Beckhoff ADS

Connect Beckhoff TwinCAT PLCs over ADS/AMS - the AMS route, runtime port, symbol paths and read lengths.

The Beckhoff ADS driver talks to Beckhoff TwinCAT PLCs over ADS, the TwinCAT automation protocol carried on AMS routes. You address values by their symbol path in the PLC program, so what you type is what the TwinCAT project declares. Add a device under the Beckhoff ADS driver in the Connector; the panel shows only the fields this protocol uses.

Connection

The device header shows the assembled endpoint, for example ads://192.168.0.1:192.168.0.50:851 (local IP, PLC IP, AMS port). Each tag may set its own Poll interval (ms); a tag value of 0 falls back to the device interval.

ADS only answers stations the PLC holds an AMS route for: Prepare the PLC says which route to add and where.

Prepare the PLC

A TwinCAT PLC answers ADS only to a station its AMS router holds a route for. Without the route, the router takes the connection on TCP port 48898 and then closes it or never answers, so the connection fails even though the network path is fine. Add a static route for this station on the PLC, once:

In TwinCAT XAE, choose the PLC as target system and open SYSTEM > Routes, tab Static Routes, then Add. On the PLC's own desktop, the TwinCAT icon in the notification area opens the same list through Router > Edit Routes.

The address is this station's on the network that reaches the PLC. A computer with several network cards has an address on each, and the route holds only for the one it names. While Local IP (AMS) is empty, the driver uses the address of the card Windows reaches the PLC through, which the box shows in grey, so that is the address the route names. A value typed in the box is used instead, and the route has to name that one.

When the PLC's router turns the station away for want of the route, the device's page says so in a notice that stands in place of the driver's error: the route ready to add (its name, this station's AMS Net Id, its address and the transport, each with a copy button) and where TwinCAT adds it. The notice goes away by itself once the PLC answers, and the journal and the agent read the same route. A port that refuses the connection or stays silent is said as what it is, not as a missing route.

The station addresses the PLC by its AMS Net Id, and the PLC's router answers only for its own: a PLC whose AMS Net Id is not the one the station uses never answers either, which looks exactly like a missing route. When the PLC already holds the route and still does not answer, check its AMS Net Id in TwinCAT XAE under SYSTEM > Routes, tab NetId Management, Target NetId, and enter it in PLC AMS Net Id; the notice names the one the station uses.

Addressing

A Beckhoff tag is addressed by two fields in the tag's Source card:

The symbol path is exactly what TwinCAT shows: program variables as MAIN.fValue, global variable lists as GVL.MachineSpeed or GVL_Settings.rSetpoint. The driver resolves the symbol by name on the PLC and reads its raw bytes. The automatic read lengths are:

For a String longer than 16 characters, set Read length to cover the declared size (a TwinCAT STRING(80) needs 80 bytes of text). The Source card's read-only Source address (wire) line shows the assembled address as you edit.

A read the PLC refuses, such as of a symbol it does not hold or does not let be read, leaves the tag without a value, and the tag's reason names the ADS error code and what it means, for example ADS error 0x710 (no symbol by that name). The connection stays up and the other tags keep reading; the reason leaves with the next read the PLC answers.

Data types

The Data type picker offers the four types the driver marshals:

Byte order is the PLC's own little-endian and is handled automatically; there is no byte-order option. A String read decodes the returned buffer up to the first NUL terminator, so the padding behind a short string never leaks into the value. Other TwinCAT widths (INT, LREAL, WORD, …) are not offered: expose such a variable in the PLC program as one of the four types above to read it here.

Writes

Tags whose Access is Read and write or Write only can be written. A write resolves the same symbol and writes the value's bytes: 1 byte for Boolean, 4 bytes for Int32 and Float. A String write lays down the tag's whole Read length: the UTF-8 bytes of the text at the front and zeros behind them, so a shorter text written over a longer one replaces the whole value and nothing of the old one survives. A text that does not fit the declared length is refused with the length named in the journal, never cut down to size. A new tag starts as Read only.

A write the PLC refuses, such as to a symbol it does not let be written, comes back refused with the ADS error code and what it means, for example ADS error 0x704 (the symbol may not be written), and the connection stays up.

Discovery

ADS has no broadcast discovery in this driver, so the Connector shows no Discover button. Add the device and its symbols by hand.

Good to know

• The AMS route is the usual reason a first connection fails: the route's AMS Net Id on the PLC must be exactly the station IP plus .1.1, and the device's page gives the whole route to add.
• The driver asks the PLC for a handle to each symbol once per connection and gives the handles back when the connection closes. After a PLC download, a handle the PLC no longer honours is replaced at the next read, so the tag keeps reading under the new program; a symbol the download renamed or removed leaves its tag without a value, with ADS error 0x710 (no symbol by that name), until the names match again.
• An unreachable PLC costs nothing at startup: the device keeps retrying in the background and its tags read as bad quality until the connection lands.