |
| Ethernet Switch |
| |
+----------+------------+
|
|
|
Profinet interface X1
The device has one interface and two ports. For Profinet conformance class B and higher, there are three assigned MAC addresses:
Profinet interface X1 (main MAC address or device MAC address)
Port X1 P1
Port X1 P2
The MAC addresses for X1 P1 and X1 P2 are used by the LLDP protocol for neighbor detection.
There are examples of Profinet controllers with more than one interface (having more than one port each). Each interface has its own IP address. Each port has its own MAC address.
Communication
Profinet uses three protocol levels:
Protocol | Typical cycle time | Ethertype | Supported by this software |
---|---|---|---|
TCP/IP (UDP actually) | 100 ms | 0x0800 = IPv4 | Yes |
RT (Real Time) | 10 ms | 0x8892 | Yes |
IRT (Isochronous Real-Time) | 1 ms | 0x8892? | No |
Profinet uses IPv4 only (not IPv6).
Overview of all protocols used in a Profinet Application
A typical Profinet application needs to handle a multitude of protocols. The P-Net stack implements some of them, while others are optional. For example HTTP is used by some IO-devices for additional configuration via a web page, but should be implemented outside the Profinet stack itself.
Layer | Protocol | Addressing | Content description | Protocol | Notes |
---|---|---|---|---|---|
4 | TCP | Port | SSH = 22 | Remote login on Linux | |
HTTP = 80 + 443 | Web server for configuration | ||||
4 | UDP | Port | DHCP = 67 + 68 | IP address assignment | |
SNMP = 161 + 162 | Network topology query | ||||
PNIO-CM = 34964 | Profinet start-up, uses DCE/RPC | ||||
3 | IPv4 | IP address | Protocol number | ICMP = 1 | Used by ping |
TCP = 6 | Transmission control protocol | ||||
UDP = 17 | User Datagram Protocol | ||||
2 | Ethernet | MAC address | Ethertype | LLDP = 0x88CC | Link layer discovery |
ARP = 0x0806 | IP address lookup | ||||
IPv4 = 0x0800 | Internet protocol | ||||
PN-DCP = 0x8892 | Profinet start-up | ||||
Profinet RT = 0x8892 | PNIO_PS = Cyclic IO data | ||||
(VLAN = 0x8100) | Not really a protocol | ||||
(VLAN = 0x9100) | For double tagged frames |
Profinet Profiles
There are a number of Profinet application profiles defined, for example PROFIenergy and PROFIdrive. These defines for example the cyclic data should be interpreted.
Profiles use the API (Application Program Identifier) concept for telling that profile-specific data is transferred.
Slots and modules
A Profinet IO-device has typically a number of slots where (hardware) modules can be placed. A module can have subslots where submodules are placed. Each submodule have a number of channels (for example digital inputs).
Each API has its own collection of slots.
TODO Example
Module
Submodule
Channels
Channels are always connected to submodules (rather than to modules).
Addressing a channel
Slot
Subslot
Index
First usable slot is slot number 1. Slot 0 is used for the IO-device itself, and does not have any input/output data. Instead it has diagnostic information for the IO-device.
If compile time setting PNET_MAX_SLOTS is 5, then the slots are numbered 0-4. The setting PNET_MAX_SUBSLOTS controls the number of subslots per slot, but there is no fixed relation to which subslot numbers will be used. Subslot numbers in the range 0-0x9FFF might be used.
The GSD file pretty much describes the hardware: slots (and subslots), and the modules (and submodules) that can be placed in the slots. The file does not describe which modules that actually have been placed in each slot for each device. That is done during the setup (configuration) in the engineering tool during PLC programming.
Also in the GSD file is description on the data exchange?
Type | Description |
---|---|
Compact field device | Not possible to change modules etc? |
Modular field device | Change modules at configuration? |
Payload
The Profinet payload is sent as big endian (network endian) on the wire.
The maximum data (and status) size in total in each direction for a device is 1440 bytes. If this is consumed by a single subslot the maximum data size is 1438 byte (plus one or two bytes for IOPS and IOCS). See the IOData entry in the GSDML specification.
If the IOPS (producer status) for a subslot goes to BAD, the PLC will indicate an error “User data failure of hardware component”. It will persist until the communication is restarted to the IO-device.
I&M data records
This is Identification & Maintenance records, which are human-readable information about the model type, software version etc. Some fields are writable, for example where the device is located.
Up to I&M15 is described in the standard. The P-Net stack supports I&M0 – I&M4. You must support writing to I&M1-3 for at least one of the DAP submodules.
Data record | Mandatory | Controller can write? | Description |
---|---|---|---|
I&M0 | Yes | No | Vendor ID, serial number. Hardware and software version etc. |
I&M1 | No | Yes | Tag function and location |
I&M2 | No | Yes | Date. Format “1995-02-04 16:23” |
I&M3 | No | Yes | Descriptor |
I&M4 | No | Yes | Signature. Only for functional safety. |
There is also I&M0 Filterdata, which is read only.
Startup modes
The startup mode was changed in Profinet 2.3, to “Advanced”. The previous startup mode is now called “Legacy”.
Net load class
The net load class describes how much non-Profinet data the device is able to handle without problems. These are the available classes:
I
II
III (Can handle the highest amount of data on the network)
Alarm types
A process alarm describes conditions in the monitored process, for example too high temperature.
A diagnostic alarm describes conditions in the IO Device itself, for example a faulty channel or short circuit. Diagnostic alarms are also stored in the IO-Device.
Description of supported alarm types:
Name | Hex | Description |
---|---|---|
Diagnosis | 0x0001 | There is something wrong with the IO device itself |
Process | 0x0002 | There is something wrong with the process, for example too high temperature. High priority. |
Pull | 0x0003 | Submodule pulled from subslot. |
Plug | 0x0004 | Module/submodule plugged into slot/subslot. |
Controlled by supervisor | 0x0008 | |
Released | 0x0009 | |
Plug wrong submodule | 0x000A | Wrong module/submodule plugged into slot/subslot. |
Return of submodule | 0x000B | |
Diagnosis disappears | 0x000C | A kind of diagnosis alarm |
Port data change notification | 0x000E | Port up, or peer changes name. A kind of diagnosis alarm. |
Pull module | 0x001F | Module pulled from slot. |
Only process alarms are sent with high prio, all other alarms use low prio.
Diagnosis
Diagnosis alarms are sent to indicate for example short-circuit on an output.
To localize the diagnosis source, these values are required:
API
Slot
Subslot
Channel number (Use 0x8000 for “whole submodule”)
Accumulative (true when describing a channel group)
Direction (in or out. Use “manufacturer specific” for “whole submodule”)
Do not update diagnosis information at a higher frequency than 1 Hz.
Logbook
A logbook is a circular buffer with at least 16 entries. The IO-controller can read out entire logbook. Each entry contains:
A timestamp
Error codes (4 bytes)
A manufacturer specific entry detail (uint32_t)