Abstract: Based on the introduction of Siemens S7-200 series programmable logic controllers and the host computer monitoring software "Kingview", this paper proposes a method for real-time monitoring of Siemens PLCs using Kingview software with VB6.0, according to the requirements of the microcomputer monitoring system of the switch test bench. Keywords: Kingview; programmable logic control (PLC); dynamic data exchange (DDE) 1 Introduction The Kingview software system, a general-purpose configuration software for industrial automation, is independent of the specific PLC or field components used by the engineers. For different hardware facilities, you only need to configure the corresponding communication driver for KingSCADA. The hardware devices supported by KingSCADA include: programmable controller (PLC), intelligent module, board, intelligent instrument, frequency converter, etc. PLC is widely used in the field of industrial control due to its excellent reliability and convenient programmability [1]. The purpose of realizing communication between PC and PLC is to provide users with a variety of functions such as process flow diagram display, dynamic data screen display, report display, window technology, etc., and to provide PLC with a good human-machine interface. This project uses Siemens' S7-200 series programmable controller [2] and upper industrial control computer to form a control system. The upper computer monitoring software uses the 6.5 "KingSCADA" configuration software of Beijing Yacon Technology Development Co., Ltd. to realize process monitoring and data processing of the switch machine test bench. 2 System Introduction Switch machine is a common device on railway used to control the direction of train movement. The extension or retraction of the switch machine's movable rod determines the different directions of train movement. The real-time monitoring system for switch machines uses KingSCADA as the main operating screen. First, the parameters of the monitored system are set on the KingSCADA interface. Then, the test bench of the switch machine under test is started. The operating status of the lower-level machine can be dynamically displayed on the KingSCADA interface, and various electrical performance indicators of various electric DC switch machines can be tested, such as working current, working voltage, friction current (fault current), switching force and switching time (action time). Since KingSCADA only provides drivers for this type of Siemens programmable logic controller (PLC) and does not provide its communication protocol, it is quite difficult to directly develop the communication protocol of the PLC within the not very powerful KingSCADA. The general method is to use the serial communication function provided by Visual Basic [3], [4] to realize communication with the PLC, and then use the DDE function of VB to complete the dynamic data exchange between KingSCADA and Visual Basic. In this way, the external signals collected from the PLC are indirectly and dynamically displayed on the KingSCADA interface through Visual Basic. Its system structure is shown in Figure 1. 3 Implementation of serial communication between VB and PLC The PC with asynchronous communication adapter and PLC can only communicate with each other if the following conditions are met[5]: the PLC with asynchronous communication interface can be interconnected with the PC with asynchronous communication adapter; the bus standards used by both parties are consistent, otherwise they must be converted by the "bus standard conversion unit" before they can be interconnected; the initialization, baud rate, data bits, stop bits, and parity of both parties are the same. Only when the communication protocol of PLC is clearly analyzed, the communication program of PC should be written strictly in accordance with the protocol and frame format. PLC is equipped with a communication mechanism, and generally does not require user programming. PC and Siemens series PLC cannot be directly connected. They need to be converted to RS232/RS485 through a PC/PPI cable. Figure 2 shows the connection relationship between them. 3.1 Communication protocol setting of PLC The communication protocol of PLC is accomplished by initializing its free port. In free port mode, the communication protocol is completely controlled by the ladder diagram. Free port communication can only be performed when the CPU is in RUN mode. SMB30 (for port 0) and SMB31 (for port 1) are used to select the baud rate, parity, and number of data bits. The control bytes for the free port are described as follows: BBB Free Port Baud Rate 000 = 38400 baud 100 = 2400 baud 001 = 19200 baud 101 = 1200 baud 010 = 9600 baud 110 = 600 baud 011 = 4800 baud 111 = 300 baud PP Parity Selection MM Protocol Selection 00 = No Parity 00 = Point-to-Point Protocol (PPI/Slave Mode) 01 = Even Parity 01 = Free Port Protocol 10 = No Parity 10 = PPI/Master Mode D Data Bits per Character 0 = 8 bits per character 1 = 7 bits per character Here, SMB30 (for port 0) is selected, and the set byte is 9 (0 0001 001H), meaning: this protocol is a free port protocol, the free port baud rate is 9600, there is no parity, and each character has 8 data bits. The Send (XMT) instruction activates the data in the transmit data buffer (TBL). The first data in the data buffer indicates the number of bytes to be sent. PORT specifies the port used for transmission. The XMT instruction sends one or more characters, up to a buffer of 255 bytes. If an interrupt routine is connected to the end-of-transmission event, an interrupt is generated when the last character in the buffer is sent (interrupt event 9 for port 0, interrupt event 26 for port 1). The XMT instruction can monitor changes in the transmit completion status bit SM4.5 or SM4.6 instead of using an interrupt for transmission. The Receive (RCV) instruction activates the service to initialize or terminate receiving information. Information received through the specified port (PORT) is stored in the data buffer (TBL). The first data in the data buffer indicates the number of bytes received. The RCV instruction receives one or more characters, up to a buffer of 255 characters, which are stored in the buffer. If an interrupt routine is connected to the receive completion event, an interrupt is generated when the last character in the buffer is received (interrupt event 23 for port 0, interrupt event 24 for port 1). Instead of using interrupts to receive information, you can monitor changes in the state of the SMB86 or SMB186. This program demonstrates the use of receiving and sending; it receives a string of characters until it receives a carriage return character, at which point the information is sent back to the sender. MAIN: LD SM0.1 MOVB 16#9, SMB30 // Select 9600 baud rate, 8-bit data, no parity MOVB 16#B0, SMB87 // Initialize RCV information control information MOVB 16#0A, SMB89 // Set the end of the message to a carriage return MOVW 5, SMW90 // Set the idle timeout to 5ms MOVB 100, SMB94 // Maximum number of characters is 100 ATCH 0, 23 // Connect the receive completion event to the interrupt ATCH 1, 9 // Connect the send completion event to the interrupt ENI // Enable interrupt RCV VB100, 0 // Receive mailbox buffer points to VB100 INT_0: INT_1: LDB= SMB86, 16#20 LD SM0.0 MOVB 10, SMB34 DTCH 10 ATCH 2, 10 XMT VB100, 0 CRETI INT_2: NOT LD SM0.0 RCV VB100, 0 RCV VB100, 0 3.2 VB Communication Protocol In VB, the MSComm control can obtain data from the port using polling or event-driven methods [6]. Here, the event-driven method is used. This method is to make the program automatically jump to a program segment when an event occurs. The Oncomm event of the control performs this function. The Oncomm program is responsible for responding to events such as hardware interrupts in the serial port or a software buffer counter reaching a trigger value. Place a TextBox control in VB. Set the VB communication protocol by setting its Settings, CommPort, InputMode, Handshaking, and PortOpen properties. Here, the Settings property is set to: 9600, n, 8, 1, that is: the free port baud rate of this protocol is 9600, there is no parity check, and the data bits of each character are 8 bits. 4. Implementation of Data Exchange between VB and KingSCADA Software Communication between VB and KingSCADA is primarily achieved through Dynamic Data Exchange (DDE) provided by KingSCADA. DDE is a complete communication protocol on the Windows platform that enables applications to exchange data and send commands to each other. The DDE process can be likened to a dialogue between two people. The party asking the question is called the "Client," and the party answering is called the "Server." An application can be both a "Client" and a "Server": when it requests data from other programs, it acts as a "Client"; if other programs need it to provide data, it becomes a "Server." The key here is to enable KingSCADA to receive data from VB as a client program. Making VB a "Server" is simple; just set the three identifiers of the server program in KingSCADA (application name, subject name, project name) and set the LinkMode property of the form providing data in the VB application to 1. No additional programs need to be added to VB. It is worth noting that the VB FormTopic property should be set to the same "topic name" as when defining the DDE device in KingSCADA; the value of the TextBox control specified in the specified VB executable file should be displayed in KingSCADA. 5. Conclusion Before the system starts running, the VB executable file must first be run as a background program before the KingSCADA system can run. When the PLC sends data, VB receives this data and then displays it on the KingSCADA interface through the DDE function provided by KingSCADA. In this way, external signals acquired from the PLC are indirectly and dynamically displayed on the KingSCADA interface through VB. This method enables KingSCADA to monitor Siemens PLCs in real time. Testing shows that the system's real-time response speed can reach the millisecond level, and this method of implementing real-time system monitoring is highly portable and applicable to monitoring other types of PLCs or microcontrollers. References: [1] Qi Congqian, Wang Shilan (eds.). PLC Technology and Application [M]. Beijing: Machinery Industry Press, 2000. [2] Fan Yizhi, Chen Liyuan, Sun Dexuan et al. Using Visual Basic to Implement Serial and Parallel Communication Technology [M]. Beijing: Tsinghua University Press, 2001. [3] Yang Yong. Using VB6.0 to Implement Serial Communication between PLC and Host Computer [J]. Microcomputer Information, 2005, 10-1: 56-59. [4] Jan Axelson. Serial Port Encyclopedia [M]. Translated by Elite Technology. Beijing: China Electric Power Press, 2001. [5] (US) McKelvey, Martinson. Visual Basic 5 Development and User Manual [M]. Translated by Yang Jiping. Beijing: Machinery Industry Press, 1997. [6] Siemens Corporation. Siemens SIMATIC S7-200 Programmable Controller System Manual [M]. 2000.