connect to the Zenon HMI via VNC

Прочие SCADA: iFix, InTouch, Citect, ...
Melander
Posts: 10
Joined: Sat Aug 01, 2020 9:29 pm

connect to the Zenon HMI via VNC

Post by Melander »

Do you know you can connect to the Zenon HMI via VNC and thereby monitor the HMI.
If you already have the PLC connected to LAN, you can connect the HMI to the same LAN, if it's not already done.
Anyway I hope you mean the factory intranet and not internet, as it's not wise to open up machines for access from internet...

If you insist doing it by the PLC you will get only the alarm, warning and information messages... nothing about what the machine is doing, or what the operator might be doing.
If your machine has a Krones LDS (Line Diagnostis System) you could get some basic information, lige state, and program etc. but it will be a long road to combine this into a monitoring system that will be useful (in my opinion).

But lets go a bit deeper :)
From the little part of the DB you provided it looks like the DB63 is structured using an UDT
The BYTE "index" contains the alarm index (the message number I believe)
The Bit 0 "is_active" is 1 if the alarm is active
The Bit 1 "is_gone" is 1 if the alarm has been active but still not reset

Alarm number 2001.6311 I would read as area 2001 (usually also a reference in the hardware drawing) the 6311 is the message number (the number you should be able to find in the Zenon Language txt-file).
Your machine is not too old, so the structure is unfortunately not as simple as I first believed... the entire list consists of data from several DB's
To find each individual alarm/warning/message reference, you should search the Step7 program for all locations of the following blocks:
FC115, FC116, FC117, FC118 and FC119 as they generate the output to the Zenon.
Scearch for the DB63.DBX91.0 and you should be able to find where it triggers one of the above mentioned FC's and you should be able to figure out the rest :)

The mentioned FC blocks are for different level of details:
FC115 Simple message without extra information
FC116 Simple message
FC117 Message with 3 additional data
FC118 Message with extra variables
FC119 Message with 5 additional data
Note the block numbers could be different in your machine (I have only mixer and CIP that new).

As you probably know by now, this is a lot of work! so I would suggest to explore the option mentioned first, and connect to the Zenon HMI via VNC
The HMI is probably a PC with Windows7 Embedded and Zenon RT, 2 LAN connections... one could easily be used for your intranet (if it's not already connected). Using a VNC client, the HMI IP address, probably port 5900 or 5901 and the password, you should soon be able to sit in your comfortable quiet office with popcorn and a cool Coke, watching the machine filling bottles/cans in the noisy production area ;)

Good luck :)
Jerry44
Posts: 11
Joined: Thu Sep 26, 2019 3:22 am

Re: connect to the Zenon HMI via VNC

Post by Jerry44 »

Thank you Sir very much.

That is exactly what I'm doing. For this way, we need to have language file (.txt) which export from Zenon and the PLC program to mapping the alarm info and PLC address.

But unfortunately, with this way, we only have the information after the alarm occur, it's mean we have to map one by one the alarm.
We hope will the shortest solution to mapping all of the alarm already reference by PLC.

Thank you.
Melander
Posts: 10
Joined: Sat Aug 01, 2020 9:29 pm

Re: connect to the Zenon HMI via VNC

Post by Melander »

If you send me the PLC and HMI backup, I'll take a look to se if there are a easier way than waiting for every alarm :)
Jerry44
Posts: 11
Joined: Thu Sep 26, 2019 3:22 am

Re: connect to the Zenon HMI via VNC

Post by Jerry44 »

That's great to hear your news. Attached file with below link, if you have any feedback, please let me know. Thank you so much
https://drive.google.com/drive/folders/ ... sp=sharing
Melander
Posts: 10
Joined: Sat Aug 01, 2020 9:29 pm

Re: connect to the Zenon HMI via VNC

Post by Melander »

Ok... (pgood)

The mentioned approach, locating all instances of FC116, FC117, FC118 and noting the I_Number and I_Data_1 will provide the information you request, without waiting for every single alarm...
The "I_Number" is the "Msg_xxxx" number in the language file...
E.g. FC3 NW10 "Circuit breaker filling valve control 1-100"
I_Number = L#120 --> Msg_0120
I_Data_1 = L#634 --> Msg_0120_Txt_634

Language file, search Msg_120...
Msg_0120_Info|24V circuit breaker tripped:
Msg_0120_Description|An electrical device has caused a short circuit or an overload.
Msg_0120_Instruction| - Check the electrical device.\n- Check whether the circuit breaker or a cable is faulty.
Language file, search Msg_120_Txt_634...
Msg_0120_Txt_634|Filling valve controller top part group 1

Do you get it :?: then it's just to get going :wink:
But this is still a massive job, as there are 10000 possible messages :shock:

Look in the DB186 it should show you all active messages out of the 10000 possible...
Msg ARRAY[0..9999] BOOL Messages

In data view its easier to see...
DB186.DBX0.0 Msg[0] BOOL FALSE
DB186.DBX0.1 Msg[1] BOOL TRUE <-- Active message no. 0001
DB186.DBX0.2 Msg[2] BOOL FALSE
DB186.DBX0.3 Msg[3] BOOL FALSE
...
DB186.DBX958.5 Msg[7669] BOOL FALSE
DB186.DBX958.6 Msg[7670] BOOL TRUE <-- Active message no. 7670
DB186.DBX958.7 Msg[7671] BOOL FALSE
...
DB186.DBX1249.7 Msg[9999] BOOL FALSE

:haha:

Try also looking in the Krones LDS :arrow: DB181...
DB181.DBD0 Header.WS_Cur_State DINT Operating status
DB181.DBD4 Header.WS_Cur_Mode DINT Mode of operation
DB181.DBD8 Header.WS_Cur_Prog DINT Program
DB181.DBD12 Header.SystemnumberFirstFault DINT System number first malfunction
DB181.DBD16 Header.FirstFault DINT First malfunction
DB181.DBD20 Header.SystemnumberLastWarning DINT System number current message
DB181.DBD24 Header.LastWarning DINT Current message
DB181.DBD28 Header.EnergyMachineMode DINT Energy status
DB181.DBD32 Header.FirstFaultDetail DINT First malfunction details
DB181.DBD36 Header.LastWarningDetail DINT Current message details

In DINT number format you are given the information needed for a different system to find the required message to show from the language file 8)
If you "just" want to show/log the alarm number you don't need to know what triggers each alarm, you just need to know the message number, and the LDS will give you that information (pgood) and as you can see you also get information about the state, mode and pgm. probably according to The Weihenstephan Standard.

The DB181 can also give you information about energy and supply consumption etc.

Job soon done (pgood) :mrgreen:
Jerry44
Posts: 11
Joined: Thu Sep 26, 2019 3:22 am

Re: connect to the Zenon HMI via VNC

Post by Jerry44 »

Dear Sir,

Thank you for your reply. Now I believe I can mapping the Msg_Number and the Software reference. (pgood) (pgood) (pgood)
VVT77
Posts: 1
Joined: Tue Jul 17, 2012 4:52 pm

Re: connect to the Zenon HMI via VNC

Post by VVT77 »

Hello guys! Can you tell me what password Krones sets on VNC? Thanks!
pilotpent
Posts: 3
Joined: Tue Nov 20, 2012 9:46 am

Re: connect to the Zenon HMI via VNC

Post by pilotpent »

Hello guys, I'm looking for the Windows password for the Krones machines, does anyone have the administrator or the krones account password ?

Maybe it's the same for the VNC connection.

Thanks ! (pgood)
SHKODRAN
Posts: 199
Joined: Wed Dec 24, 2008 4:37 pm
Location: Europe

Re: connect to the Zenon HMI via VNC

Post by SHKODRAN »

pilotpent wrote: Tue Feb 01, 2022 4:00 pm Hello guys, I'm looking for the Windows password for the Krones machines, does anyone have the administrator or the krones account password ?

Maybe it's the same for the VNC connection.

Thanks ! (pgood)
Create hmi hdd image with ghost, upload somewhere, we can evaluate protection.