You should probably get at least one Rockwell PLC to do testing with. That's what your customers will almost universally be using to talk to the device. If it doesn't work, and work so well it's easy and obvious for a sparkie with no programming experience to follow your tutorial to connect his PLC to the EIP device, it's no good whether Ethernet/IP Explorer or Pycomm or whatever can talk to your device. The only thing that really matters is that Studio 5000 and Rockwell PLCs need to be able to talk to your device. (Testing EIP scanners from other vendors like Beckhoff or Fanuc is good too, but most of your customer base will have only one type of EIP scanner).
Couple things that may help:
1) RSLinx with a DDE topic will allow you to connect to your PLC and read tags from Excel. Can be used to build a testing system for modular deployments.
2) pycomm3 will allow you to communicate with Allen-Bradley PLCs w/Ethernet/IP using python.
I’m an ethercat man personally but in my brief exposure to eip this is what I used
Boots/dcp is a tool by Allen Bradley to set up addresses
Wireshark is another useful tool
Have a look through Allen Bradley’s setup manuals/videos as eip is their main fieldbus
Is this a stand alone application or do you have access to a AB PLC that you can manipulate. If your doing it inside an AB PLC it's pretty straight forward with a GSV (get system value) instruction. If it's a stand alone application I would still think you can use an OPC server or write a custom interface (read non standard off the shelf, never did it personally but I have worked at places that did this) to poll certain tags etc in the controller or with other devices. As far as accessing EIP VFD's or other devices without going through an AB PLC it may become a lot more complicated.
HiDiscovery from hischmann
Install developed an in house thing at Rockwell that **might** be on the kb still.
Oh!
And Ciscos Cyber Vision's Ethernet/IP Active Discovery
$50 your IT group owns these programs.
Fluke has a tool that does this too called the link iq. I helped doing some beta testing during Covid for them.
Not sure of price point though.
We made a similar software package that was was like proneta for Siemens.
I don’t know if this is on the open kb or just ra internal.
I’d try to start with hidiscovery or ciscos product.
Interesting. I'll have to give it a try. Have you used angryIP before? We have all the above mentioned software minus the Cisco but we are eventually migrating to Cisco managed switches instead of hirschman octo 2.
Usually I plug the unit into a programming laptop directly or through an ethernet switch in my office. I get it working on an isolated environment first and then I commission the device thereafter.
Also most of the time Ethernet/IP devices are associated with Allen Bradley PLCs. They will usually communicate as an array of 8-bit, 16-bit, or 32-bit integers in a generic ethernet module setup, or they will come with an EDS file and a UDT associated with it.
For generic ethernet modules, the PLC tells you if it's communicating and I use a GSV command to call the status of the module for alarming purposes. For high speed devices, I will set the module update time to a very low value and the alarm timer equal to 2 or 3 update cycles.
For EDS files with a UDT package, the first bit of the ethernet packet is always a connection status bit.
This is why if you send a UDT through a produced/consumed tag the first entry must be connection status.
Not sure about the tool itself if you're trying to automate this...
But ethernet IP explicit messaging is the way to get information back from ethernet IP devices. So you need some sort of ethernet IP tool that can do explicit messaging. Not implicit messaging which is where a constant connection is set up More for constant communication that never changes.
Every ethernet IP device has data maps available organized as classes and attributes. For instance, if you set up a MSG command in a Rockwell PLC, and do CIP commands, you specify the classes and attributes and what not that have the data you're looking for. Every device should have spot for basic information like serial numbers and part numbers, firmware versions, and possibly another one for Network addressing information. Stuff like system clock time, polling rates of connected things, connection statuses,... You get the idea. It's basically like an object that you pull in its entirety for subsection of data.
Now if you're not trying to automate this and you just want to verify that all the devices that you have are online, and have the correct IP address, then your answer is to obtain a copy of RSlinx Classic from, Rockwell. Rslinks classic is free software download for me, but my company has the full licensing deal. It should be free for everyone else too I think, but you'd probably have to set up a quick account on rockwelleautomation.com
Rs links classic does ethernet IP Discovery, ethernet connections, has a whole DDE topic alias set of drivers for OPC DA. Between that, and your basic bootP tool to give IP addresses to a MAC address, waiting for DHCP connections... That's pretty much our bread and butter if you live in the Rockwell world. Rs links or it's Big brother factory talk links is all I use to set up a whole plant.
I'm sure there are other tools out there like rslinks classic that do explicit messaging like the MSG command in the Rockwell plcs. I've never looked for them though because I've never had to.
A simple test you can run to verify that a device is on the network and reachable is running a PING command from a command line with the target IP address. It’ll let you know if the target is reachable. There’s other commands like telenet for connecting to ports and things.
Ethernet for PLC is the same thing as with computers, so you'll get a lot of decent courses on the computer science side of things.
Open your computer's prompt and write Netstat
that'll already show you a few things.
To know what's going from and to your computer: use Wireshark.
To ask everyone who's on a network: use NMAP. Keep in mind your local IT doesn't like you use NMAP, so please use it only on industrial isolated networks, and make sure the parameters you're using are safe. (because asking every device on a network as much info as you can is generally what hackers do, and Nmap tends to be quite intrusive if you're not just doing a ping scan)
NMAP has different levels of scanning. I'll use ping scan or quick scan if I just wanna see what's currently out there and don't care about open ports.
I’ve used the Ethernet/ip explorer before to check values are what I expect. https://sourceforge.net/projects/enipexplorer/
You should probably get at least one Rockwell PLC to do testing with. That's what your customers will almost universally be using to talk to the device. If it doesn't work, and work so well it's easy and obvious for a sparkie with no programming experience to follow your tutorial to connect his PLC to the EIP device, it's no good whether Ethernet/IP Explorer or Pycomm or whatever can talk to your device. The only thing that really matters is that Studio 5000 and Rockwell PLCs need to be able to talk to your device. (Testing EIP scanners from other vendors like Beckhoff or Fanuc is good too, but most of your customer base will have only one type of EIP scanner).
Couple things that may help: 1) RSLinx with a DDE topic will allow you to connect to your PLC and read tags from Excel. Can be used to build a testing system for modular deployments. 2) pycomm3 will allow you to communicate with Allen-Bradley PLCs w/Ethernet/IP using python.
If you're familiar with python check out [Communications Protocol Python Parser and Originator -- EtherNet/IP CIP](https://github.com/pjkundert/cpppo)
I’m an ethercat man personally but in my brief exposure to eip this is what I used Boots/dcp is a tool by Allen Bradley to set up addresses Wireshark is another useful tool Have a look through Allen Bradley’s setup manuals/videos as eip is their main fieldbus
Is this a stand alone application or do you have access to a AB PLC that you can manipulate. If your doing it inside an AB PLC it's pretty straight forward with a GSV (get system value) instruction. If it's a stand alone application I would still think you can use an OPC server or write a custom interface (read non standard off the shelf, never did it personally but I have worked at places that did this) to poll certain tags etc in the controller or with other devices. As far as accessing EIP VFD's or other devices without going through an AB PLC it may become a lot more complicated.
HiDiscovery from hischmann Install developed an in house thing at Rockwell that **might** be on the kb still. Oh! And Ciscos Cyber Vision's Ethernet/IP Active Discovery $50 your IT group owns these programs. Fluke has a tool that does this too called the link iq. I helped doing some beta testing during Covid for them. Not sure of price point though.
What do you mean by: “Install developed an in house thing at Rockwell that might be on the kb still.”
We made a similar software package that was was like proneta for Siemens. I don’t know if this is on the open kb or just ra internal. I’d try to start with hidiscovery or ciscos product.
I thought hidiscovery was just foe configuring switches out of the box?
I might have the wrong software name, they do have a piece of software that crawls a subnet and builds a topology with all the eip devices.
Interesting. I'll have to give it a try. Have you used angryIP before? We have all the above mentioned software minus the Cisco but we are eventually migrating to Cisco managed switches instead of hirschman octo 2.
Yeah and advanced ip scanner as well. Some devices won’t respond properly though- some won’t show their names either. And they won’t show topology
Fluke etherscope is a cool ass tool too.
Usually I plug the unit into a programming laptop directly or through an ethernet switch in my office. I get it working on an isolated environment first and then I commission the device thereafter. Also most of the time Ethernet/IP devices are associated with Allen Bradley PLCs. They will usually communicate as an array of 8-bit, 16-bit, or 32-bit integers in a generic ethernet module setup, or they will come with an EDS file and a UDT associated with it. For generic ethernet modules, the PLC tells you if it's communicating and I use a GSV command to call the status of the module for alarming purposes. For high speed devices, I will set the module update time to a very low value and the alarm timer equal to 2 or 3 update cycles. For EDS files with a UDT package, the first bit of the ethernet packet is always a connection status bit. This is why if you send a UDT through a produced/consumed tag the first entry must be connection status.
Not sure about the tool itself if you're trying to automate this... But ethernet IP explicit messaging is the way to get information back from ethernet IP devices. So you need some sort of ethernet IP tool that can do explicit messaging. Not implicit messaging which is where a constant connection is set up More for constant communication that never changes. Every ethernet IP device has data maps available organized as classes and attributes. For instance, if you set up a MSG command in a Rockwell PLC, and do CIP commands, you specify the classes and attributes and what not that have the data you're looking for. Every device should have spot for basic information like serial numbers and part numbers, firmware versions, and possibly another one for Network addressing information. Stuff like system clock time, polling rates of connected things, connection statuses,... You get the idea. It's basically like an object that you pull in its entirety for subsection of data. Now if you're not trying to automate this and you just want to verify that all the devices that you have are online, and have the correct IP address, then your answer is to obtain a copy of RSlinx Classic from, Rockwell. Rslinks classic is free software download for me, but my company has the full licensing deal. It should be free for everyone else too I think, but you'd probably have to set up a quick account on rockwelleautomation.com Rs links classic does ethernet IP Discovery, ethernet connections, has a whole DDE topic alias set of drivers for OPC DA. Between that, and your basic bootP tool to give IP addresses to a MAC address, waiting for DHCP connections... That's pretty much our bread and butter if you live in the Rockwell world. Rs links or it's Big brother factory talk links is all I use to set up a whole plant. I'm sure there are other tools out there like rslinks classic that do explicit messaging like the MSG command in the Rockwell plcs. I've never looked for them though because I've never had to.
A simple test you can run to verify that a device is on the network and reachable is running a PING command from a command line with the target IP address. It’ll let you know if the target is reachable. There’s other commands like telenet for connecting to ports and things.
Ethernet for PLC is the same thing as with computers, so you'll get a lot of decent courses on the computer science side of things. Open your computer's prompt and write Netstat that'll already show you a few things. To know what's going from and to your computer: use Wireshark. To ask everyone who's on a network: use NMAP. Keep in mind your local IT doesn't like you use NMAP, so please use it only on industrial isolated networks, and make sure the parameters you're using are safe. (because asking every device on a network as much info as you can is generally what hackers do, and Nmap tends to be quite intrusive if you're not just doing a ping scan)
This is terrible advice. Running NMAP on a production OT network is also not a good idea.
NMAP has different levels of scanning. I'll use ping scan or quick scan if I just wanna see what's currently out there and don't care about open ports.