[?]: PC Software CPU 1505s/1507s

[Longhunter]

I have a CPU 1507s running in a IPC227E.Would be useful to you?

Hi Bitolo, if you have the HDD image it will be very helpful, but if you haven't the disk then with the VMWare Converter, as Dr. Acrobat said, you can get the VMX file and I can see if there is something missing or different inside, at least if the converter keeps the main parts of the original hardware configuration.

Let me upload the converter in Mega.

Update1:

Here you have:
https://mega.nz/file/Ff5R1ACR#o9ngCapiV ... hTcHPCYxcw

After download please check the file hash. Sometimes I can't load correctly the files... third world connection issues... e_eU
MD5SUM: 04e1d49d80a75e42c1b1b327d9b5cda9
https://my.vmware.com/web/vmware/downlo ... rPId=20180, click in "Read more"

[Longhunter]

Well, the plan "B" would be getting a hardware report from the IPC with the AIDA64

http://uploaded.net/file/boanvrfy <= AIDA64 Extreme Portable

With the programa open, you'll need to generate the file in "Report -> Report Wizard -> Custom Selection -> deselect Benchmark -> HTML -> Finish"
Avoid the "All pages" or "Benchmark pages" options because it will have a heavy impact on Windows performance that would be troublesome if the IPC is in production.

Save the file (is around 1 MB) and upload it, please. Choose the best method that suits your situation.

[den1049]

Maybe the problem is that 150xS requires a specific network card that the hypervisor can capture and use in the CPU configuration.
By analogy with RTX, it could only capture an E1000E network card when used with VMWare.
Accordingly, when loading any configuration into the CPU, it cannot start with the error "does not match hardware".

I tried different settings of the vmx file. I tried different BIOS files. In the best case, the processor was in the STOP state and was waiting for the configuration. After loading any configuration, it cannot start with the error "does not match hardware".

P.S. Sorry for my english.

[Longhunter]

I think the software looks for its hardware in a specific slots. While I was trying a way to start the kernel, the fact it asked me the SATA device has the pciSlotNumber "17" gave a hint why sometimes fresh Windows installations in a Siemens IPC doesn't work, as I have seen in other forums, and the only way they recover the PLC is with a HDD image. The PCI data changed, so the kernel doesn't know where to look.

In my research I found you can reencode the Bus:Dev.Func: you would encounter in Windows' Device Manager in a value you can use in the VMX file. I don't know the limit of this, so I hope someone else can give a better idea. We could reconstruct the Ethernet port with the VMWare E1000E device and at least get, if not the RT protocol, basic S7 comm without patching the kernel. I checked some IPCs with 1507S support have the 82574L ethernet chipset. Good enough for a minimal chance to get it working.

[amarillo]

Here is what I got so far:
- Screen shot from a running VM with CPU1507s in STOP mode:
https://mega.nz/file/GpZ11QqI#OCZ5nUBEw ... d3VAAE7h3s
How I got here:
- Modified vmware config file *.vmx so sata0.pciSlotNumber = "17" etc see the vmx file below:
https://mega.nz/file/HoQlGSrK#Tk2MLm_p5 ... FOWlhvARFg
- Install Windows and CPU1507s.
- Modify VMM_1ST_STAGE.ELF and VMM_2ND_STAGE.ELF otherwise only a select list of PCs are allowed to run:
https://mega.nz/file/r8IHRSIL#eBur6YTJc ... XPOpI1MLFI

Items to figure out:
- Why SIMATIC RT-VMM Network Adapter driver fails to start
- Make a GUI program and use the existing API (VMM_BinConfigFileApi.dll) to generate cfg file for each VM guest that SIMATIC Hypervisor RT-VMM will start.
- Create a TIA HW catalog package installer with VMware VM as a PC Station like but capable to add CPU1507s.

[Longhunter]

In my case the SIMATIC RT-VMM Network Adapter works, but I can't see any ethernet module available in the "Devices" section to do an upload from TIA Portal and sometimes I couldn't power on the PLC.

I think that's happening because I'm using the PLC 1508S v20.8 when the VM BIOS tell the PLC that is a IPC227E and Siemens document says that hardware isn't supported. ^-^u Instead I'll try the 1507S and check your solution.

Example pic:
https://mega.nz/file/UWZAzAiB#aXRmLRdxZ ... 7KxJFLfCwM

[Demen]

I have the same result with 1507s. No ethernet device in cpu.

I read manual. Real ethernet adapter connected to CPU ethernet throw simens hypervisor.
Need to undestand why simens hypervisor don't see Ethernet card. see page 73.

Link to cloud with manual and 1507s virtual machine
https://cloud.mail.ru/public/41FS/4omCCetzi

[amarillo]

Longhunter,
Can you please look under resources what RAM, I/O and IRQ is SIMATIC RT-VMM Network Adapter using?

[Ilya]

I have the same result with 1507s. No ethernet device in cpu.
...
https://cloud.mail.ru/public/41FS/4omCCetzi

Works but no license.
notebook HP.

desktop computer - asus

p.s.Where to find ?

[Demen]

And next.

Use TIA 16 to make a PC station file and try to import in 1507s.

Result. CPU in Error. See screenshots
Screenshots and "PC system configuration.psc" i upload to cloud.

I install a new Embedded machine and now i can see from TIA portal. BUT can't download. f...
https://cloud.mail.ru/public/R4s6/2VxFZW1m4

If some one need new 1507s machine. I can upload it.

And i don't know where to get a license for software cpu 1500 v2.0

[Demen]

I think problem with Ethernet adapter X2.
See:
CPU_X2_error2.JPG
CPU_X2_error.JPG
in cloud

[Ramomkosta]

I have a old Image GHO of IPC277D OS = WinPE 7 x86 V 6.1.7601 . After change to VHD image, can i see de .Reg file.

This is the link below, I hope it helps...

https://ulozto.net/tamhle/kaowCLyiOdEq# ... SJpwp5At==

[racer77rus]

I think the problem is that TIA portal doesn't recognize the VM Network adapter as "Siemens Network adapter". that's why TIA portal show a message that incompatible device was found during downloading to device attempt.

[CoMod]

about PC Software CPU 1505s/1507s from Russian Support
видео от российской техподдержки
"Программные контроллеры Simatic (softlogic). Вводная часть"
https://youtu.be/0LZAAMPlyrA?t=975


about keys

[hanjinxing]

Expect 1507 or 1508 to run on the VM

[flyingengine]

Does anyone know how to fix it? I can't use the working VMs from here as I have there no option to create a shared drive (to import data from my host PC). I tried to fix it by adapting the vmx based on the vmx from the posted VMs here but no lock so far:

[Demen]

Ему скорее всего нужен правильный БИОС.
He most likely needs the correct BIOS.

[erre]

Anyone got it running as it should in a virtual machine or on real hw PC (not siemens IPC)?

I tried i vmware workstation 15.5, but I didn't get passed BSOD or even to open vmx-file after adding all suggested lines to vmx. And rom-file.
I tried HW compability 11.x and 15.x.
UEFI and BIOS.

[antibalda]

Hello all,
Is possible install software controller on non-IPC computer with Windows 10 and "normal" (no CP1616 or other) ethernet card ?
I read only install on WM - why install to the virtual machine ?

Thank you.

[Wang]

Is it possible install 1507s in IPC127E? From official manual i saw it support IPC 227E, 127E doesn't include.

[Wang]

I bought A secondhand IPC127E，tried whole weekend，here is the result，since UEFI only，1507 can be only tested with latest version，failed with IPC type unknown，with type ID 0x0d01，is anyone have a Bios editor.so that I can let it pretends as like IPC227E.thanks

[Nael]

A few notes for the UEFI version (not working yet, but making progress):

* Requires a modification to the UEFI bios (either via a UEFI shell app or a custom firmware image) that changes the SMBIOS machine model and adds an entry with type "129" and contents

Code: Select all

unsigned char Data[] = {
  0xff,
  9,
  5, 2, 2,
  LOBYTE(type), HIBYTE(type), 0, 0
};

where type can be extracted from VMM_2nd_stage.elf. An example would be model="SIMATIC IPC847E" and type=0x0C04. You can find the data around 0x2003A7A60 in 21.9 Upd4.

I have a tool for doing this on any platform, but I'm not ready to release it yet.

* AMD does not work. It requires Intel VT-d specifically. Otherwise it just silently resets. I also encountered an error during timer init in 21.9 Upd4 but I'm not sure if it's due to Intel or AMD -- I just bypassed that reset.
* Some startup debug output can be enabled by NOP-ing the LEA instruction in 0x200008D5F0
* The checksum for the .cfg files is weird. It's calculated over the file except for the last 24 bytes and is stored in bytes 12-16. The code for calculating it is (Python):

Code: Select all

def mkcrc(a):
    crc = 0xffffffff
    for x in a:
        v7 = 0
        for j in range(8):
            if (x & 1) != 0:
                v7 |= 1 << (7-j)
            x >>= 1
        crc ^= v7 << 24
        for k in range(8):
            crc = (crc << 1) ^ 0x04c11db7 if crc & 0x80000000 else crc << 1
    out = 0
    for k in range(0x20):
        if (crc & 1) != 0:
            out |= 1 << (31-k)
        crc >>= 1
    return 0xffffffff & ~out

* I haven't been able to get it to run on QEMU yet (VMware refuses to keep the SATA controller on a PCI address of my choice, and I haven't figured out how to edit the AHCI controller location in the .cfg yet), but I've gotten further than on VMware.

E: The controller itself runs on a MIPS emulated CPU apparently. I found a MIPS ELF binary in the memory dump that seems to be the controller OS.

[Nael]

Debug output can be enabled with trace_loader=COM?, trace=COM? (eg COM1) and will be written to serial out.

A full list of whitelisted model names and types. The way it seems to check is: check type. If type (!= 0) is found, use that. Otherwise check name. If you have an IPC127E, you should be able to either modify the ELF or the SMBIOS entry via a UEFI program to show an IPC227E type.

Code: Select all

name, type
SIMATIC IPC427C, 0x0
SIMATIC IPC627C, 0x401
SIMATIC IPC647C, 0x402
PSEUDO IPC677C, 0x405
SIMATIC IPC827C, 0x403
PSEUDO IPC847C, 0x404
SIMATIC IPC227D, 0x501
PSEUDO IPC277D, 0x502
SIMATIC IPC427D, 0x701
SIMATIC IPC477D, 0x702
SIMATIC IPC627D, 0x801
PSEUDO IPC647D, 0x802
SIMATIC IPC677D, 0x805
SIMATIC IPC827D, 0x803
SIMATIC IPC847D, 0x804
SIMATIC IPC227E, 0x901
SIMATIC IPC277E, 0x902
SIMATIC IPC547E, 0x203
SIMATIC IPC427E, 0xa01
SIMATIC IPC477E, 0xa02
SIMATIC IPC627E, 0xc01
SIMATIC IPC647E, 0xc02
SIMATIC IPC827E, 0xc03
SIMATIC IPC847E, 0xc04
SIMATIC IPC677E, 0xc05
SIMOTION P350-5, 0x0
NCU730.3B, 0x0
SINUMERIK NCU17X0, 0x0
MC APL1, 0x0
MCU1720, 0x0
SIMATIC 150XD, 0x0
SIMATIC EC457A, 0x0
CPU1517_EC457A_PT1, 0x0
S7+CPU1518, 0x0
CPU15xx, 0x0
CPU 1515SP PC2, 0x602
CELSIUS M470, 0x0
CELSIUS M730power, 0x0
CELSIUS M730 Power, 0x0
CELSIUS M730, 0x0
CELSIUS M740, 0x0
To Be Filled By O.E.M., 0x0
Stargo, 0x0
SandyBridge Platform, 0x0
Shark Bay Client platform, 0x0
To be filled by O.E.M., 0x0
Inagua, 0x0
Persimmon, 0x0
D3313-S5, 0x0
Broxton P, 0x0
JuniperHill, 0x0
Leafhill, 0x0
Grangeville, 0x0
oc_II, 0x602

A few of these (CPU15xx, etc) require an additional parameter to work.

Notably, it's whitelisted on regular desktop PCs and a few FUJITSU CELSIUS models.

[spacedev]

How activate license for software conroler CPU1507s V21.9 ?

[Longhunter]

I have a old Image GHO of IPC277D OS = WinPE 7 x86 V 6.1.7601 . After change to VHD image, can i see de .Reg file.

This is the link below, I hope it helps...

https://ulozto.net/tamhle/kaowCLyiOdEq# ... SJpwp5At==

This is nice, I'll check it later. Maybe I can see something related to the IPC's network adapters. Thank you so much.
Do you have a 15XXs PLC installed in this IPC?

Debug output can be enabled with trace_loader=COM?, trace=COM? (eg COM1) and will be written to serial out.

A full list of whitelisted model names and types. The way it seems to check is: check type. If type (!= 0) is found, use that. Otherwise check name. If you have an IPC127E, you should be able to either modify the ELF or the SMBIOS entry via a UEFI program to show an IPC227E type.

Code: Select all

name, type
SIMATIC IPC427C, 0x0
SIMATIC IPC627C, 0x401
SIMATIC IPC647C, 0x402
PSEUDO IPC677C, 0x405
SIMATIC IPC827C, 0x403
PSEUDO IPC847C, 0x404
SIMATIC IPC227D, 0x501
PSEUDO IPC277D, 0x502
SIMATIC IPC427D, 0x701
SIMATIC IPC477D, 0x702
SIMATIC IPC627D, 0x801
PSEUDO IPC647D, 0x802
SIMATIC IPC677D, 0x805
SIMATIC IPC827D, 0x803
SIMATIC IPC847D, 0x804
SIMATIC IPC227E, 0x901
SIMATIC IPC277E, 0x902
SIMATIC IPC547E, 0x203
SIMATIC IPC427E, 0xa01
SIMATIC IPC477E, 0xa02
SIMATIC IPC627E, 0xc01
SIMATIC IPC647E, 0xc02
SIMATIC IPC827E, 0xc03
SIMATIC IPC847E, 0xc04
SIMATIC IPC677E, 0xc05
SIMOTION P350-5, 0x0
NCU730.3B, 0x0
SINUMERIK NCU17X0, 0x0
MC APL1, 0x0
MCU1720, 0x0
SIMATIC 150XD, 0x0
SIMATIC EC457A, 0x0
CPU1517_EC457A_PT1, 0x0
S7+CPU1518, 0x0
CPU15xx, 0x0
CPU 1515SP PC2, 0x602
CELSIUS M470, 0x0
CELSIUS M730power, 0x0
CELSIUS M730 Power, 0x0
CELSIUS M730, 0x0
CELSIUS M740, 0x0
To Be Filled By O.E.M., 0x0
Stargo, 0x0
SandyBridge Platform, 0x0
Shark Bay Client platform, 0x0
To be filled by O.E.M., 0x0
Inagua, 0x0
Persimmon, 0x0
D3313-S5, 0x0
Broxton P, 0x0
JuniperHill, 0x0
Leafhill, 0x0
Grangeville, 0x0
oc_II, 0x602

A few of these (CPU15xx, etc) require an additional parameter to work.

Notably, it's whitelisted on regular desktop PCs and a few FUJITSU CELSIUS models.

Oh, this is very nteresting... I'll give it a try.