PROFIBUS frame analysis - Peter Thomas of Control Specialists

A Demonstration

of PROFINET

Frame Analysis

using

Peter ThomasControl Specialists Ltd

www.controlspecialists.co.uk

An Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)

2Objectives

• To gain an understanding of the way in which PROFINET devices communicate with one another over Ethernet.

• To learn how to capture the PROFINET Frames using Wireshark®.

• To see how Wireshark® can be used to analyse the captured frames to gain an understanding of the various protocols.

• This is a topic covered in more detail in the Certified PROFINET Engineers Course

www.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)

3What is Wireshark?

• Wireshark® is a network protocol analyser.It lets you capture and interactively browsethe traffic running on a computer network.

• It is not dedicated to PROFINET and assuch cannot be compared to ProfiTrace.

• It is free to download and available fromwww.wireshark.org


4The need for Real Time


• Normal, office-like, Ethernet communication, as defined in IEEE 802.3, is non-deterministic, i.e. the time to transmit a message from one device to another, and then receive a response, is undefined and cannot be guaranteed.

• Industrial Automation Control Systems require Deterministic or “Real Time” Communications.

• Software and/or hardware solutions allow IEEE 802.3 to be deterministic and operate in Real Time.

• Remote I/O (typical PLC) applications generally require guaranteed responses in the order of 5-10mS.

• Motion Control applications are even more demanding requiring cycle times of <1mS.

5What is PROFINET

• It is an Industrial Ethernet Protocol.• Unlike conventional, office-like, Ethernet,

PROFINET is deterministic meaning that itis capable of supporting guaranteed cycletimes.

• There are two “real time” variants ofPROFINET, RT for conventional PLCapplications (Typ 10mS) and IRT for HighSpeed applications (Typ 250µS but 31.25µSASICS have been developed).

• Although considered to be the modern-dayalternative to PROFIBUS DP, PROFINET isNOT PROFIBUS over ETHERNET.


Device to Device Communication (Ethernet)6

APPLICATION LAYER(HTTP / SMTP / FTP)

PRESENTATION LAYER

SESSION LAYER

TRANSPORT LAYER(TCP / UDP)

NETWORK LAYER (IP)

DATALINK LAYER (MAC ADDRESS)

PHYSICAL LAYER

APPLICATION LAYER(HTTP / SMPTP / FTP)

PRESENTATION LAYER

SESSION LAYER

TRANSPORT LAYER (TCP / UDP)

NETWORK LAYER(IP)

DATALINK LAYER(MAC ADDRESS)

PHYSICAL LAYER

Device 1 Device 2

= Potential Delayswww.controlspecialists.co.ukAn Introduction to PROFINET Frame Analysis using Wireshark – V1.1 (21/08/2013)

Device to Device Communication (PROFINET)7

IO Controller IO Device

STANDARD

PRESENTATION LAYER

SESSION LAYER

TRANSPORT LAYER (UDP)

NETWORK LAYER

(IP ADDRESS)


PHYSICAL LAYER

REAL TIME STANDARD

PRESENTATION LAYER

SESSION LAYER

TRANSPORT LAYER(UDP)

NETWORK LAYER

(IP ADDRESS)


PHYSICAL LAYER

REAL TIME


8Frame Capturing Ports


9Frame Capturing – Mirrored Ports


10Frame Capturing – Mirrored Ports

Switch A – Port 2(IM153-3 & WAGO)

Switch B – Port 2(IM153-3 ONLY)

LAN LAN

TO/FROM CPU

TO/FROM IM153-3

TO/FROM WAGO


11Frame Capturing – ProfiTap

USBXTO/FROM IM153-3

TO/FROM CPU

TO/FROM WAGO


12Scope of this workshop

• Wireshark® can be used to capture andanalyse PROFINET traffic during thefollowing events:-

– Start-Up– Data Exchange– Loss of Module– Loss of Communications– Duplicate Device Name


13Equipment used in this workshop

• Siemens S7 PLC Hardware & Switches.• Wago IO• ProfiTap from Procentec• Wireshark® Network Protocol Analyser.


14Siemens – Hardware Configuration


15IEEE 802.3 EtherNet Frame

40 – 1500 BYTES

DATASOURCEMAC

6 BYTES

DESTMAC

ETHERTYPE

FRAMECHECKSEQ

ETHER TYPE EXAMPLES

0800: Internet Protocol (IPV4)0806: ARP8892: PROFINET88CC: LLDP

Format / Contents dependent upon the value of the

ETHER TYPE

ETHERNET HEADER ETHERNET TRAILER

Note – VLAN Tags (Bandwidth Control / Prioritisation),IFG (Inter Frame Gap), Preamble and

SFD (Start Frame Delimiter) bytes not shown.

ETHERNET FRAME

6 BYTES 2 BYTES 4 BYTES


16PROFINET Frame

SOURCE ADDRESS DESTINATION ADDRESS ETHERTYPE

PROFINET IO DATA CYCLE COUNTER DATA STATUS

FRAME ID

TXFR STATUS

ETHERTYPE 8892 = PROFINET, FRAME ID 8000 = REAL TIME CLASS 2

-- APPLICATION PROTOCOL DATA UNIT STATUS --


17PROFINET Frame (CPU to OUTPUTS)

SLOT 1SLOT 2

SLOT 3SLOT 4

IOPS SLOT 3/4 DIG OUT DATA

DAP

DAP = DEVICE ACCESS POINT (IO DEVICE STATUS) 00 = BAD, 80 = GOOD

IOPS = IO PROVIDER STATUS (DATA STATUS @ CPU) 00 = BAD, 80 = GOOD


18Common Protocols seen on PROFINET

• PNIO-DCP – Device Name / IP Address Assignment• PNIO-CM – Start-up Services between an IO

Controller and each IO Device.• PNIO – Cyclic IO Data Exchange

• PN-PTCP – Time Syncronisation• PNIO-AL – Acyclic Alarms / Events

• ARP – IP Address – MAC Address Lookup• LLDP – Device Identity & Properties.


19WIRESHARK - HomePage


20WIRESHARK – Frame Analysis

Packet Filter

Expression Filter Buttons

Packet Details Window

Packet Bytes Window

Packet List Window


21Protocol Usage: Start-up to Data Exchange

Assign Device Name *

PNIO-DCP / ARP Assign IP Address

Establish Connection

PNIO-DCPor LLDP

PNIO-CM

PNIO Cyclic Data Exchange

IO Device confirms Name SET

IO Device confirms IP Address SET

Connection Established

* DEVICE NAME ASSIGNMENT

Device Names can be set up Manually, prior to connecting to the network, or Automatically on power-up.

Manual name assignment uses PNIO-DCPand tools such as the Primary Set-Up Toolfrom Siemens or Netilities from Procentec.

Automatic name assignment uses theLLDP protocol and requires the use of a PROFINET Topology Configuration Tool.

Primary Setup Tool


Determine MAC Address

22Demonstration

Demonstration


PROFIBUS frame analysis - Peter Thomas of Control Specialists

Technology

Transcript of PROFIBUS frame analysis - Peter Thomas of Control Specialists