Beckhoff ADS

ADS (Automation Device Specification) is Beckhoff’s protocol for talking to the TwinCAT runtime. inSCADA supports it natively, in the client role only.

Addressing is symbolic: a variable is read by its name in the PLC program.

Two separate addressing layers

Two kinds of addressing nest inside each other in ADS, and confusing them is the commonest mistake:

Layer	What it reaches	Where it is given
TCP	The TwinCAT router	The connection’s ip / port (48898)
AMS	The runtime behind that router	Target NetId + the device’s AMS Port

An AMS NetId is not the IP with “.1.1” appended

That is the common assumption and it is wrong. Measured on the test PLC: the IP was 192.168.1.20 while the PLC runtime’s NetId was 192.168.4.1.1.1. The two have nothing to do with each other.

Worse, a wrong NetId and a missing route answer identically (0x7, “no route”). So “I forgot to add the route” and “I mistyped the NetId” cannot be told apart. Read the NetId off the TwinCAT side and copy it.

An AMS NetId is six dot-separated numbers (each 0 – 255). A mistyped one is refused at the save, not at the first poll.

Connection

Parameter	Default	Description
IP Address	—	The TwinCAT router’s address
Port	48898	The router’s TCP port
Target NetId	—	The target runtime’s AMS NetId
Source NetId	—	inSCADA’s own AMS NetId
Timeout (ms)	2000	The request timeout (100 – 60000)
Connect Timeout (ms)	3000	The connect timeout (100 – 60000)

A route is needed on the PLC side

ADS works through the router, and TwinCAT must have a route defined for inSCADA’s source NetId. Without one the connection is refused with “no route” — the same error as the wrong-NetId case above.

Device — the runtime port

Each device corresponds to one of the PLC’s runtimes.

Parameter	Default	Description
AMS Port	851	The runtime’s AMS port
Scan Time	—	The polling interval (at least 100 ms)
Scan Type	—	PERIODIC or FIXED_DELAY

In TwinCAT 3 the first PLC runtime is 851, the second 852, and so on. When one PLC holds several runtimes, define a device for each — the connection stays the same.

Frame — polled or notified

Parameter	Default	Description
Use Subscription Mode	off	Take values from the PLC’s notifications
Cycle Time (ms)	50	How often the PLC checks the value (1 – 60000)
Max Delay (ms)	0	How long notifications are gathered for (0 – 60000)

With a subscription on, the PLC checks each value every cycle time and sends it when it has changed; max delay is how long notifications are gathered into one packet. 0 means “do not gather, send at once”.

Cycle time is not the scan time

Cycle Time is the PLC’s checking rate, not inSCADA’s — it decides how quickly a change is noticed. Max Delay decides how long a noticed change is held back. For fast reaction keep the cycle time small and the max delay at 0; to cut network traffic, raise the max delay.

Variable

Parameter	Default	Description
Symbol	—	The variable’s name in the PLC program (max 255 characters)
Type	—	The data type
String Length	80	The length for STRING / WSTRING (1 – 65535)

Read by name, not by address

A variable is read through a handle, by its name — never by the address a browse once reported. The reason: a download to the PLC program can move a symbol’s address silently. Reading by name is unaffected by that shift.

Data types

BOOL	BYTE	USINT	SINT
WORD	UINT	INT	DWORD
UDINT	DINT	LWORD	ULINT
LINT	REAL	LREAL	STRING
WSTRING	TIME	LTIME	DATE
TIME_OF_DAY	DATE_AND_TIME

Browsing symbols

The PLC’s symbol list can be browsed, so variables are picked from it by name.

Related

• Connections — defining a connection
• S7 Plus — the other symbolically addressed protocol