Home

1770-6.5.16, Front Cover

1. PLC 2 30 processor personal computer al o E L_ ggi SC station connector 1770 SC aS modem 1771 KG PLC 5 250 processor 5130 RM1 modem RS 232 C link o HE 50 cable t max modem LPP a on D jo PLC 3 processor i 7 modem 7 Ss DH interface module s hi t nos 1775 KA or L _ j 0 canes AE ier Ss cat nos 1771 KE KF l kog per 1770 KF2 oA 0 lt SC SC SC SC DH link SC SC SC gt HAH d 1770 KF2 l m RS 232 C link i i li m 60 cable ft max li li 1785 KA PLC 2 family processor DH link cat no 1771 KA2 lt T60 industrial workstation running ControlView software Publication 1770 6 5 16 October 1996 Network Layers 1 5 DH Link A DH link is similar to a DH link but is optimally used for smaller networks consisting of limited nodes about 15 maximum A DH link accepts 64 devices and can transmit data at 57 6 115 2 or 230 4K bits PLC 5 250 SLC and PLC processors support 57 6 and 115 2K bits SLC 5 04 processors support 230 4K bits PLC 5 processors are expected to support 230 4K bits earl
2. Publication 1770 6 5 16 October 1996 1784 KTX card installed and running PLC 5 processor 6200 series software 7 EEE T Le DH link eM oe a 1747 AIC SLC 500 notebook compute fixed 30 0 with 1784 PCMK rts henineli SLC 5 04 controller with 1747 AIC channel Processor 1747 AlC_ _ amp xpansion chassis RS 232 RS 485 a Tay converter z i l 1747PI09 channel 0 Hags link SLC 5 01 processor in 17 slot modular system 555 P PanelView 550 n fe SLC 5 03 m operator terminal i processor pfs f o DTAM Plus 1770 KF3 operator ne interface 1747 AIC 1747 AIC to remote L 5 S remote 1 O link V O chassis To connect an SLC 5 04 to a 1747 PIC use a 9 pin male to 25 pin female adapter Software Layers Network Layers 1 7 Your DF1 links and network links DH DH and DH485 each use two layers of software to enable communication e the data link layer e the application layer This figure shows how these layers fit together computer DH DH DH485 PLC processor RS 232 interface modules application application lt gt common common application application routines routines RS 232 RS 232 link layer link
3. First Byte Second Byte 0 0 1 0 010 0 0 0 0 0 0 0 0 0 0 Low byte High byte value 20 hex value 00 hex Important 1774 PLC and PLC 2 family controllers use this same logical addressing format when they transmit command messages to another node If you want to transmit a command message to your computer from one of these PLC processors set up a buffer space in your computer to simulate PLC 2 1774 PLC memory You must then write computer application programs to accept and execute commands from these nodes and to translate the ADDR value into the corresponding address in the simulated memory PLC 2 word address 121 octal logical byte address 242 octal physical byte address 0046 hex PLC Addressing 13 3 PLC 2 Physical Addressing PLC 2 processors use physical addresses that are directly related to the logical addresses To convert a logical address to its corresponding physical address 1 Move bit 7 of the logical address to bit position 1 2 Shift bits 1 through 6 to the left one position The following figure illustrates the conversion process for logical word address 121 Remember that the logical PLC 2 address is a byte address so the physical address is also a byte address Converting a PLC 2 Logical Address to a Physical Address High byte Low byte Bit octal 17 16 15 14 13 12 11 10 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 10 1 0 0 0 1
4. CMD FNC Byte File File Ele S Ele C DST SRC OF STS TNS A2 Size No Type No No CMD EXT R SRC DST 4p STS TNS DATA STS J Field Description Byte Size The size of data to be read in bytes not including the address fields or other overhead bytes Addresses files 0 254 only For higher addresses setting this File Number byte to FF expands this field to three bytes total Use the second and third bytes for the expanded file address low address byte first Use one of the these values for this field Do not use any other values doing so may result in unpredictable results e80 83 hex reserved e84 hex status e85 hex bit e86 hex timer e87 hex counter File Type e88 hex control e89 hex integer 8A hex floating point e8B hex output logical by slot e8C hex input logical by slot e8D hex string e8E hex ASCII e8F hex BCD Element Number Addresses elements 0 254 only For higher addresses setting this byte to FF expands this field to three bytes Use the second and third bytes for the expanded element address low address byte first Sub element Number Addresses sub elements 0 254 only For higher addresses setting this byte to FF expands this field to three bytes Use the second and third bytes for the expanded sub element address low address byte first DATA eFor SLC 5 01 or 5 02 82 bytes 41 words For SLC 5 03
5. Command CMD FNC Processors Page Micro sic SLC SLC 1774 PLC 5 PLC 5 ae 500 5035 04 pic PIO PLCS PLCS s0 vME i apply port configuration OF 8F S S WA 7 4 bit write OF 02 sVe 4 7 4 OF 3A ov 4 7 5 change mode OF 30 J J 75 close file OF 82 w4 Yividv 7 5 diagnostic status 06 03 w4 S vo 4 ov 4 s v se 7 6 disable forces OF 41 S S S S SE se 7 6 disable outputs 07 00 S 7 6 download all request OF 50 S se S I download completed OF 52 S S S S S se S 7 7 download request OF 05 S 7 8 echo 06 00 w4 s vo v v 4 v ov se 7 8 enable outputs 07 01 S 7 9 enable PLC scanning 07 03 S 7 9 enter download mode 07 04 S 7 9 enter upload mode 07 06 S 7 10 exit download upload mode 07 05 S 7 10 file read OF 04 ov w4 7 10 file write OF 03 Jv s 7 11 get edit resource OF 11 S S S S f S 7 11 initialize memory OF 57 S S S S Se se 7 12 PLC 2 compatibility OF 5E S 7 12 open file OF 81 S S S S EE 04 s s 7 13 physical read oF 09 7 73 physical write OF 08 w4 7 14 protected bit write 02 S S S S w4 7 15 protected typed file read OF A7 S S w4 S 7 16 EQ Sao eee Re AAA AA a Ae DAENS EMA COA EMN GEIGA As EION ARAAUNEME N N E EN E A D This command cannot be executed by channel 0 of a PLC 5 11 5 20 5 30 5 40 5 60 or 5 80 processor The following processors can initiate these commands but cannot respond to them Processor Series Revision Processo
6. Communication Commands typed write write block Writes a block of data to the processor starting at the PLC 5 system address plus the packet offset The type of data sent with the typed write command must match the data type of the file to which it is PLC 5 being written If not the remote host returns an error reply PLC 5 VME seca CMD FNC Packet Total acke otal SLC 5 04 C DST SRC OF STS TNS 67 Offset Trans PLC 5 sys address A B L L 7 CMD EXT R SRC DST 4F STS TNS STS A Type data parameter B Data up to 240 bytes minus the number of bytes used in the PLC 5 system address and the type data parameter An EXT STS byte will replace A and B if there is an error For packet offset total transaction and size in elements low byte is first The PLC 5 system address can be a logical binary address or a logical ASCII address that contains up to 51 bytes of specification The EXT STS field may be attached to the reply packet only when there is an error unprotected bit write Sets or resets individual bits in any area of PLC data table memory 1774 PLC PLC 2 CMD Set Reset PLC 3 c DST SRC 05 STS TNS ADDR to 60 masks T on PLC 5 L 1 R SRC DST STS TNS Data max 244 bytes DATA ADDR SET RESET DATA is e Use ADDR to specify the Use SET to specify which eUse RESET to
7. The EXT STS field may be attached to the reply packet if an error occurs get edit resource Secures the edit resource sole access for the programming device Once a programming device has obtained the edit resource another node cannot write to or modify the device C DST PSN SRC PSN ss STS TNS oF LNH LNH CMD EXT HI LO DST PSN SRC PSN AF STS TNS STS The EXT STS field may be attached to the reply packet only when there is an error LNH length of the optional portion of the reply packet in bytes First four words of get edit resource The first four words are currently unused and unexamined To assure compatibility with any future use of these bytes they should be initialized to 0 DST PSN and SRC are included for reference only For this processor This access is cleared by SLC 500 SLC 5 01 SLC 5 02 any node sending a return edit resource the programming device or via a timed mechanism SLC 5 03 SLC 5 04 internal to the processor sending a return edit resource Publication 1770 6 5 16 October 1996 7 12 Communication Commands e MicroLogix 1000 PLC 5 PLC 5 250 receive only SLC 500 SLC 5 03 SLC 5 04 Publication 1770 6 5 16 October 1996 initialize memory Resets the processor s memory to the default directory the directory the processor is shipped with Using this com
8. 3 timeouts this message Receive message 3 timeouts this poll Yes y No Message OK Duplicate message y No Send message to application layer Y Send DLE ACK Y Send DLE ACK y Tell application layer of failure y Add node to inactive list Publication 1770 6 5 16 October 1996 Using Half duplex Protocols to Send and Receive Messages 3 7 Message Characteristics Ideally the data link layer protocol is not concerned with the content or form of the messages it is transferring However half duplex protocol places the following restrictions on the messages that are submitted to it for transfer e Minimum size of link layer data is 6 bytes e Maximum size of link layer data depends on the application layer command e Some protocol implementations require that the first byte of a message match the node address thus receivers ignore messages that do not contain the correct address This filtering can optionally be performed by the message sink e As part of the duplicate message detection algorithm the receiver checks the source SRC command CMD and transaction TNS fields of each message There must be a difference in at least one of these bytes between a message and the previous message Otherwise the message is classified as a retransmis
9. DLE SOH STN DLE STX xxxx DLE ETX BCC CRC _ lt full timeout not full 5 sometime later I_ DLE SOH STN DLE STX xxxx DLE ETX BCC CRC gt lt not full XXXX lt DLE ACK lt OK Using Half duplex Protocols to Send and Receive Messages Message Sink Full Case 2 3 17 In this transfer the slave s message source and message sink share the same memory pool as with the 1771 KG The message sink is full because there are too many messages in the message source To clear the message sink the master must first receive messages from the slave s message source Otherwise the slave s sink will remain full Source Source Sink Master Link Slave Sink XXXX gt _____ DLE SOH STN DLE STX xxxx DLE ETX BCC CRC gt lt full timeout not full DLE ENQ STN BCC gt lt full lt _________ DLE STX xxxx DLE ETX BCC CRC lt XXXX F DLE ACK gt DLE SOH STN DLE STX xxxx DLE ETX BCC CRC lt not full lt OK tas DLE ACK sometime later DLE ENQ STN BCC gt lt not full lt _______ DLE STX xxxx DLE ETX BCC no messages to send Publication 1770 6 5 16 October 1996 Chapter A Using Full duplex Protocol to Send and Receive Messages In full duplex protocol devices share the same data circuits and both d
10. 343 A oo onm oO Contents Program ID Processor ID Pointer to start program Pointer to end of available memory Size of I O Processor error code Error word address low byte Error word address high byte Processor mode Pointer to END statement low byte Pointer to END statement high byte Pointer to end of used memory low byte Pointer to end of used memory high byte Publication 1770 6 5 16 October 1996 Diagnostic Status Information 10 13 1775 KA S5 and SR5 Status Bytes Bytes Bits Contents Description 1 0 1 Operating status of 0 Program mode PLC 3 processor 1 Test mode 2 Run mode Not used 0 Normal 1 Major processor fault 4 0 Normal 1 Shutdown request 5 0 Normal 1 Shutdown in effect 7 Not used 2 0 3 Type of node interface 6 1775 KA Data Highway port 1775 S5 or 1775 SR5 and processor 7 1775 KA RS 232 C port A 12 1775 S5 SR5 new revisions only 3 all Current context stored in bits 4 to 7 all Thumbwheel number 5 6 all Mode control word The logical address of the mode control word is E0 0 0 8 7 8 all Starting byte address of diagnostic There is a separate block of diagnostic timers and counters counters and timers for the DH port and the RS 232 port The address given here is for the port that received the diagnostic status command 9 0 4 Series and revision number of 0 Revision A the module
11. 1x27 128 1x26 64 1x2 32 1x24 0 1x23 8 1x22 4 1x2 2 1x20 1 1 14 14 Oo 1 4 4 41 23940 Bit 7 6 5 4 3 2 1 0 Binary Coded Decimal PLC data is often represented in binary coded decimal BCD form In this system each group of four bits in a PLC word represents one decimal number between 0 and 9 In this way each 16 bit word can represent a BCD value between 0 and 9 999 Many PLCs use only a three digit BCD 12 bits The upper digit 3 bits is used for information such as timer or counter status BCD Representation of Decimal 239 0x23 0 0x22 0 2 1x21 2 19 0x 29 0 0x23 0 0x22 0 3 1x22 10 1x20 4 1x23 8 0x22 0 0x20 ole 1x20 1 0 1 0 0 0 141 1 141 07 OF 1 23940 first digit second digit third digit Publication 1770 6 5 16 October 1996 11 4 Data Encoding Hexadecimal The hexadecimal hex numbering system is the most compact way to represent binary data and allows for the easiest conversion to and from binary Hex uses 16 digits numbers 0 to 9 and letters A to F Letters A to F are equivalent to the decimal numbers 10 to 15 respectively Each group of four data bits represents one hex digit between 0 and F Thus each 16 bit data word can have a hex value between 0 and FFFF Each digit of a hex number has a
12. This does not present a problem at PLC nodes on the link because PLC processors store and retrieve their data in this same order of low byte first Depending on the type of computer however you may have to do some extra computer application programming to maintain the proper byte and word order in PLC data stored in the computer Three factors that can influence the ability of your computer to handle PLC data are the size of words in your computer s memory the left to right or right to left ordering of bits within a word in your computer s memory whether the computer considers the low order byte of a word to have an even or an odd address If your computer uses something other than 2 byte 16 bit words design your application programs to make the proper conversions from PLC word addresses to computer word addresses When stored in a computer each PLC word should start on an even byte boundary The following figures show 16 bit words in PLC and computer memory In all cases the address of a word is the address of the even byte assuming that each word is properly aligned on an even boundary Data Encoding 11 7 A 16 Bit Word in PLC Memory Bit 17 16 15 14 13 12 11 10 7 6 5 4 3 2 1 Octal Odd high byte Even low byte Value A576 hex A 16 Bit Computer Word with Left to Right Byte and Bit Order This figure shows a 16 bit computer word with righ
13. Write the directory length to the directory using file write CMD OFH CMD AFH For more on file write see page 7 11 Write the program directory to program file 0 using logical write CMD OFH FNC AAH For more on logical write see page 7 18 Write all other processor files using logical write CMD FNC For more on logical write see page 7 18 Close program file 0 using close file CMD OFH FNC 82H For more on close file see page 7 5 Publication 1770 6 5 16 October 1996 12 12 Uploading and Downloading with A B Processors Publication 1770 6 5 16 October 1996 Procedure 2 SLC 5 03 and SLC 5 04 Processors 1 10 11 12 Make sure the mode selector switch is in the REM remote position Determine the current mode of the processor using diagnostic status CMD 06H FNC 03H For more on diagnostic status see page 7 6 Place the processor in the program mode using change mode CMD OFH FNC 80H For more on change mode see page 7 5 Disable forces if present using disable forces CMD OFH FNC 41H For more on disable forces see page 7 6 Request the download and initialize memory using A execute command list CMD OFH FNC 88H B logical write CMD OFH FNC AAH For more on logical write see page 7 18 C download CMD OFH FNC 50H Secure sole access to commands using get edit resource CMD OFH FNC 11H For more on get edit resource see page 7 11
14. Type Extender FE Extended Interface Type 2C Not used 00 ol A N Series Revision 0 release1 1 release 2 etc 0 series A 1 series B etc 6 16 all Bulletin Number Name in ASCII 1770 KF3 17 24 all Product Specific Information 00 Bytes Bits 0 2 1771 KA2 KA KC KD KE KF KG KGM 1770 KF2 Status Bytes Contents Operating status of PLC processor Description For the 1770 KF2 this byte is always 0 For other modules 0 Program load mode 1 Test mode 2 Run mode 3 not used 4 Remote Program load 5 Remote test 0 normal communication 1 No communication with PLC processor 0 Normal 1 Download or upload mode 0 Normal 1 Format error in communication zone of PLC program always zero Type of interface module and processor 0 1771 KC KD module 1 1771 KA2 or 1771 KA module 2 1771 KA4 module 3 1771 KE KF or 1770 KF2 module 4 1771 KG module 5 1771 KGM module 0 PLC processor 1 PLC 2 processor 2 PLC 2 20 LP1 Processor 3 Mini PLC 2 processor 5 PLC 2 20 LP2 processor 6 PLC 2 02 2 15 2 16 or 2 17 processor 7 PLC 2 30 processor F computer all Octal address of the start of the PLC program For the 1770 KF2 these bytes are always 0 The ladder logic starts at the end of the data table To find the physical end
15. 11 Times the receiver sent an ACK without first being able to allocate a receive buffer This results in a memory overflow error when the next message is received 12 Frames rejected because of a bad CRC This error is very common on a noisy DH link 13 Times a message was received that contained more than 250 bytes 14 Times a message was received when there was no buffer space allocated for it usually follows a memory full error 15 Duplicate frames received A duplicate frame is sent by a transmitter when it fails to receive an ACK If the reason it failed to receive an ACK was that the ACK was lost rather than because the original message was lost the duplicate is redundant and is discarded Any two successive messages between polls that have the same sequence number fields and the same command or reply bits are assumed to be duplicates 16 Aborts received The HDLC abort signal is not used on a DH link but can be detected by the serial input or output in certain circumstances Some nodes whose addresses match the ringing pattern after a transmitter shutoff are susceptible to this error nodes 36 76 and 176 for example These numbers depend on highway configurations 17 18 Messages successfully transmitted 19 20 Messages successfully received 21 22 Command messages that were successfully generated as a result of a start bit being set and records this nu
16. First byte 1 0 1 0 1 0 0 0 value A8 hex Second byte 0 0 1 0 1 1 1 1 value 2F hex Third byte 0 0 0 0 0 0 0 0 values 00 hex Fourth byte 0 0 0 0 0 0 0 0 always 00 hex The recommended procedure for uploading or downloading PLC 5 memory is to begin at physical address 0000 and proceed sequentially to the end of memory Therefore each successive physical read or write begins at the next physical address after the one where the previous command stopped Since a single physical read or write command can transfer only about 120 words of data it takes many commands to upload or download the entire PLC 5 memory PLC 5 Floating Point PLC Addressing 13 17 PLC 5 type reads and type writes use the IEEE floating point This is the default for PLC 5 processors This means data is returned e low word then high word e low byte then high byte Example PLC 5 type read 20 FF FF FF BF low word high word low high low high exponent MSB mantissa middle MSB mantissa LSB mantissa 1000 00 00 00 7A 44 Example PLC 5 word range read 1000 00 7A 44 00 00 low word high word low high low high 20 FF BF FF FF 3 0 40 co 00 00 Publication 1770 6 5 16 October 1996 Chapter 1 4 Line Monitor Examples This chapter contains line monitor examples for DF1 protocol Each example shows how actual commands and replies look on a line monitor bytes are shown
17. 17 18 Messages successfully transmitted 19 20 Messages successfully received 21 22 ACKs received 23 24 ACKs sent 25 26 NACKs received 27 28 NACKs sent 29 Replies that were lost because they could not be delivered over the link Undeliverable commands can be signalled to the user because the user is located in PC memory and can always be reached If a reply message cannot be delivered over the link there is no way to signal the user of that message who is also on the link that this node cannot signal a reply The local user is not concerned with the problems of the remote user and can take no meaningful action so there is not much to do but destroy the message and count it 30 Timeouts preset 31 Values set by diagnostic commands or set by default on power up 32 ENGs preset Diagnostic Counters 9 19 1771 KG KGM Diagnostic Counters Asynchronous Link Diagnostic Counters This counter byte 0 1 Counts the number of Times a node attempted to send a message 2 3 Messages that were successfully transmitted and ACKed 4 5 ACKs that were received 6 ACKs successfully passed from the receiver s separator to the transmitted 7 NAKs received 8 NAKs passed from the separator to the transmitter 9 Timeouts waiting for a response 10 ENQs se
18. To upload information from See page PLC 2 processors 12 2 PLC 3 processors 12 2 PLC 5 processors 12 3 SLC 500 processors 12 6 Uploading from a PLC 2 Processor 1 If you have Then Make sure the mode selector switch is in the RUN PROG or PROG position Go to step 2 PLC 2 05 2 15 2 16 2 17 or 2 30 processor The mode selector switch can be in any PLC 2 20 or Mini PLC 2 processor position Go to step 2 To inhibit programming terminal access enable the PLC 2 processor to receive mode setting or physical reads using enter upload mode For more on enter upload mode see page 7 10 Upload the information using one or more physical reads For more on physical read see page 7 13 To exit the upload mode use exit download upload mode For more on exit download upload mode see page 7 10 Uploading from a PLC 3 Processor 1 Determine the last memory address used using diagnostic status For more on diagnostic status see page 7 6 Request the right to upload from the PLC 3 processor using upload request For more on upload request see page 7 34 Shut down the PLC 3 processor using shutdown request For more on shutdown see page 7 28 Upload information using one or more physical reads For more on physical read see page 7 13 Exit the upload mode using restart request For more on restart request see page 7 23 Uploading and Downloading with A B Proces
19. Write the directory length to the directory using file write CMD OFH CMD AFH For more on file write see page 7 11 Write the program directory to program file 0 using logical write CMD OFH FNC AAH For more on logical write see page 7 18 Write all other processor files using logical write CMD OFH FNC AAH For more on logical write see page 7 18 Complete the download using download complete CMD OFH FNC 52H For more on download complete see page 7 7 Apply the port configuration using apply port configuration CMD OFH FNC 8FH For more on apply port configuration see page 7 4 Release sole access to commands using return edit resource CMD OFH FNC 12H For more on return edit resource see page 7 11 Chapter 1 3 PLC Addressing PLC processors support these types of addressing Type of Addressing logical Description Type of addressing that a PLC processor uses in its ladder diagram program to access its own data table memory This is the same type of addressing you use in non privileged commands that is in commands that access only PLC data table memory physical Type of addressing a computer uses to send a privileged command to a PLC node In particular you use physical addressing to upload or download PLC memory symbolic PLC 3 only Used by a PLC 3 processor to represent a logical PLC 3 only address with ASCII characters This chapter explains the types of
20. 4 NAKs due to bad LSAPs 5 NAKs due to memory available 6 7 8 9 Duplicate tokens detected 10 Duplicate nodes detected 11 Token pass timeouts 12 Token pass retries exhausted 13 Claim token sequences entered 14 Tokens claimed 15 Bad CRC in received frame 16 17 18 NAK due to no memory sent 19 20 21 Frame transmissions received 22 Receive frames aborted noise 23 24 Messages successfully sent low byte first 25 26 Messages successfully received low byte first 27 28 29 30 31 32 33 34 35 36 Number of active nodes A shaded cell means the counter is present but not functional Publication 1770 6 5 16 October 1996 9 30 Diagnostic Counters Publication 1770 6 5 16 October 1996 1785 KA5 DH485 Diagnostic Counters This counter byte Counts the number of 0 1 Total packets received low byte first 2 3 Total messages sent low byte first 4 Messages ACK timeout count 5 Message retried failure count 6 NAK NO MEM sent 7 NAK NO MEM received 8 Bad messages received 9 Reserved 1785 L11B L20B L30B L40B L60B and L80B DH Channel Diagnostic Counters This counter byte Counts the number of 0 1 Messages received 2 3 Messages sent 4 5 Messages received with errors 6 7 Messages sent with errors 8 9 Messages unable to receive 10 11 T
21. Allen Bradley DF1 Protocol and Command Set Important User Information Because of the variety of uses for the products described in this publication those responsible for the application and use of this control equipment must satisfy themselves that all necessary steps have been taken to assure that each application and use meets all performance and safety requirements including any applicable laws regulations codes and standards The illustrations charts sample programs and layout examples shown in this guide are intended solely for purposes of example Since there are many variables and requirements associated with any particular installation Allen Bradley does not assume responsibility or liability to include intellectual property liability for actual use based upon the examples shown in this publication Allen Bradley publication SGI 1 1 Safety Guidelines for the Application Installation and Maintenance of Solid State Control available from your local Allen Bradley office describes some important differences between solid state equipment and electromechanical devices that should be taken into consideration when applying products such as those described in this publication Reproduction of the contents of this copyrighted publication in whole or in part without written permission of Allen Bradley Company Inc is prohibited Throughout this manual we use notes to make you aware of safety con
22. KG ea personal computer running ControlView ePLC 5 11 5 20 5 30 5 40 5 60 software PLC 5 80 on channel 0 ePLC 5 11 5 20 5 30 5 40 5 60 PLC 5 80 on channel 0 e SLC 5 03 and 5 04 on channel 0 personal computer running 5130 RM1 RM2 KA channel 1 WINtelligent LINX software oF personal computer running e personal computer running RSLINX WiNtelligent LINX software e personal computer running RSLINX SLC 5 03 and 5 04 processors OS302 and OS401 respectively now support half duplex DF1 masters With half duplex protocol you can use a e two circuit system master sends and slaves receive on one circuit slaves send and master receives on the other e one circuit system master and slaves send and receive on the same circuit Transmitter and Receiver Message Transfer Half duplex Protocol Environment Using Half duplex Protocols to Send and Receive Messages 3 3 Each node on a multidrop link contains a software routine to transmit and receive messages DH and DH interface modules already contain a slave transceiver routine so they can be configured to function as slave nodes in half duplex mode Instead of a single routine you can program separate transmitter and receiver routines However in this chapter we assume you are using a single routine The master and slave transmitter receivers are illustrated in the figure below source mast
23. Procedure 1 SLC 500 SLC 5 01 and SLC 5 02 PrOCESSOIS ea ee ee eee eee ee Procedure 2 SLC 5 03 and SLC 5 04 Processors PLC Addressing 2 0eeeceeeeeeeeeaes PLC 2 1774 PLC Addressing 0e eee eeee PLC 2 1774 PLC Logical Addressing PLC 2 Physical Addressing 00e000ees 1774 PLC Physical Addressing 05 PLC 3 Addressing wind eed kde ddan ediucedbeuee deeus PLC 3 Logical Addressing 000000ees PLC 3 Physical Addressing 00ee0 eee PLC 3 Symbolic Addressing 000 000e PLC 5 Addressing iow cce gu edt acobecy Wen lt ees PLC 5 Logical Addressing 00000eeee PLC 5 Logical Binary Addressing PLC 5 250 Logical Binary Addressing Logical ASCII Addressing 0000 PLC 5 Physical Addressing 2 000 PLC 5 Floating Point nnna wdc aaseduaweias Line Monitor Examples 00eeeeeeeees Half duplex Line Monitor Example Message from master to slave and slave acknowledgement Message sent from slave to master in response to poll and slave acknowledgement 2 005 Poll witha DLE EOT in response Full duplex PLC 2 Line Monitor Example Full duplex PLC 3 Line Monitor Example ASCII Codes 0cc cece eee cece ee eeeees Purpose of This Manual Who Shou
24. Publication 1770 6 5 16 October 1996 9 10 Diagnostic Counters Publication 1770 6 5 16 October 1996 This counter byte Counts the number of 21 22 Times the node attempted to send a message 23 24 Messages were successfully transmitted and ACKed 25 26 ACKs received 97 ACKs successfully passed from the receiver s separator to the transmitter 28 NAKS received 29 NAKs passed from the separator to the transmitter 30 Timeouts waiting for a response 31 ENQs sent 32 Messages that could not be successfully sent 33 Reply messages that could not be forwarded and were destroyed 34 35 Messages received 36 37 ACKs sent 38 NAKs sent 39 ENQs received Re transmissions received and ACKed 40 Are transmission is a message that has a transparent word command and source that match the previous message 4 STX full duplex mode or SOH half duplex mode received This is a count of the number of messages that were started 42 Messages characters or message fragments that were ignored 43 Messages aborted by receipt of a DLE ENQ 44 Messages aborted by the receipt of an unexpected control code other than DLE ENQ 45 Times the DLE ACK response was sent but there was no buffer space for the next message 46 DLE NAK was sent because there was no buffer 47 Broadcast messages received 48 Broadcast messages that were successful
25. STS TNS oe DATA R SRCI DST TI STS TNS set link parameters Sets the DH485 parameter Maximum Solicit Address This parameter specifies the maximum node address that a DH485 node tries to solicit onto the link CMD FNC Address Size C DST SRC oe STS TNS oA 000007 Data CMD R SRC DST 46 STS TNS Data the maximum node address that can be solicited 1 byte set NAKs Sets the maximum number of NAKs negative acknowledgements that the asynchronous interface module accepts per message transmission Put the number in the DATA field The default setting for most modules is 3 NAKs per transmission c CMD FNC DST SRC STS TNS og DATA R SRC DST a STS TNS Publication 1770 6 5 16 October 1996 7 26 Communication Commands e PLC 5 Publication 1770 6 5 16 October 1996 set CPU mode Sets the operating mode of the processor at the next I O scan The operating mode is set to the mode indicated in the flag byte shown below A no privilege error is returned if the requester does not have the privilege of placing the host in Download mode This error occurs when the processor is not in Remote mode must be in Remote Program mode Remote Run mode or Remote Test mode e the processor is being edited some other node is alre
26. c XXXX gt DLE CK timeout DLE SOH STN DLE STX xxxx DLE ETX BCC CRC _ lt DLE ACK lt OK Poll with No Message Available In this transfer e the master polls the slave for a message e the slave has no message e the slave returns a DLE EOT Source Source Sink Master Link Slave Sink not full DLEENQSTNBCC _ lt nomessage lt DLE EOT Publication 1770 6 5 16 October 1996 3 14 Using Half duplex Protocols to Send and Receive Messages Publication 1770 6 5 16 October 1996 Poll with Message Returned In this transfer e the master polls for a message and the slave returns a message with faulty data e since it did not receive a DLE ACK on its first attempt the slave re transmits the same message e the master responds with a DLE ACK Source Source Sink Master Link Slave Sink not full DLEENQSTNBCG W __ gt lt XXxx lt DLE STX xx xx DLE ETX BCC CRC DLEENQSTNBCC W ___ gt lt LE STX xxx DLE ETX BCC CRC same message lt XXXX DLE ACK gt OK _ Using Half duplex Protocols to Send and Receive Messages 3 15 Duplicate Message Transmission In this transfer e aslave does not receive a DLE ACK from the master after the master receives the slave s message e when the master polls the slave again the slave sends th
27. 1 74 3573 23949 Binary Floating point Use the binary floating point numbering system when you want to manipulate numbers outside of the range 32768 to 32768 or for a resolution finer than one unit for example 2 075 SLC 5 03 OS300 SLC 5 04 OS400 and PLC S classic processors do not support unnormalized Not a Number NaN and infinity PLC 5 enhanced processors support both NaN and infinity The valid range for a binary floating point number is 3 402824 x 1038 to 1 1754944 x 10738 Publication 1770 6 5 16 October 1996 11 6 Data Encoding Order of Transmission Publication 1770 6 5 16 October 1996 Bits PLC processors store data in 16 bit 2 byte words The bits in these words are numbered addressed 0 through 17 octal going from right to left within a word as follows PLC Word Bits 17 16 15 14 13 12 11 10 07 06 05 04 02 031 01 00 When a module transmits data over its asynchronous link it transmits one byte at a time The module always transmits the low byte bits 00 through 07 of a word before the high byte bits 10 through 17 of the same word Also the Universal Asynchronous Receiver Transmitter UART transmits the low bit first within a byte First Byte Second Byte 00 01 02 03 04 05 06 07 10 11 12 13 14 15 16 17
28. 13 Times a message was too long 14 Times a message arrived when there was no buffer space left 15 Re transmissions of a previously received message 16 Aborts result of line noise 17 18 Messages successfully transmitted 19 20 Messages successfully received 21 22 Command messages sent 23 24 Reply messages received 25 26 Command messages received 27 28 Reply messages sent Publication 1770 6 5 16 October 1996 9 22 Diagnostic Counters Publication 1770 6 5 16 October 1996 Asynchronous Link Counters 1775 KA only This counter byte Counts the number of 29 30 Command messages sent 31 32 Reply messages received 33 34 Command messages received 35 36 Reply messages sent 37 38 ACKs received 39 40 ACKs sent 41 42 NAKs received 43 44 NAKs sent 45 Undeliverable reply messages 46 47 Computer link timeouts preset to 500 ms 48 NAKs accepted per message preset to 10 maximum number 49 ENQs sent per message preset to 10 maximum number 50 NAKs current count 51 ENQs current count Diagnostic Counters 9 23 1775 S5 SR5 DH Diagnostic Counters This counter byte Counts the number of 0 1 Messages sent successfully 2 3 Message received successfully not counting duplicate messages 4 Undeliverable messages message was NAKed or retries were used up 5 ACK timeouts s
29. 9 3 1747 L514 9 3 1747 L524 9 3 1747 L532 9 3 1747 L542 9 4 9 5 9 6 1747 PA2x 9 3 1761 9 7 1761 Li6AWA 9 7 1761 L16BBB 9 7 1761 L16BWB 9 7 1761 L32AWA 9 7 9 7 9 7 1761 L32BWA 1761 L32BWB 1770 9 8 1770 KF2 9 11 1770 KF3 9 3 1770 KF3 connection to DH 485 1 6 1771 9 14 1771 KA 9 14 1771 KA2 9 14 1771 KC 9 16 1771 KG 9 19 1771 KGM 9 19 1774 KA 9 14 1774 PLC commands disable outputs 7 6 enable program 7 9 enable scan 7 9 1775 9 21 Index 1775 KA 9 21 1775 95 9 21 9 23 2 1775 SR5 9 21 9 23 1779 9 24 1779 KP5 9 24 1784 9 25 1784 KR 9 3 1784 KT 9 25 1784 KT2 9 25 1784 KT Connection to Data Higway Plus 2 1 1784 KT2 Connection to Data Highway Plus 2 1 1785 9 26 9 33 1785 KA 9 26 9 27 1785 KA3 9 28 1785 KA5 9 29 9 30 1785 KE 9 11 1785 KR connection to DH 485 1 6 1785 KR5 connection to DH 485 2 1 6001 NET desrcription of P 5 A ADDR 6 8 definition 6 3 Addressing 13 1 1774 PLC physical 13 3 logical 13 1 physical 13 1 PLC 2 13 3 conversion 13 3 PLC 2 1774 PLC logical 13 2 PLC 3 13 4 extended address 13 5 PLC 3 logical 13 5 PLC 3 physical 13 7 PLC 3 symbolic 13 8 PLC 5 13 9 PLC 5 logical 13 9 13 10 PLC 5 logical binary 13 10 PLC 5 250 logical binary 13 13 symbolic 13 1 types 13 1 APP DATA definition 2 8 Index Application layer 1 7 description of 1 8 Appli
30. B1 10110001 177 DE 11011110 222 B2 10110010 178 DF 11011111 223 B3 10110011 179 E0 11100000 224 B4 10110100 180 E1 11100001 225 B5 10110101 181 E2 11100010 226 B6 10110110 182 E3 11100011 227 B7 10110111 183 E4 11100100 228 B8 10111000 184 E5 11100101 229 B9 10111001 185 E6 11100110 230 BA 10111010 186 E7 11100111 231 BB 10111011 187 E8 11101000 232 BC 10111100 188 E9 11101001 233 BD 10111101 189 EA 11101010 234 BE 10111110 190 EB 11101011 235 BF 10111111 191 EC 11101100 236 co 11000000 192 ED 11101101 237 C1 11000001 193 EE 11101110 238 C2 11000010 194 EF 11101111 238 C3 11000011 195 FO 11110000 240 C4 11000100 196 F1 11110001 241 C5 11000101 197 F2 11110010 242 C6 11000110 198 F3 11110011 243 C7 11000111 199 F4 11110100 244 C8 11001000 200 F5 11110101 245 c9 11001001 201 F6 11110110 246 CA 11001010 202 F7 11110111 247 CB 11001011 203 F8 11111000 248 cC 11001100 204 F9 11111001 249 cD 11001101 205 FA 11111010 250 CE 11001110 206 FB 11111011 251 CF 11001111 207 FC 11111100 252 DO 11010000 208 FD 11111101 253 D1 11010001 209 FE 11111110 254 D2 11010010 210 FF 11111111 255 D3 11010011 211 D4 11010100 212 D5 11010101 213 D6 11010110 214 D7 11010111 215 D8 11011000 216 Publication 1770 6 5 16 July 1996 Symbols Empty P 1 P 2 P 4 P 5 2 2 2 3 6 1 6 2 6 3 7 1 Numbers 16 bit computer word _11 7 16 bit PLC word 11 7 1747 9 3 1747 KE 9 3 1747 L20 9 3 1747 L30 9 3 1747 L40 9 3 1747 L511
31. DF1 and network links The application layer interfaces to user processes and databases interprets commands e formats user data into packets The application layer depends upon the type of node the application is running on since it must interface to the user process and interpret the user database Processes in the application layer The application layer is typically organized into two types of processes senders A sender after receiving a signal from the user process sends a message and awaits a reply It then sends the results to the user process responders A responder waits for an incoming message from the link When the responder receives a message it performs the indicated operation on the user data base and returns a reply message to the sender If your physical link is Then the communication modules automatically network link Anging take care of this layer a DF1 link between Allen Bradley interface the interface modules automatically take modules care of this layer See figure below 1747 KE SLC 5 02 processor DH485 link RS 232 DF1 full duplex 1785 KE ae PLC 5 15 S FU DH link a DF1 link between an Allen Bradley you will need to program this layer at your interface module and a computer computer Message Packet Structure Network Layers 1 9 Messages
32. Half duplex Transmission Symbols Symbol Type Meaning DLE SOH control symbol Sender symbol that indicates the start of a master message DLE STX control symbol Sender symbol that separates the multi drop header from the data DLE ETX f BCC CRC control symbol Sender symbol that terminates a message DLE ACK control symbol Response symbol which signals that a message has been successfully received Global link reset command only issued by the master Causes the slaves to cancel all messages DLE NAK control symbol that are ready to transmit to the master Typically the slave returns the message and an error code to the originator DLE ENQ control symbol Sender symbol issued only by the master that starts a poll command DLE EOT Sontrolsvmbol Response symbol used by slaves as a response to BCC y a poll when they have no messages to send STN data symbol Station number of the slave node on your half duplex link Single characters having values 00 0F and 11 FF APP DATA data symbol Includes data from application layer including user programs and common application routines A data 1046 is sent as 10 10 DLE DLE DLE DLE data symbol Represents the data value or STN value of 1046 See APP DATA Publication 1770 6 5 16 October 1996 2 8 Understanding DF1 Protocol Table 2 D Full duplex Transmission Symbols Symbol Type Meaning DLE STX control symbol Sender symbol that indicates the start of a message frame DLE ETX
33. See Chapter 7 Communication Commands for e a description of the command messages for each type of PLC processor e information on how to program the application layer fields of a message packet for an asynchronous link All messages on a network have the same fundamental structure regardless of their function or destination If you could freeze a message packet while it is in transmission you would see Bytes Contents Information used by the application and data link layers of your software to get the message to its destination elf a transaction originates from a PLC processor the interface module rotocol p automatically fills the protocol bytes elf the transaction originates from a computer your computer software must supply the necessary protocol data Information supplied by application program at the source and delivered to the application program at the destination The following sections describe bytes that you define using the application layer protocol bytes in your message packet For a detailed description of how to use these bytes for each type of command see Chapter 7 Communication Commands To define this See this page command and reply message 1 9 message priority 1 10 delivery order of commands 1 10 types of commands 1 11 error codes 1 11 Command and Reply Message A network transaction consists of a command and a reply The two parts provide extra data integrity by making sure t
34. TOTAL FNC OFFSET TRANS ADDRRESS SIZE DLE ETX BCC 01 00 00 56 01 2C 08 OA 00 E4 10 03 6C DLE ACK 10 06 DATA FROM PLC 3 DLE ETX BCC lt lt 228 bytes of data gt gt 10 03 9C DLE ACK 10 06 Packer Toran L FNC OFFSET TRANS ADDRRESS SIZE DLE ETX BCC 01 72 00 56 012C 08 OA 00 E4 10 03 F9 DLE ACK 10 06 DATA FROM PLC 3 DLE ETX BCC lt lt 228 bytes of data gt gt 10 03 9B DLE ACK 10 06 PACKET TOTAL FNC OFFSET TRANS ADDRRESS SIZE DLE ETX BCC 01 E4 00 56 01 2C 08 OA 00 E4 10 03 86 DLE ACK 10 06 DATA FROM PLC 3 DLE ETX BCC lt lt 228 bytes of data gt gt 10 03 9A DLE ACK 10 06 Line Monitor Examples 14 7 Command Field Value Function DLE STX 2 bytes 1002 Indicates the start of a message DST destination 09 Indicates the remote node address that the computer is communicating to 09 hex equals 011 octal the address of the 1771 KA2 SRC source 00 Indicates the DH node address that is the source of the message In this example the computer uses an SRC byte of 00 hex The asynchronous interface 1770 KF2 automatically inserts the correct SRC value before sending the message across the DH link to the 1775 KA CMD command OF Indicates the type of command In this example the CMD byte has the value OF hex which points to a group of PLC 3 commands The FNC byte specifies which command in the gro
35. Tokens claimed r A Bad CRC in received frame o NAKs sent illegal protocol operation ez NAK sent bad LSAP N NAK sent no memory foo Received frames that were too short Received frames that were too long ye Re transmissions received of a frame M Received frames aborted line noise 22 23 Messages successfully sent low byte first 24 25 Messages successfully received low byte first 26 27 Commands successfully sent low byte first 28 29 Replies successfully received low byte first 30 31 Commands successfully received low byte first 32 33 Replies successfully sent low byte first 34 Replies that could not be sent low byte first 35 Number of active nodes Publication 1770 6 5 16 October 1996 9 26 Diagnostic Counters 1785 Cat Nos Publication 1770 6 5 16 October 1996 Cat Nos Link Pages 1785 KE DH 9 11 1785 KA3 DH 9 28 1785 KA DH 9 26 1785 KA DH 9 27 DH 1785 KA5 DH485 9 29 1785 L11B L20B L30B L40B L60B L80B processors DH 9 30 1785 L20E L40E L40L L60L L80E processors DH 9 32 1785 KA DH Diagnostic Counters This counter byte Counts the number of 0 Times received ACKs with a bad CRC 1 Timeouts expired wit
36. WAG Cat NOS ccs crete geen d eases aeeeeaee teens 9 7 1761 L16AWA L16BBB L16BWB L32AWA L32BWA L32BWB MicroLogix 1000 processors Series C or later DH485 Diagnostic COUNUGIS lt ho awd band daw au Goa E eked x 1761 L16AWA L16BBB L16BWB L32AWA L32BWA L32BWB co mY MicroLogix 1000 processors DF1 Diagnostic Counters 9 7 1770 Cat NOS c 2rccenevdiaccaBedaadeegedectiogads 9 8 1770 KF2 and 1771 KE KF DH and Asynchronous Link Diagnostic COUN EIS ioe edi edd es SRS ES an pam ien 3 9 8 1770 KF2 and 1785 KE DH and Asynchronous Link Diagnostic COUNEIS opseicesipeneimn p eniran nius eee 5 9 11 1770 KFC DF1 Diagnostic Counters 9 13 TV CaL NOS 5 215425 Genes 28 doin ge aie EEEE y 9 14 1771 KA 1771 KA2 and 1774 KA DH Diagnostic Counters 9 14 1771 KC DH Diagnostic Counters 9 16 1771 KG KGM Diagnostic Counters 9 19 vi Table of Contents W775 Cat NOS vies sve ee ke neguu he See eee eke ce eeee 9 21 1775 KA S5 SR5 DH Diagnostic Counters 9 21 1775 S5 SR5 DH Diagnostic Counters 9 23 1779 Cat NOS eerie pirater ar erana E eee ceed 9 24 1779 KP5 DH Diagnostic Counters 9 24 1784 Cat NOS n trepere pe neds deena ce oe aa 9 25 1784 KT and 1784 KT2 DH Diagnostic Counters 9 25 1785 Cat NOS cc icceudeccdedtwatddeodn GOee eee 9 26 1785 KA DH Diagnostic Counters 9 26 1785 KA DH Diagnostic Count
37. bit write write bit Modifies the bits at the address specified by either a word symbol a file symbol plus a word offset or a logical address This address must point to a word within a file The function code is 2 Unlike unprotected writes and protected bit writes this command can change the bits in a single word only F T CMD FNC PLC 3 Logical Address Set Reset DST SRC oF STS TNS o2 2 51 bytes Mask Mask CMD EXT SRC DST ge STS TNS cre The EXT STS field may be attached to the reply packet only when there is an error e MicroLogix 1000 e SLC 500 e SLC 5 03 e SLC 5 04 e SLC 500 e SLC 5 03 e SLC 5 04 Communication Commands 7 5 change mode MicroLogix 1000 Changes the mode of the MicroLogix processor CMD FNC Mode C DST SRC p STS TNS P och CMD EXT R SRC DST F STS TNS TS Mode 01 change to Program mode REM program 02 change to Run mode The EXT STS field may be attached to the reply packet only when there is an error SLC 500 Changes the mode of the SLC processor For an SLC 5 03 or SLC 5 04 processor change mode only works when the keyswitch is in the REM position CMD FNC Mode C DST SRC OF STS TNS 80 xh CMD EXT R SRC DST AF STS TNS STS Mode 01 change to PROGRAM
38. transmitter A sends messages to receiver B path 1 and receiver A sends response control symbols DLE ACK DLE NAK to transmitter B path 3 On the second circuit transmitter B sends messages to receiver A path 4 and receiver B sends response control symbols DLE ACK DLE NAK to transmitter A path 2 e All message and symbols on the first circuit are traveling in the same direction node A to node B and all messages and symbols on the second circuit are traveling in the opposite direction B to A Publication 1770 6 5 16 October 1996 Using Full duplex Protocol to Send and Receive Messages 4 3 Figure 4 2 Software implementation of data paths Paths 1 2 3 and 4 Transmitter A Receiver B A Pathi Patho Pathi Path 2 Software Physical Circuit AB Software Multiplexer gt Separator A y Software 4 Physical Circuit BA Software Separator Multiplexer A Path 4 Path 3 Path 4 y Path 3 Receiver A Transmitter B Paths 1 a message symbol sent from node A to node B Transmitter A Receiver B Path 1 Path 1 i Software Physical Circuit gt Software Multiplexer Separator e To implement four logical paths with two physical circuits a software multiplexer is needed to combine the message symbols with the response symbols going in the same direction e At t
39. word range write write block 0 0005 1 35 write bytes physical physical write 7 35 PLC 5 Type Data Parameter Examples 1 36 SLC 500 Information 0 0 cece eee eee 7 38 Reading and Writing SLC 500 Data 1 38 Reading and Writing SLC 500 Data using PLC 2 terminology 71 38 Message Packet Status Codes STS EXT STS 8 1 STS BV cb sde ude EaR seus ehees 8 2 Local STS Error Codes 0 ccc ceeeaee 8 2 Remote STS Error Codes 0 00000 eee 8 3 EXT STS BYlC 2 eau ace dae cea taonsats aba neeke dees 8 3 DH485 EXT STS Codes 000 cee eeee 8 5 Remote STS and EXT STS Codes 005 8 5 Remote STS Codes from a PLC 2 or 1774 PLC Processor 8 5 Remote STS and EXT STS Codes from a PLC 3 Processor 8 6 Diagnostic Counters 00ee eee e eens 9 1 1747 Cat NOS 0 0 ee teens 9 3 1747 KE DH485 Diagnostic Counters 9 3 1747 L20 L30 L40 L511 L514 L524 SLC 500 5 01 and 5 02 processors 1747 PA2x SLC APS COM1 1770 KF3 and 1784 KR DH485 Diagnostic Counters 9 3 1747 L541 L542 and L543 SLC 5 04 processors DH Diagnostic Counters 0 00 9 4 1747 L541 L542 and L543 SLC 5 03 and 5 04 processors DH485 Diagnostic Counters 4 9 5 1747 L541 L542 and L543 SLC 5 03 and SLC 5 04 processors DF1 Diagnostic Counters 00 005 9 6
40. 0 0 0 1 Ievel4 high byte value 0o00 0 00 0 lwel6qaue zo 20 decima Description Flag bits 0 1 and 4 are set to 0 default values are used for levels 1 2 and 5 of the PLC 3 address Flag bits 2 3 and 5 are set to 1 you must specify a value for levels 3 4 and 6 in the bytes following the flag byte Even though the value of address level 6 is 0 the default value the last level of a PLC 3 address is always specified in the ADDR message packet field Address levels are specified lowest level to highest level Address level 3 is the lowest level that must be specified so it is specified in the first byte following the flag byte It is followed by address level 4 then address level 6 3 4 and 5 The level 4 address is 260 decimal which is too large to fit in one byte Therefore byte 3 is a delimiter that contains all 1 s FF hex and is used to delimit the 2 byte level 4 address value The value 260 is then coded low byte first in bytes 4 and 5 Specifies the level 6 address PLC Addressing 13 7 PLC 3 Physical Addressing PLC 3 processors use physical addresses that are related to logical addresses by means of pointers Since no two PLC 3 systems are configured identically the pointers are not fixed Therefore there is no algorithm for converting logical to physical PLC 3 addresses A PLC 3 physical address goes in the 4 byte field labeled PLC 3 PHYSICAL ADDR in the PLC 3 physical reads o
41. 14 3 Full duplex PLC 2 Line In the following example an unprotected read CMD 01 hex is sent Monitor Example e from a computer connected to a 1770 KF2 with Data Highway node address 012 octal to the PLC 2 30 connected to a 1771 KA2 with Data Highway node address 011 octal DH link gt node 012 4770 KF2 1771 KA2 node 011 computer PLC 2 30 Command DLE stx pst srRc cmp sts_ TNS ADDR size DLE erx Bcc ha 10 02 09 00 01 00 01 00 11 00 02 10 03 E2 DLE ACK Path 2 10 06 Reply sometime later DLE STX DST SRC cmp STS TNS DATA DLE ETX Bcc Path 1 10 02 0A 09 41 00 01 00 FF FF 10 03 AD Bae DLE Ack 10 06 Publication 1770 6 5 16 October 1996 14 4 Line Monitor Examples Command Field Value DLE STX 2 bytes 1002 Function Indicates the start of a message DST destination 09 Indicates the remote node address that the computer is communicating to 09 hex equals 011 octal the address of the 1771 KA2 SRC source 00 Indicates the Data Highway node address that is the source of the message In this example the computer uses an SRC byte of 00 hex The asynchronous interface 1770 KF2 automatically inserts the correct SRC value before sending the message across Data Highway to the 1771 KA2 CMD command 01 Indicates the specific type of command
42. 16 October 1996 gt Reading diagnostic counters To read diagnostic counters you issue a diagnostic read command from a device that e is connected to an interface module that supports an asynchronous port e can format the diagnostic commands Therefore a PLC user program is unable to initiate a diagnostic command An interface module s diagnostic counter location varies e by module type between revision levels of the same type module You first request the location of these counters by transmitting a diagnostic status command to the module For more on diagnostic Status see page 7 6 Based on the address returned you can use the number of the counters which follow as an offset to calculate e the location of the desired counter e how many counter values you want returned You can then use this information to format a diagnostic read command The reply from the diagnostic read command contains the data stored in the counters For the PLC 5 and SLC 500 processors you format the diagnostic read command with a dummy value for the address The reply contains the entire counter block For more on diagnostic read see page 7 19 1747 Cat Nos Diagnostic Counters 9 3 Cat Nos Link Pages 1747 KE DH485 9 3 1747 L20 L30 L40 L511 L514 L524 1532 DH485 9 3 1747 L541 L542 L542 sakai i DH485 9 5 1747 L541 L542 1542 DF1 9 6 SLC 500 5 01 and 5 02 process
43. 4 0 Shift bit values 1 through 6 to the left one position To send a physical read or physical write to a PLC 2 node put the PLC 2 physical address in the ADDR field of the command Be sure to encode the low byte of the physical address as the first byte in the ADDR field 1774 PLC Physical Addressing The 1774 PLC controllers use physical addresses that are exactly the same values as the corresponding logical addresses Remember that the logical address is a byte address so the physical address is also a byte address For example the logical byte address of the 17th word in PLC memory is 32 decimal and the physical address is 32 decimal To send a physical read or write command to a 1774 PLC node put the 1774 PLC physical address in the ADDR field of the command message packet Be sure to encode the low byte of the physical address as the first byte in the ADDR field Publication 1770 6 5 16 October 1996 13 4 PLC Addressing PLC 3 Addressing Publication 1770 6 5 16 October 1996 PLC 3 family controllers support logical physical and symbolic addressing For information on See page logical addressing 13 5 physical addressing 13 7 symbolic addressing 13 8 Important PLC 3 processors can accept and transmit PLC 2 1774 PLC command messages with the PLC 2 1774 PLC logical addressing format B
44. 9 19 1774 KA 9 14 1775 S5 9 21 1775 SR5 9 21 baud rate 1 5 description 1 5 example network 1 5 formerly known as P 3 node limit 1 5 PLC connections 1 3 1 5 Data Highway Plus diagnostic counters 1770 KF2 9 11 1775 S5 9 23 1775 SR5 9 23 1779 KP5 9 24 1784 KT 5 1784 KT2 9 2 1785 KA3 9 2 1785 KA5 9 29 9 30 1785 KE 9 11 PLC 5 250 9 33 PLC 5 40 5 60 9 30 Data Hoghway Plus connection to DH 485 il rm co ion co fore co 1 6 Data link layer 1 7 definition _1 7 Data link layer protocol description 2 1 Data link layer protocols 2 4 Data type ID 7 29 Data type size 7 29 Decimal 11 2 DH diagnostic counters 1747 L542 9 4 9 5 9 6 DH 485 connection to Data Highway Plus 1 6 description 1 6 example network 1 6 DH485 diagnostic counters 1747 KE 9 3 1747 120 9 3 1747 L30 9 3 1747 L40 9 3 1747 L511 9 3 1747 L514 9 3 1747 L524 9 3 1747 L532 9 3 1747 PA2x 9 3 1761 Li6GAWA 9 7 1761 Li6BBB 9 7 1761 Li6BWB 9 7 1761 L32AWA 9 7 1761 L32BWA 9 7 1770 KF3 9 3 1784 KR 9 3 1761 L32BWB 9 7 Diagnostic counters 9 1 how to read 9 2 Diagnostic status information _10 2 10 5 10 11 10 15 10 16 10 23 DLE ACK definition 2 8 DLE ENQ definition 2 8 DLE ETX BCC CRG definition 2 8 DLE EXT BCC 5 3 DLE NAK definition 2 8 DLE STX 5 3 definition 2 8 Dowload PLC 12 6 Download 12 PLC 2 12 7 PLC 3 PLC 5 12 6
45. BCCICRC control symbol Sender symbol that terminates a message frame Response symbol which signals that a message BEE AER control symboal frame has been successfully received Response symbol which signals that a message DLE NAK control symbol i frame was not received successfully Sender symbol that requests retransmission of a DLE ENQ control symbol response symbol from the receiver Single character data values between 00 0F and 11 FF Includes data from application layer including user programs and common application routines A data 1046 is sent as 10 10 DLE DLE APP DATA data symbol DLE DLE data symbol Represents the data value of 1046 Publication 1770 6 5 16 October 1996 Chapter 3 Using Half duplex Protocols to Send and Receive Messages In half duplex protocol devices share the same data circuits therefore only one device can talk at a time Half duplex protocol can be likened to a one lane bridge each car must wait its turn to cross the bridge To compare half duplex to full duplex protocol refer to Chapter 4 Using Full duplex Protocols to Send and Receive Messages Read this chapter to help learn how to use half duplex protocol to send and receive messages It contains these sections Section Page Half duplex Protocol Message Transmission 3 2 Transmitter and Receiver Message Transfer 3 3 Half duplex Protocol Environment 3 3 Message Characteristics 3 7 Ma
46. DH link that has just been powered up there should be only one node that has this counter incremented Times that this node has tried to relinquish mastership and the node that was expected to takeover failed to respond This happens often on a noisy link because the noise is mistaken for a poll response and the wrong node is selected as the next master When this occurs the old master resumes polling It also can happen on a long link if the poll response is very attenuated and is not picked up by the carrier detect circuit If the new node does respond but the old master does not hear it the old master records a false poll and continues polling and the new master starts polling This usually leads to the second node detecting contention and relinquishing Times that the receiver received a status frame instead of a message frame This counter is never incremented because the message size is checked first and all status messages are too small to be accepted This counter byte Diagnostic Counters 9 9 Counts the number of Frames that were rejected because they were less than 6 bytes long This counter records all status frames that were received by a node that disabled its address recognizer in the second step of the mastership timeout process This happens often on a heavily loaded link 10 Frames that were rejected because the destination address was incorrect This can have the same cause as counter byte 9 T
47. E Check processor expansion byte byte 4 3 all Interface expansion byte 10 1785 KA 4 all Processor expansion byte 10 1785 KA 5 6 all The starting address of the counters on the link other than the one from which the diagnostic status command was issued 7 8 all This is the starting address of the counters on the link from which the diagnostic status command was issued 9 0 4 Series and revision level of node 0 Revision A interface module 1 Revision B etc 5 7 0 Series A 1 Series B etc 10 0 Settings of the option switches on 0 57 600 bits per second Data Highway baud rate the module 1 Undefined 1 0 57 600 bits per second Data Highway Plus baud rate 1 Undefined 2 3 Not used 0 No redundancy switch valve 1 Redundancy switch valve 5 0 Secondary switch valve 1 Primary switch valve 6 7 Not used Not used 11 12 all Address of the DH active node table low byte first Publication 1770 6 5 16 October 1996 Diagnostic Status Information 10 17 1785 KA5 Status Bytes DH Status Bytes Bytes Bits Contents Description 0 all mode 0 1 all type extended EE 2 all interface type 1785 KA5 30 3 all processor type 1785 KA5 2F 4 5 all DH485 diagnostic counters address low byte first 6 7 all DH diagnostic counters address low byte first 8 all module revision series 0 4 revision 5 7 series 9 all options 0 1
48. Each byte contains a hex value 5 0 30 For example byte 3 contains the value for the ASCII character 4 E Refer to Chapter 15 ASCII Codes for a list of ASCII 6 3A characters and their hex binary and decimal values 7 33 8 36 9 30 10 NUL 00 A null character that ends the ASCII address specification Publication 1770 6 5 16 October 1996 13 16 PLC Addressing Publication 1770 6 5 16 October 1996 PLC 5 Physical Addressing PLC 5 processors use physical addresses that are related to logical addresses by means of pointers Since no two PLC 5 systems are configured identically the pointers are not fixed Therefore there is no algorithm for converting logical to physical PLC 5 addresses A PLC 5 physical address goes in the 4 byte field labelled PLC 5 PHYSICAL ADDR in the PLC 5 physical read or write command message packets A physical address is made of 24 bits These bits are inserted in the message packet physical address field as follows bits are labelled A1 to A24 respectively Function FNC Field First byte A8 A7 A6 A5 A4 A3 A2 A1 Second byte A16 A15 A14 A13 A12 Ail A10 A9 Third byte A24 A23 A22 A21 A20 A19 A18 A17 Fourth byte 0 0 0 0 0 0 0 0 Size Field For example to address a command message to physical word address 12 200 decimal 002FA8 hex use the following binary code in the address field
49. FNC ADDR SIZE DATA SRC Command specific DST CMD STS TNS data packet SRC DST CMD STS TNS Field Contents See DST destination node for the message SRC source node of the message page 6 4 FNC function code CMD command code page 6 5 ADDR address of memory location 2 bytes page 6 8 STS status code EXT STS extended status code page es SIZE number of bytes to be transferred page 6 8 TNS transaction number 2 bytes page 6 7 data values being transferred by the message DATA The number of data bytes in a message depends on Chapter 7 the command or function being executed The combination of SRC CMD and TNS bytes uniquely identifies every message packet One of these fields in the current message must be different than the corresponding field in the last message received by a command executor If all fields are the same the message is ignored and is considered to be a duplicate If the receiving module has the ignore duplicate messages option enabled the message will be ignored Publication 1770 6 5 16 October 1996 6 4 Application Layer Message Packets DST and SRC Form the DST and SRC bytes of a reply message by interchanging the DST and SRC bytes of the corresponding command message Command DST SRC Repl SPY SRC DST Byte Contents Value supplied by Value range ae receiving message
50. Loop Maximum data field size is 95 bytes not 243 Maximum data field size is 95 bytes not 244 In addition the Unprotected Read Addr field is used as a word address instead of a byte address and the Size field may contain either an even or odd value Maximum data field size is 94 bytes not 244 In addition the Unprotected write Addr field is used as a word address instead of a byte address Reading and Writing When using SLC terminology SLC 500 Data e The address field in the unprotected read and unprotected write p p commands is used as the word offset into the file e Thus to read N9 9 from an SLC 500 put 9 in the address field after converting it to 09 hex Reading and Writing Important The address fields of unprotected reads and unprotected SLC 500 Data writes are used as word addresses instead of the byte using PLC 2 terminology addresses used in the PLC 2 1774 PLC and PLC 5 processor Because of this existing software drivers that communicate with the these processors do not work with SLC 500 family processors unless you set bit S 2 8 to a logical one The SLC 500 processor then changes to byte addressing mode This bit is reset to logical zero by default Publication 1770 6 5 16 October 1996 Communication Commands 7 39 You can map the SLC 500 CIF file to PLC 2 memory as shown in the following example The maximum size of PLC 2 memory that you can simulate is 256 words octal 00 through 377 Example R
51. October 1996 Cat Nos Link Pages DH 9 8 1770 KF2 DH gmi 1770 KF3 DH485 9 3 1770 KFC DF1 9 13 1770 KF2 and 1771 KE KF DH and Asynchronous Link Diagnostic Counters This counter byte 0 Counts the number of Bad CRCs or I O errors on ACK Same causes as bad CRC on messages Times the sender timed out waiting for an acknowledgment This is a common error and is the first to respond to reflections or low level noise on the link It is sensitive to problems on longer cables It also appears if the receiver or transmitter circuitry on a module is marginal or if the cable connections are loose Times contention was detected This counter corresponds to error 93 This also appears quickly on noisy or over length cables Times the ACK was successfully received but contained a non zero status code other than memory full Currently the only other implemented ACK code is buffer overflow This condition should never occur except when debugging new computer programs Times the link driver returns a message to sender Each count corresponds to one local error bit set or one reply message lost Times the link driver returns a message to sender Each time this happens the message is placed on a waiting queue for 0 5s Each message is re tried five times before it is returned to the sender Times this node grabbed mastership of the link because it timed out while waiting to hear a valid frame On a
52. Ss te OON OOF WD ou more than 7 bytes for each element of data one 1 in bit 3 of the flag byte In bits 0 1 and 2 you enter the number of bytes that will contain the number of bytes used for each element of data These additional size value bytes follow the flag byte and any ID Type bytes If the Data Then set bit 7 of the flag byte to Type ID is 7 or less zero 0 and encode the ID value for the data type in the bits 4 5 and 6 ID Value Field greater than7 one 1 In bits 4 5 and 6 you insert the number of bytes to follow that contain the data type ID value usually 1 These additional ID value bytes follow directly after the flag byte For example if you were sending address data then bit 7 would be set to 1 because the address ID value 15 cannot fit into bits 4 5 and 6 Bits six five and four would be set to 0 0 1 respectively to signify that the data ID value 15 will be contained in one byte that follows the flag byte For example if each element of data used 8 bytes then you set bit 3 to 1 because the value 8 cannot fit into bits 0 1 and 2 Bits two one and zero would be set to 0 0 1 respectively to signify that the number of bytes per element of data 8 will be contained in one byte that follows the flag byte and any ID Type bytes For examples of type data parameter see page 7 36 Publication 1770 6 5 16 October 1996 7 30
53. a complete set of drivers to communicate with Allen Bradley processors via Ethernet DH DH DH485 and DF1 serial links on various hardware and operating system platforms 1770 6 5 16 October 1996 P 2 About This Manual What This Manual This manual is divided into five units Contains ONetwork Protocol Message Module Reference Basics Packets Diagnostics Chapter 1 Network Layers gain an understanding of the network Chapter 2 Understanding DF1 Protocol Chapter 3 Using Half duplex Protocol to Send and Receive Messages Chapter 4 Using Full duplex Protocol to Send and Receive Messages 2 e understand what DF1 protocol is e understand the difference between half duplex and full duplex protocols 1770 6 5 16 October 1996 Chapter 5 Data link Layer Message Frames Chapter 6 Application Layer Message Packets Chapter 7 Communication Commands Chapter 8 Message Packet Status Codes STS EXT STS e properly configure the data link layer of your software driver e understand each part of a message packet e learn message packet formats for all commands e asynchronous link status codes that may be sent in the STS fields of your message packet Chapter 9 Diagnostic Counters Chapter 10 Diagnostic Status Information 4 e diagnostic counters contained in each interface module e information returned from each interface when your computer send
54. addressing a computer can use in command messages that it transmits to these processors It contains these sections Section Page PLC 2 1774 PLC Addressing 13 2 PLC 3 Addressing 13 4 PLC 5 Addressing 13 9 Publication 1770 6 5 16 October 1996 13 2 PLC Addressing PLC 2 1774 PLC Addressing Publication 1770 6 5 16 October 1996 PLC 2 and 1774 PLC processors support logical and physical addressing For information on See page PLC 2 1774 PLC logical addressing 13 2 PLC 2 physical addressing 13 3 1774 PLC physical addressing 13 3 PLC 2 1774 PLC Logical Addressing PLC 2 and 1774 PLC processors access their data tables by using an octal word address For PLC 2 1774 PLC command messages you must put the equivalent of this address in the 2 byte message packet field labeled ADDR To encode a logical PLC 2 1774 PLC address 1 Convert the octal word address to the number system you are using in your computer application program 2 Double this converted word address to get the corresponding byte address 3 Place the result in the ADDR field low byte first For example to address PLC 2 word 020 you must first convert the octal value 20 to the desired base In this example we use hexadecimal values Octal 20 is 10 hex Doubling this value gives us a value of 20 hex for the byte address You then code the value 0020 hex in the ADDR field of the message low byte first In binary format ADDR looks like this
55. by sending another upload all request within the 90 second limit 3 Upload the first 14 bytes of PLC 5 memory using read bytes physical For more on read bytes physical see page 7 19 4 Upload the rest of PLC 5 memory starting at location 0A00 hex to 3FFO hex Uploading PLC 5 memory You can accomplish a complete upload of PLC 5 memory using 107 read bytes physical with a size of 128 bytes plus one read bytes physical with a size of 112 bytes For more on read bytes physical see page 7 19 You can only read 112 bytes with a physical read sent to address 3F80 5 Exit Upload mode using upload completed For more on upload completed see page 7 34 Uploading and Downloading with A B Processors 12 5 Procedure 2 The processor can be in any mode while uploading 1 Verify the processor type using diagnostic status For more on diagnostic status see page 7 6 Place the processor in Upload mode using upload all request For more on upload all request see page 7 33 This command returns a reply which contains the addresses of e PLC 5 memory segments that you can upload e memory segments that can be verified after upload Upload the memory segments specified in the reply packet of upload all request using read bytes physical For more on read bytes physical see page 7 19 Read bytes physical A single segment of PLC 5 memory may require more than one read bytes physical You must calculate the PLC 5
56. computer node and to initialize a PLC 3 restart CMD FNC C DST SRC OF STS TNS OA CMD EXT R SRC DST AF STS TNS STS The EXT STS field may be attached to the reply packet only when there is an error Publication 1770 6 5 16 October 1996 7 24 Communication Commands PLC 5 PLC 5 VME SLC 500 SLC 5 03 SLC 5 04 e PLC 2 Publication 1770 6 5 16 October 1996 return edit resource Returns the edit resource sole access of the processor when editing is completed When you return the edit resource the programming device can be written to or modified CMD FNC C DST PSN SRC PSN OF STS TNS 12H LNH LNH CMD EXT Hi LO DST PSN SRC PSN AF STS TNS STS LNH length of the optional portion of the reply packet in bytes First four words of return edit resource The first four words are currently unused and unexamined To assure compatibility with any future use of these bytes they should be initialized to 0 DST PSN and SRC are included for reference only For this processor This access is cleared by SLC 5 00 SLC 5 01 SLC 5 02 any node sending this command SLC 5 03 SLC 5 04 the programming device or via a timed mechanism internal to the processor sending this command set data table size Sets the data table size for the PLC 2 processor Use this command immediately be
57. computer to indicate that the module successfully received the message If the BCC value calculated by the module does not match the BCC value in the message packet the module sends a DLE NAK 10 15 instead of the DLE ACK hex Publication 1770 6 5 16 October 1996 Line Monitor Examples 14 5 Reply Field Value Function DLE STX 2 bytes 1002 Indicates the start of the reply message DST destination 0A Indicates the node address that the reply is being sent back to In our example command message the 1770 KF2 put its address in the source SRC byte before sending the command message to the 1771 KA2 The 1771 KA2 takes the source byte from the command message and makes it the destination byte of the reply message In our example the reply message is sent back to the 1770 KF2 node address 012 octal 0A hex SRC source 09 Indicates the Data Highway node address that is the source of the message In this example the reply is being sent from the 1771 KA2 at node address 011 octal 09 hex CMD command 41 Indicates the specific type of command In a reply packet 40 hex is added to the CMD byte to indicate that the packet is a reply In this example the CMD byte in the command message was 01 hex unprotected read so the CMD byte in the reply message is 41 hex STS status 00 Indicates the status of the message If there is a problem with the message or the network a status code appears in this byte
58. e AND Mask 0 to reset a bit 1 to leave it the same e OR Mask 1 to set a bit 0 to leave it the same Important The controller may change the states of the original bits in memory before this command can write the word back to memory Some data bits may unintentionally be overwritten To help prevent this we suggest that you use this command to write into the storage area of a programmable controller s data table and have the controller read the word only not control it id ca e e PLC 5 250 ONLY Communication Commands 7 21 read modify write N Sets or resets specified bits in specified words of data table memory The variable N lets you specify the number of sets modified The interface that receives this command performs this procedure for each PLC 5 system address AND Mask and OR Mask in the message packet 1 Copies the specified word in the data table 2 Resets the bits specified in the AND mask 3 Sets the bits specified in the OR mask 4 Writes the word back to its location Important The controller may change the states of the original bits in memory before this command can write the word back to memory Some data bits may unintentionally be overwritten To help prevent this we suggest that you use this command to write into the storage area of a programmable controller s data table and have the controller read the word only not control it DST src CMD sts
59. first 7 0 4 Series and revision of the PLC 5 0 Revision A 1 Revision B etc 5 7 0 Series A 1 Series B etc all Processor number on DH link all I O address Address of the processor if it is an adapter If it is a scanner value is OFDH 10 0 I O and communication parameters 0 Double density 1 1 Adapter mode 2 1 Module group 4 top half 5 1 Adapter is half rack 6 1 Data Highway Plus at 115K baud 11 12 all Number of data table files low byte first 13 14 all Number of program type files low byte first 15 0 Forcing status 1 Forces active 4 1 Forces are present in the tables 16 all Memory protect indication non zero means memory is protected 17 all Bad RAM indication non zero means RAM is bad must be cleared Publication 1770 6 5 16 October 1996 Bytes Bits 0 2 Diagnostic Status Information 10 21 1785 LT3 PLC 5 12 and 1785 LT2 PLC 5 25 Status Bytes Contents Operating status of PLC 5 processor Description 0 Program load 1 Not used 2 Run mode 3 Not used 4 Remote program load 5 Remote test 6 Remote run 7 Not used 0 Normal 1 Major processor fault 0 Normal 1 Download mode Not used 0 Not testing edits 1 Testing edits 0 Not testing edits 1 Testing edits Processor Type B PLC 5 E Expansion byte Processor Expansion Byte 13 1785 LT3 PLC 5 12 14 1785 LT2 PLC 5 25 Size o
60. idle due to SUS instruction 00110 remote RUN 00111 remote TEST continuous scan 01000 remote TEST single scan 01001 remote TEST continuous step 10000 download 10001 PROG 11011 idle due to SUS instruction 11110 RUN forces active forces installed communication active 20 0 om A ew pe ON oO an N processor mode status control word high byte protection power loss startup protect fault load memory module on error load memory module always load memory module and run major error processor halted locked first pass bit 21 L 22 L program ID low byte high byte 23 4 processor RAM size in Kbytes Publication 1770 6 5 16 October 1996 Diagnostic Status Information 10 5 Bytes Bits Contents Description 24 0 directory file corrupted 1 not used 0 2 7 program owner node address 00 1F for nodes 0 through 31 3E for nodes 20 through FF 3F no program owner SLC 5 03 processors only SLC 5 04 processors only 1761 1770 and 1771 For status information from these cat nos See page Cat Nos 1761 L16AWA L16BBB L16BWB L32AWA L32BWA L32BWB 10 6 MicroLogix 1000 processors 1770 KF3 10 7 1771 KA KA2 KC KD KE KF KG KGM 1770 KF2 and 1774 KA 10 7 Publication 1770 6 5 16 October 1996 10 6 Diagnostic Statu
61. message If you change this value the command initiator cannot match its command to the corresponding reply message Values are assigned by Publication 1770 6 5 16 October 1996 6 8 Application Layer Message Packets Publication 1770 6 5 16 October 1996 ADDR The ADDR address bytes contain the byte address of a memory location in the command executor where the command is to begin executing except in SLC 500 processors where the ADDR byte is interpreted as the word address In SLC 5 02 SLC 5 03 and SLC 5 04 processors the CIF Addressing Mode bit S 2 8 can be set to a one to change the interpretation of the ADDR byte to the byte address so that it is compatible with other PLC processors For example if the command is to read data from the command executor ADDR specifies the address of the first byte of data to be read ADDR tt contains the low least significant byte of the address contains the high byte of the address Sending commands to PLC 3 PLC 5 and SLC 500 processors In some instances when sending commands from the basic command set to a PLC 3 PLC 5 or PLC 5 250 processor or to an SLC 500 processor you must create special files to accept the data Important The ADDR field specifies a byte address not a word address as in PLC data tables Chapter 13 PLC Addressing explains how to convert PLC word addresses to byte addresses Also if you use the native read an
62. mode REM program 06 change to RUN mode REM Run 07 change to TEST Cont Scan Mode REM Test 08 change to TEST Single Scan Mode REM Test 09 change to TEST Debug Single Step REM Test SLC 500 and SLC 5 01 processors do not support 09 mode The EXT STS field may be attached to the reply packet only when there is an error close file Closes a file in an SLC 500 processor When closing program file 0 in an SLC 500 SLC 5 01 or SLC 5 02 processor after it has been opened for write the SLC processor calculates the LRC for the directory data and internal files CMD FNC c DsT src CMD sts TNS g T9 CMD EXT R SRC DST 4p STS cr The EXT STS field may be attached to the reply packet if there is an error Publication 1770 6 5 16 October 1996 7 6 Communication Commands diagnostic status Reads a block of status information from an interface module The reply contains the status information in its DATA field The status information varies with the type of interface module For additional information see Chapter 10 Diagnostic Status Information 1774 PLC MicroLogix 1000 PLC 2 06 03 c pst src CMD sts Ns FNC PLC 3 PLC 5 R src pst CMD sts TNS Data max 244 bytes PLC 5 250 8 receive only SLC 500 SLC 5 03 SLC 5 04 disable forces Disables the f
63. must precede the first physical write C pst SRC m STS TNS ADDR Data eal bytes R SRC DST pa sTs NS 1774 PLC c pst src a sts TNS ADDR Data max 244 bytes R SRC DST Y STS TNS PLC 3 The starting address is a PLC 3 physical address The destination interface module accepts this command after the source node has successfully transmitted a shutdown request CMD FNC a Data max 238 bytes DST SRC OF STS TNS 08 PLC 3 phys address or 119 words CMD EXT SRC DST ye STS TNS STS The EXT STS field may be attached to the reply packet only when there is an error id Ia Y BT f 1774 PLC PLC 2 PLC 3 PLC 5 PLC 5 250 DATA DATA is e4 byte blocks each of which contains a 16 bit address field ea set mask ea reset mask protected bit write Communication Commands 7 15 Sets or resets individual bits within limited areas of the PLC data table memory The access is limited by memory access rungs in the communication zone of the PLC processor s ladder diagram program C CMD DST SRC 02 STS TNS ADDR ser RESET Up to 60 masks of this form R src pst CMD sts TNS DATA max 244 bytes 42 j ADDR SET RESET pi ooo eUse SET to specify which eUse RESET to specif
64. of PLC 2 memory look for FFFF after the address in bytes 3 and 4 The FFFF must appear at a 1 2 Kbyte junction all Memory size Size of memory in number of bytes for 1774 PLC processor zero for all other processors all Diagnostic address Starting byte address of diagnostic counters and timers Publication 1770 6 5 16 October 1996 10 8 Bytes Bits 9 0 4 Diagnostic Status Information Contents Series and revision level of interface module 1770 KF2 A identifies itself as Series D in byte 9 bits 5 to 7 Series B 1770 KF2 identifies itself as Series E and so on 1771 KA identifies itself as a Series A 1771 KA2 Series A identifies itself as a Series B and so on Description 0 Revision A 1 Revision B etc 0 Series A 1 Series B etc 10121 0 7 Settings of the option switches on the node interface module This byte is not used in replies by 1771 KC KD or KE KF modules For the other modules the bits of this byte are defined as follows 1771 KA and 1771 KA2 modules 1771 KA2 status information is opposite of 1771 KA as noted 0 57 600 bits per second baud rate for DH link undefined for 1771 KA2 1 Undefined 2 Undefined 3 Undefined 57 600 for 1771 KA2 0 All other PLC 2 Family processors PLC 2 processor for 1771 KA2 1 PLC 2 processor all other PLC 2 proc
65. or 5 04 225 bytes with IP does not apply to DF1 drivers 236 bytes without IP applies to DF1 drivers Publication 1770 6 5 16 October 1996 7 18 Communication Commands e SLC 500 e SLC 5 03 e SLC 5 04 Publication 1770 6 5 16 October 1996 protected typed logical write with three address fields Writes data to a logical address in a SLC processor CMD FNC Byte File File Ele S Ele DST SRC OF STS TNS AA Size No Type No No DATA CMD EXT SRC DST ye STS TNS ots The EXT STS field is only included if there is an error Field Description The size of data to be read in bytes not including the address fields Byte Size or other overhead bytes Addresses files 0 254 only For higher addresses setting this byte to File Number FF expands this field to three bytes total Use the second and third bytes for the expanded file address low address byte first Use one of the these values for this field Do not use any other values doing so may result in unpredictable results 80 83 hex reserved e84 hex status e85 hex bit File Type e86 hex timer e87 hex counter e88 hex control e89 hex integer 8A hex floating point e8D hex string e8E hex ASCII Element Number Addresses elements 0 254 only For higher addresses setting this byte to FF expands this field to three bytes Use the second and third byte
66. request restart 7 23 shutdown request shutdown 7 28 upload request upload priviledge 7 34 PLC 5 commands typed write write block 1 30 PLC 5 family commands download all request download 7 7 download completed _7 7 modify PLC 2 compatibility file 7 12 read bytes physical physical read 7 19 read modify write write bit 7 20 read modify write n 7 21 set processor mode 7 26 typed read read block 7 28 upload all request upload 7 33 upload completed 7 34 word range read read block 7 34 word range write write block 7 35 write bytes physical physical write 7 35 Polling packet 5 2 Protocol full duplex _2 4 Protocol bytes description of 1 9 Protocol environment definition 4 3 message characteristics 4 4 message sink 4 3 message source 4 3 transmitter operation 4 5 R Receiver operation 4 7 ACK 4 8 DLE ENQ 4 8 NAK 4 8 Releated Products _P 4 Remote error 8 2 remote node definition of _P 3 Remote STS and EXT STS codes meaning from a PLC 3 8 6 Remote STS Codes meaning sent from a PLC 2 or 1774 PLC 8 5 remote STS error codes 8 3 responder definition 1 8 Return edit resource _7 24 S Sender defintion 1 8 SIZE 6 8 definition 6 3 Slave packet 5 2 Slaves 2 3 SLC 500 family commands reading and writing using PLC 2 terminology 7 38 SLC 500 family commands protected typed logical read three address fields 7 17 protecte
67. source and destination addresses 11 Times that the receiver sent an ACK without first being able to allocate a receive buffer This results in a memory overflow error when the next messages is received 12 Frames that were rejected because of a bad CRC This error is common on a noisy link 13 Times a message was received that contained more than 250 bytes 14 Times a message was received when there was no buffer space allocated for it This usually follows a memory full error Publication 1770 6 5 16 October 1996 9 18 Diagnostic Counters Publication 1770 6 5 16 October 1996 This counter byte 15 Counts the number of Duplicate frames received A duplicate frame is sent by a transmitter when it fails to receive an ACK If the reason it failed to receive an ACK was that the ACK was lost rather than that the original message was lost the duplicate is redundant and is discarded Any two successive messages between polls that have the same sequence number fields and the same command or reply bits are assumed to be duplicates 16 Aborts received The HDLC abort signal is not used on a DH link but can be detected by the serial input or output in certain circumstances Some nodes whose addresses match the ringing pattern after a transmitter shutoff can be particularly susceptible to this error nodes 36 76 and 176 for example These numbers depend on link configurations
68. specify e4 byte blocks each of address of the byte to be bits to set to 1 in the which bits to reset to 0 in which contains a 16 bit modified in the PLC data addressed PLC byte the addressed PLC byte address field ea set mask ea reset mask Publication 1770 6 5 16 October 1996 table memory Put the low byte least significant bits of the PLC address value into the first byte of the ADDR field eA 1 in a bit position of the eA 1 in a bit position of the SET mask means to set RESET mask means to the corresponding bit in the reset the corresponding bit addressed PLC byte to 1 in the addressed PLC byte to 0 eA 0 in a bit position of the SET mask means to leave the corresponding bit in the PLC byte unchanged eA 0 in a bit position of the RESET mask means to leave the corresponding bit in the PLC byte unchanged Communication Commands 7 31 Important The interface module at the receiving PLC node executes this command by first making a copy of the addressed PLC byte It then sets or resets the appropriate bits and writes the byte back into PLC memory At the same time the PLC processor can be changing the states of the original bits in memory Because of this some data bits may unintentionally be overwritten unprotected read 1774 PLC PLC 2 PLC 3 PLC 5 Reads words of data from any area of PLC and PLC 2 data table memory In PLC 3 and PLC 5 processors the data is read from the PLC 2 compatibility fil
69. the 2 s complement of STN The BCC does not include any other message frame symbols or response symbols Publication 1770 6 5 16 October 1996 Full duplex Protocol Message Frames From user application program From common application routines Data link layer frame Data link Layer Message Frames 5 3 Full duplex protocol implements different message frames depending on the network layer This figure shows the format of a message frame for full duplex protocol and the layer at which each portion is implemented DST CMD STS command data DST SRC CMD STS TNS oaa j from application layer E data from BCC CRC DLE STX application layers DLE ETX field The BCC CRC field contains the 2 s complement of the 8 bit sum module 256 arithmetic sum of all application layer data bytes between the DLE STX and the DLE ETX BCC It does not include any response symbols You can use the BCC CRC field for one of the following types of error checking e block check character BCC e 16 bit cyclic redundancy check CRC 16 Publication 1770 6 5 16 October 1996 5 4 Data link Layer Message Frames BCC and CRC Fields Publication 1770 6 5 16 October 1996 At the end of each polling frame and each message frame there is a one byte BCC block check character field or a two byte CRC cyclic redundancy check field You select BCC or CRC through switch sett
70. then begin BCC the data code GET CODE if it s a DLE STX then begin RESPONSE GETMESSAGE if RESPONSE is ACK then begin if message header is different from last and sink is not full begin save new HEADER try to send message to sink end if this is not a broadcast message and sink was not full then begin turn on RTS wait for CTS send DLE ACK turn off RTS end end end end end else if it s a DLE ENQ then begin GET CODE the station number GET CHAR the BCC check the station number and the BCC and if they re OK then begin if there is a message left over from the last time and the transmit counter is exceeded then throw the message away and send an error code to the message source if there is no message then try to get one from the message source turn on RTS wait for CTS if there is still no message then send a DLE EOT else SEND the message turn off RTS end end else if it s a DLE ACK then send a success code to the message source and discard the message else if it s a DLE NAK then while the message source can supply a message begin get a message from the message source discard the message send an error code to the message source end end Using Half duplex Protocols to Send and Receive Messages 3 5 GETMESSAGE is defined as GET CODE while it is data code begin if buffer is not overflowed put data in buffer GET CODE end if it is a control code and it is an ETX then begin if parity error flag is set then retu
71. they receive the command from a computer Publication 1770 6 5 16 October 1996 7 4 Communication Commands PLC 5 PLC 5 VME SLC 5 03 SLC 5 04 tg e PLC 3 e PLC 5 receive only e PLC 5 250 ea ay Publication 1770 6 5 16 October 1996 apply port configuration Changes the configuration of some or all ports If there are no parameters changes all ports This command reconfigures the ports based on information in the processor s physical memory It is normally used as part of a physical download operation where the processor memory and configuration are to be fully restored A programming device must have the edit resource to use this command C DST PSN SRC PSN n STS TNS x A B LNH LNH CMD EXT Hi LO DST PSN SRC PSN 4FH STS TNS STS Data A number of ports to change is a one byte field 00 means all ports B port numbers in this list are two bytes each low byte first Data returned only if there is an EXT STS error 12H It contains the file and element that relate to the error LNH length of the optional portion of the reply packet in bytes First four words of apply port configuration The first four words are currently unused and unexamined To assure compatibility with any future use of these bytes they should be initialized to 0 DST PSN and SRC are included for reference only
72. this counter incremented Times that this node has tried to relinquish mastership and the node that was expected to take over failed to respond This happens on a noisy link because the noise is mistaken for a poll response and the wrong node is selected as the next master When this occurs the old master resumes polling It also can happen on a long link if the poll response is very attenuated and is not picked up by the carrier detect circuit If the new node does respond but the old master does not hear it the old master records a false poll and continues polling and the new master starts polling also This usually leads to the second node detecting contention and relinquishing This counter byte 8 Diagnostic Counters 9 17 Counts the number of Times the receiver received a status frame instead of a message frame This occurs if a poll timeout is imminent a master has had mastership for more than 170ms and the node has disabled its address recognizer to test for any valid traffic The probability of errors in counter bytes 8 9 and 10 increases substantially Frames that were rejected because the header was incomplete This is only counted because of undebugged software or in the unlikely event that a bad frame fooled the CRC checker 10 Frames that were rejected because the destination address was incorrect This can have the same cause as counter byte 8 This counter also detects frames that have the same
73. you connect an interface module to another Allen Bradley communication interface module the modules automatically handle the link arbitration For a list of modules that automatically handle link arbitration refer to page 4 1 Full duplex dial up modems Full duplex dial up modems can be used as long as a carrier is detected before the carrier timeout about 10 seconds If a carrier is not sensed before the timeout the module drops DTR to trigger the modem to hang up the phone A carrier must be sensed at least every 10 seconds to maintain the connection Character Transmission Understanding DF1 Protocol 2 5 Allen Bradley interface modules send data serially over the RS 232 C RS 422 A interface one 10 bit byte 11 bit byte with parity at a time The transmission format conforms to ANSI X3 16 CCITT V 4 and ISO 1177 standards with the exception that the parity bit is retained while the data length is extended to eight bits Make sure that your computer conforms to this mode of transmission The transmission format is No Parity start bit data bit 0 data bit 1 data bit 2 data bit 3 data bit 4 data bit 5 data bit 6 data bit 7 one stop bit With Parity start bit data bit 0 data bit 1 data bit 2 data bit 3 data bit 4 data bit 5 data bit 6 data bit 7 even parity bit one stop bit For all DH DH and DH485 interface modules you must comply with this transmission format For communication rates and parity setting
74. 0 all DH active node table address low byte first DH485 Status Bytes Bytes Bits Contents Description 0 all type extended EE 1 all interface type 1785 KA5 30 2 all processor type 1785 KA5 2F 3 all revision series 4 all 11 bytes ASCII bulletin number zero terminated 5 all 8 bytes of product specific information 1785 KA3 Status Bytes Bytes Bits Contents Description 1 0 2 Operating status of PLC 2 0 Program load mode 1 Test mode 2 Run mode 3 not used 4 Remote program load 5 Remote test 3 0 normal communication 1 No communication with PLC 2 4 0 Normal 1 Download or upload mode 5 0 Normal 1 Format error in communication zone of PLC 2 program 6 7 Always zero 2 0 3 Type of interface module and processor D 1785 KA3 module 4 7 1 PLC 2 processor 2 PLC 2 20 LP1 processor 3 Mini PLC 2 processor 5 PLC 2 20 LP2 processor 6 PLC 2 15 7 PLC 2 30 processor E expansion byte precedes byte 3 expansio Data only if byte 2 contains ED 1D PLC 2 02 1E PLC 2 05 n byte 1F PLC 2 16 20 PLC 2 17 Publication 1770 6 5 16 October 1996 10 18 Diagnostic Status Information Bytes Bits Contents Description 3 4 all Octal address of the start of the PLC program 5 6 all 0 not used 7 8 all Starting byte address of diagnostic Starting byte address of diagnostic counters and timers counters and timers 9 0 4 Series a
75. 1 Revision B etc 5 7 The 1775 S5 and 1775 SR5 series A 0 Series A appear as series C modules 1 Series B etc 10 all Not used Not used 11 14 all The physical address of the unused The physical address corresponding to the logical address word of PLC 3 system memory E60 0 0 0 This is the last word to read or write in an upload or download 15 18 all The total number of words in the PLC 3 system memory both used and unused Publication 1770 6 5 16 October 1996 10 14 Diagnostic Status Information 1779 KP5 Status Bytes Bytes Bits Contents Description 1 all 00 Not used 2 all Interface Type and Processor Type EE see expansion bytes bytes 3 and 4 3 all Interface Type Expansion Byte 1A 1779 KP5 4 all Processor Type Expansion Byte 17 DH information 5 6 all 00 Not used 7 8 all Address of Active Node Table byte 7 low byte byte 8 high byte 9 10 all Diagnostic Counter Address byte 9 low byte byte 10 high byte 11 0 4 1779 KP5 Revision and Series Level 0 Revision A 1 Revision B etc 5 7 0 Series A 1 Series B etc 12 0 3 Option Switches SW 5 Data Highway Plus Baud Rate 2 230 Kb 4 115 Kb 6 57 6 Kb 4 7 SW 4 Transmit Route Updates 0 Do not transmit route updates 3 transmit route updates Publication 1770 6 5 16 October 1996 Diagnostic Status Informatio
76. 1 KA2 and the industrial terminal when you send an enter download upload mode the industrial terminal port is disabled until you send an exit download upload mode When the industrial terminal port is disabled the industrial terminal enters the mode select state To leave this state you must manually select a mode at the industrial terminal If you are using 1771 KA A revision F 1771 KG A enter download mode before sending physical read commands 1771 KA2 B 1771 KG B or later enter upload mode before sending physical read commands Publication 1770 6 5 16 October 1996 7 10 Communication Commands enter upload mode Puts the PLC 2 processor in Upload mode Use this command on a PLC 2 node before sending a physical read to the node e PLC 2 c pst src CMD FNC 07 STS TNS 06 R SRC DST oe STS TNS Important When you send an enter upload mode the industrial terminal port is disabled until you send an exit download upload mode exit download upload mode Takes the PLC 2 processor out of the Upload or Download mode Use this command to restart the PLC 2 processor after performing an upload or download operation e PLC 2 Important Do not send this command after a download upload command you must recycle power to the 1771 KA KA2 KG or 1785 KA3 module to enable indu
77. 100 68 FS 1C 00011100 28 E 45 01000101 69 GS 1D 00011101 29 F 46 01000110 70 RS 1E 00011110 30 G 47 01000111 71 US 1F 00011111 31 H 48 01001000 72 SP 20 00100000 32 l 49 01001001 73 21 00100001 33 J 4A 01001010 74 22 00100010 34 K 4B 01001011 75 23 00100011 35 L 4C 01001101 76 24 00100100 36 M 4D 01001101 77 25 00100101 37 N 4E 01001110 78 amp 26 00100110 38 0 4F 01001111 79 27 00100111 39 P 50 01010000 80 28 00101000 40 Q 51 01010001 81 Publication 1770 6 5 16 July 1996 15 2 ASCII Codes ASCII Hex Binary Decimal R 52 01010010 82 S 53 01010011 83 T 54 01010100 84 U 55 01010101 85 V 56 01010110 86 Ww 57 01010111 87 X 58 01011000 88 Y 59 01011001 89 Z 5A 01011010 90 5B 01011011 91 5C 01011100 92 5D 01011101 93 5E 01011110 94 E 5F 010111111 95 60 01100000 96 a 61 01100001 97 b 62 01100010 98 c 63 01100011 99 d 64 01100100 100 e 65 01100101 101 f 66 01100110 102 g 67 01100111 103 h 68 01101000 104 i 69 01101001 105 j 6A 01101010 106 k 6B 01101011 107 6C 01101100 108 m 6D 01101101 109 m 6E 01101110 110 0 6F 01101111 111 p 70 01110000 112 q 71 01110001 113 r 72 01110010 114 s 73 01110011 115 t 74 01110100 116 u 75 01110101 11
78. 12 8 PLC 5 15 series B rev F and later and other PLC 5 12 10 Series B rev E and earlier 12 9 Driver before you begin writing P 1 DST 6 4 definition 6 3 Duplicate message detection 6 3 ati ing D Index 1 3 E Error codes 1 11 returned by local node 1 11 EXT STS 6 6 EXT STS byte EXT STS byte 8 3 EXT STS codes for command code OF 8 4 Extended addressing _13 5 F Flag byte 7 28 floating master desciption 1 3 FNC 6 5 definition 6 3 Full duplex description 2 4 transmission symbols 2 6 two way simultaneous operation 4 2 Full duplex line monitor examples PLC 2 14 3 PLC 3 14 6 Full duplex protocol diagrams 4 10 packet format 5 3 H Half duplex line monitoring 14 1 master polling responsibilities 3 7 master transceiver 3 6 Master slave 3 3 message characteristics 3 7 message packet formats 5 2 protocol diagrams 3 11 slave transceiver actions 3 9 Half duplex protocol communication chacteristics _2 2 description 2 2 M Hexadecimal 11 4 L Link layer packets 5 2 link protocol definition 2 2 Local error 8 2 local node definition of _P 3 local STS error codes 8 2 Index Manual purpose P 1 who should read P 1 Master 2 3 Master packet 5 2 Message priority 1 10 reply 1 9 Message bytes data bytes 1 9 message bytes protocol bytes 1 9 Message packet format command and reply 6 3
79. 1770 6 5 16 October 1996 3 10 Using Half duplex Protocols to Send and Receive Messages Verifies DLE ETX BCC CRC Performs duplicate detection Receives a poll Publication 1770 6 5 16 October 1996 If any control symbol other than a DLE ETX BCC CRC is received at the end of the packet the message is discarded and all input is ignored until the next DLE SOH or DLE ENQ is received When the DLE ETX BCC CRC is received the error flag the BCC CRC the message size and the address optionally are all verified lf DLE ETX BCC CRC content is Then the incorrect message is ignored slave begins the duplicate message detection correct process The slave compares the SRC CMD and both TNS bytes to the corresponding bytes of the previous message Ifthese bytes are Then the slave the same discards the current message and sends a DLE ACK tests the state of the message sink e If the message sink is full the transceiver discards the current message and does not respond e If the message sink is not full the transceiver e forwards the current link level data to the message sink e keeps a copy of the first four bytes of the current link level data for duplicate message detection e sends a DLE ACK different If while waiting for a message a poll DLE ENQ STN BCC is received the transceiver accepts the next two characters The last character is a BCC and is not byte stuffed If the station address does not match or ther
80. 1771 KC DH 9 16 9 18 1771 KE KF DH 9 8 1771 KG KGM DH 9 19 1771 KA 1771 KA2 and 1774 KA DH Diagnostic Counters This counter byte 0 Counts the number of Times CRC was in error on an ACK 1 Times the sender timed out waiting for an acknowledgement Common error that occurs with error reflections or noise on the link sensitive to problems on longer cables It also shows up if the receiver or transmitter circuitry on a module is marginal or if cable connections are loose Times contention was detected This appears quickly on noisy or long cables This counter corresponds to error 93 If 93 is a common error on your link expect 37 start bit timeout errors also since any reply that experiences contention is not re tried Times the ACK was successfully received but contained a non zero status code other than memory full Only other implemented ACK code is buffer overflow This condition should never occur except when debugging new code Times the link driver returns a message to sender Each count corresponds to one local error bit set or one reply message lost Times the receiving node s memory was full Each time this happens the message is placed on a waiting queue for 0 5s Each message is re tried five times for memory overflow before it is returned to sender Times this node grabbed mastership of the DH link because it timed out while waiting to hear a valid frame On a link that
81. 3 Replies could not be sent 34 Active nodes Publication 1770 6 5 16 October 1996 9 12 Diagnostic Counters Publication 1770 6 5 16 October 1996 This counter byte Counts the number of 35 36 Times node attempted to send a message 37 38 Messages that were successfully transmitted and ACKed 39 40 ACKs that were received 41 ACKs successfully passed from the receiver s separator to the transmitter 42 NAKs received 43 NAKs passed from the separator to the transmitter 44 Timeouts waiting for a response 45 ENQs sent 46 Messages that could not be successfully sent 47 Reply messages that could not be forwarded and were destroyed 48 49 Messages received 50 51 ACKs sent 52 NAKs sent 53 ENQs received 54 Re transmissions received and ACKed Are transmission is a message that has a transaction TNS word command CMD and source SRC that match the previous message 55 STX full duplex mode or SOH half duplex mode received This is a count of the number of messages that were started 56 Messages characters or message fragments that were ignored 57 Messages that were aborted by receipt of a DLE ENQ 58 Messages that were aborted by the receipt of an unexpected control code other than DLE ENQ 59 DLE ACK response was sent but there was no buffer space for the next message 60 DLE NAK was sent because there w
82. 40 bytes Size the number of bytes to read up to 240 must be an even number A extended status byte if there is an error Otherwise it will be data at physical address first word low byte read diagnostic counters Reads up to 244 bytes of data from the PROM or RAM of an interface module Use this command to read a module s diagnostic timers and counters You must use diagnostic status to obtain the starting address of the diagnostic counters except for the PLC 5 PLC 5 250 and SLC 500 processors PLC 5 and PLC 5 250 processors don t require that this address be specified though you must include a dummy value in the ADDR field which the PLC 5 or PLC 5 250 processor ignores For SLC 500 processors zero is the only valid value for the ADDR field For listings of read diagnostic counters status information see Chapter 10 Diagnostic Status Information C pst SRC ie sts NS m ADDR SIZE R SRC DST pa sTs TNS Data max 244 bytes Publication 1770 6 5 16 October 1996 7 20 Communication Commands e SLC 500 e SLC 5 03 e SLC 5 04 Channel 0 configured for DH485 e PLC 5 e PLC 5 VME Publication 1770 6 5 16 October 1996 read link parameters Reads the DH485 parameter Maximum Solicit Address This parameter specifies the maximum node address that a DH485 node tries to solici
83. 5 2 Data link Layer Message Frames Half duplex Protocol Message Frames Half duplex protocol uses three types of transmissions e polling frame e master message frame e slave message frame The master node transmits both polling frames and master message frames and slave nodes transmit slave message frames The following figure illustrates the formats of these frames The slave message frame has the same format as the full duplex message frame The master message frame is the same as the slave message frame except that it is prefixed with DLE SOH and an address to specify a slave station address STN Important Even if you set your module to use CRC when you send a polling frame it uses a single BCC byte Polling Frame DLE ENQ STN BCC Master Message Frame From common application routines Data BCC DLE SOH STN DLE STX DST SRC CMD STS TNS command data DLE ETX CRC Slave Message Frame Data BCC DLE STX DST SRC CMD STS TNS command data DLE ETX CRC Aea he fe rrie Ne GEen ATI Sly ee E a panty SS E a A ees E Sy ey Eten oes oe A From common application routines The BCC field contains the 2 s complement of the 8 bit sum module 256 arithmetic sum of the slave station address STN and all the data bytes in the frame For polling frames the BCC is simply
84. 7 V 76 01110110 118 w 77 01110111 119 X 78 01111000 120 y 79 01111001 121 Z 7A 01111010 122 7B 01111011 123 7C 01111100 124 7D 01111101 125 Publication 1770 6 5 16 July 1996 ASCII Hex Binary Decimal 5 7E 01111110 126 DEL 7F 01111111 127 80 10000000 128 81 10000001 129 82 10000010 130 83 10000011 131 84 10000100 132 85 10000101 133 86 10000110 134 87 10000111 135 88 10001000 136 89 10001001 137 8A 10001010 138 8B 10001011 139 8C 10001100 140 8D 10001101 141 8E 10001110 142 8F 10001111 143 90 10010000 145 91 10010001 146 92 10010010 147 93 10010011 148 94 10010100 149 95 10010101 150 96 10010110 151 97 10010111 152 98 10011000 153 99 10011001 154 9A 10011010 155 9B 10011011 156 9C 10011100 157 9D 10011101 158 9E 10011110 159 9F 10011111 160 Al 10100001 161 A2 10100010 162 A3 10100011 163 A4 10100100 164 A5 10100101 165 A6 10100110 166 A7 10100111 167 A8 10101000 168 A9 10101001 169 AA 10101010 170 AB 10101011 171 ASCII Codes 15 3 ASCII Hex Binary Decimal ASCII Hex Binary Decimal AC 10101100 172 D9 11011001 217 AD 10101101 173 DA 11011010 218 AE 10101110 174 DB 11011011 219 AF 10101111 175 DC 11011100 220 BO 10110000 176 DD 11011101 221
85. Alternatively this code can also mean that the PLC 2 processor is not in Program or Remote Program mode 80 Execution of protected commands at the PLC 2 processor is inhibited because its PROG light is on The error sets the remote error bit for the associated rung Publication 1770 6 5 16 October 1996 Command diagnostic read Message Packet Status Codes STS EXT STS Remote STS and EXT STS Codes from a PLC 3 Processor A PLC 3 interface module 1775 KA S5 SR5 inserts the reply error code in the STS byte of any reply message packet it returns to a remote node your computer The meaning of each error code depends on the command message received from the computer The following pages describe the error conditions that the various commands can generate The error codes are listed according to the decimal value that is stored at the computer When a remote node transmits one of these commands the local PLC 3 interface module may issue a reply message that contains one of the error codes listed under that command Error codes contained in the EXT STS bytes are only available if either another PLC 3 or computer originates the command message EXT STS Code STS Code 10 Explanation e A two byte ADDR field and a one byte SIZE field are missing after the FNC byte in the command message The number of bytes of data requested in the SIZE field is greater than the maximum number allowed per reply packet 244
86. BCC is D246 This is sometimes referred to as double stuffing DLEs Important If your BBC check sum is 10 hex send it as 10 and not 10 10 That is a BCC is not treated like data Publication 1770 6 5 16 October 1996 5 6 Data link Layer Message Frames Publication 1770 6 5 16 October 1996 CRC Field For these protocols You calculate the CRC value full duplex using the value of the link layer data bytes and the ETX byte half duplex efor master messages using the value of the link layer data bytes and the STN STX and ETX bytes efor slave messages using the value of the link layer data bytes and the ETX byte The polynomial for a CRC value is X18 X15 X2 4 X0 Do not add in the associated DLE for STX and ETX values Important To transmit the data value of 1016 you must use the data symbol DLE DLE However only one of these DLE bytes is included in the CRC value Embedded responses are not included in the CRC value The following explains the transmission of the CRC value 1 At the start of a message frame the transmitter clears a 16 bit register used for the CRC value As a byte is transmitted it is exclusive ORed least significant bit to the right with the right eight bits of the CRC register The result is placed in the right eight bits of the CRC register The CRC register is then shifted right eight times by inserting Os on the left Each time a 1 is
87. C DHFlink SC be H E i ii z po Ly ee 1770 KF2 SLC 5 04 processor l q LJ RS 232 C link l e j 50 cable ft max i Weeks T53 programming T60 industrial industrial SC terminal with 1784 KT ann workstation with Dinin installed or any other PLC 2 CT ControlView software e processor Publication 1770 6 5 16 October 1996 1 6 Network Layers T53 programming terminal with a DH485 Link A DH485 link is a low cost peer to peer programming and data acquisition link for a variety of Allen Bradley products DH485 topology is similar to DH and DH topology You can connect as many as 32 nodes to a DH485 link The DH485 link is based on the Electrical Industries Association EIA Standard RS 485 Electrical Signalling Specification A variety of Allen Bradley products including SLC 500 controllers 1784 KTX 1747 KE 1770 KF3 and operator interface devices act as token passing masters on the DH485 link This link also supports a respond only mode for low level devices on the link such as Allen Bradley bar code decoders A DH485 link implements peer to peer communication with a token passing scheme to rotate link mastership among the nodes connected to that link
88. CD toggled off and on 24 25 Lost modem field times modem has been disconnected 26 27 Priority station poll list maximum scan time 100 ms increments 1761 Cat Nos Diagnostic Counters 9 7 Cat Nos 1761 Li6AWA L16BBB L16BWB L32AWA L32BWA L32BWB DF1 9 7 1761 L16AWA L16BBB L16BWB L32AWA L32BWA L32BWB MicroLogix 1000 processors Series C or later DH485 Diagnostic Counters This counter byte Counts the number of Total message packets received low byte Total message packets received high byte Total message packets sent low byte Total message packets sent high byte Message packet retries Retry limit exceeded NAK no memory sent NAK no memory received Total bad message packets received Reserved Ol O N OD an AI ao rm oOo 1761 L16AWA L16BBB L16BWB L32AWA L32BWA L32BWB MicroLogix 1000 processors DF1 Diagnostic Counters This counter byte Counts the number of 0 1 Unused 2 3 Message packets sent 4 5 Message packets received 6 7 Messages undelivered 8 9 ENQ packets sent 10 11 NAK packets received 12 13 ENQ packets received 14 15 Bad message packets received NAKed 16 17 Out of memory NAKed 18 19 Duplicate message packets 20 21 Framing errors detected 22 23 Unused 24 25 Unused Publication 1770 6 5 16 October 1996 9 8 Diagnostic Counters 1770 Cat Nos Publication 1770 6 5 16
89. In our example the message is successful status code 00 hex For a list of status codes see Chapter 8 Message Packet Status Codes STS EXT STS TNS transaction 01 00 Indicates a specific transaction value for each message The TNS value for the reply message is the same 2 bytes as the TNS value for the command message This allows the computer to keep track of commands and their associated replies DATA FF FF In our example the computer reads two actual bytes of data from the PLC 2 30 data table octal word 011 These bytes of data are FF FF hex 1111 1111 1111 1111 binary This indicates that all 16 bits at octal word 011 are set on DLE ETX 2 10 03 Indicates the termination of the reply message bytes BCC block check AD Used to check the accuracy of the message transmission You can optionally use CRC bytes here character The BCC value must equal the 2 s compliment of the 8 bit sum of all data bytes between DLE STX and DLE ETX For more information on BCC and CRC error checking see page 5 4 DLE ACK 10 06 Sent from the computer back to the module 1770 KF2 to indicate that the computer successfully received the message If the BCC value calculated by the module does not match the BCC value in the message packet the module sends a DLE NAK 10 15 hex instead of the DLE ACK hex If the module does not receive a DLE ACK or DLE NAK from the computer within approximately one second 1771 KE KF KG only it sends
90. In this example the CMD byte has the value 01 hex which indicates an unprotected read of the PLC 2 30 data table STS 00 Indicates the status of the message A command message should always set this field to 00 hex TNS transaction 01 00 2 bytes Indicates a specific transaction value for each message The TNS value increments for each message packet This value makes each message uniquely different which helps you check for duplicate message packets ADDR address 11 00 2 bytes Specifies the PLC 2 data table address where the unprotected read starts The combination of these two bytes points to a byte address Since the PLC 2 works in word 2 byte increments the address should specify an even number of bytes The address must be transferred low byte first In our example the address 11 00 hex low byte first equals 000 022 octal byte address or 000 011 octal word address SIZE 02 Specifies how many bytes of PLC 2 data table information you read in this transaction DLE ETX 2 bytes 1003 Indicates the termination of the message BCC block check E2 character Used to check the accuracy of the message transmission You can optionally use CRC bytes here The BCC value must equal the 2 s compliment of the 8 bit sum of all data bytes between DLE STX and DLE ETX For more information on BCC and CRC error checking see page 5 4 DLE ACK 10 06 Sent from the module 1770 KF2 back to the
91. MP sts ms 7 Size Tag Offset Type R src pst OMPI sts Ns DATA 7 a Offset is the word offset into the file low byte then high byte Size is the size of data to read For this processor MicroLogix 1000 SLC 500 SLC 5 01 SLC 5 02 Valid range for Size in bytes 0 248 0 96 0 225 with internet protocol 0 236 without internet protocol SLC 5 03 SLC 5 04 protected typed file write Writes data to an open file in a MicroLogix 1000 or an SLC processor For MicroLogix 1000 processors this command can be used to update the Terminal ID by writing two bytes To do this size 02h the tag 4176 the offset 0000 the file type 90 and the two bytes of data contain the terminal ID low byte first FNC File pst src CMP sts TNs ae Size Tag Offset type Data CMD EXT sac pst M sts TNs EX Offset is the word offset into the file low byte then high byte Size is the size of data to read For this processor Valid range for Size in bytes MicroLogix 1000 0 241 SLC 500 SLC 5 01 SLC 5 02 0 89 0 218 with internet protocol SLC 5 03 SLC 5 04 0 229 without internet protocol e SLC 500 e SLC 5 03 e SLC 5 04 Communication Commands 7 17 protected typed logical read with three address fields Reads data from a logical address in a SLC 500 module
92. Message packet formats 7 1 Message packets how they are sent 1 9 Message priority high 1 10 how to specify 1 10 normal 1 10 Message sink 3 3 Message source 3 3 Message transer poll with no message available 3 11 3 13 Message transfer duplicate message 3 11 3 15 message sink full 3 11 3 16 3 17 normal 3 12 4 10 poll with message returned 3 11 3 14 with ACK Destroyed 3 11 3 13 with invalid BCC 3 11 3 12 with message sink full 4 14 with message sink full on the reply 4 17 with NAK 4 11 with NAK on reply 4 15 with re transmission 4 13 with Timeout and ENQ 4 12 with timeout and ENQ for the reply 4 16 Messages command _1 9 Multidrop topology 2 3 network link definition 1 2 network s physical link 1 1 node definition of _P 3 Number systems 11 2 Numbering systems Binary 11 3 binary coded decimal _11 3 decimal 11 2 hexadecimal 11 4 octal 11 5 O Octal 11 5 Order of transmission 11 6 PCCCs apply port configuration 7 4 return edit resource 7 24 physical communication link 1 2 PLC definition of _P 3 PLC 2 commands enter download mode 7 9 enter upload mode _7 10 exit download upload mode _7 10 physical read 7 13 physical write 7 14 set data table size 7 24 PLC 3 commands bit write write bit 7 4 download request download privilege 7 8 file read read file 7 5 7 10 7 13 file write write file 7 11 restart
93. PDATA DLEDLE DLE EXT BCC In this case the sum of the data bytes is 2E hex because only one DLE byte is included in the BCC The BCC 2 s complement of 2E46 is D246 Data link Layer Message Frames 5 5 Full duplex protocol example If a message frame contained the data 08 09 06 00 02 04 and 03 decimal the message symbols are 10 02 08 09 06 00 02 04 03 10 03 E0 DLE STX APP DATA DLE ETX BCC The sum of the application data bytes in this message frame is 32 decimal or 20 hex The BCC is the 2 s complement of this sum or EO hex This is shown in the following binary calculation 00100000 2046 1101 1111 1 s compliment 1 11100000 2 s compliment E0 hex To quickly determine a BCC value add up the hex values of the application layer bytes If the total is greater than 100 hex drop the most significant digit Then subtract the result from 100 hex This gives you the BCC For example if the sum of the application layer bytes is 20 hex then 10046 2016 E016 Important To transmit the value 10 hex you must use the data symbol DLE DLE However only one of these DLE data bytes is included in the BCC sum For example to transmit the values 08 09 06 00 10 04 and 03 hex use the following message symbols 10 02 08 09 06 00 10 100403 10 03 D2 DLE STX APPDATA DLEDLE DLE EXT BCC In this case the sum of the application layer data bytes is 2E hex because only one DLE byte is included in the BCC So the
94. R TRANSMIT CRC_REGISTER as 2 byte CRC field Below is an actual frame that you can use to validate your CRC routine Use this frame to validate the CRC 10 02 07 11 41 00 53 B9 00 00 00 00 00 00 00 00 00 00 00 00 10 93 6B 4C Publication 1770 6 5 16 October 1996 Chapter 6 Application Layer Message Packets Read this chapter to help learn about the application layer for your asynchronous driver and the fields that your computer uses in the application layer of a message packet It contains these sections Section Page How Your Application Program Sends and Receives Messages 6 2 Message Packet Format 6 3 Publication 1770 6 5 16 October 1996 6 2 Application Layer Message Packets How Your Application Program Sends and Receives Messages Publication 1770 6 5 16 October 1996 There are two types of application programs e command initiators command executors This application program Sends command messages specify which command function to execute at a particular remote node Each command message requires one reply message The command initiator must check for error codes and depending on the type of error retransmit the message or notify the user The command initiator should also use a timer to be aware of lost reply messages due to noise or other factors If the time limit expires before the initiator receives the reply the initiator can retransmit or notify the user command i
95. T AF STS TNS a The EXT STS field may be attached to the reply packet only when there is an error upload Informs the interface module that it wants to perform an upload If the module grants the upload privilege the computer issues physical reads If another node already has the upload privilege the second node is denied the privilege CMD FNC C DST SRC OF STS TNS 06 CMD EXT R SRC DST AF STS TNS STS The EXT STS field may be attached to the reply packet only when there is an error word range read read block Reads a word or file starting at a specified address A special case of this command is a single word read where the number of bytes to read is only two bytes one word This command must always be an even number of bytes CMD FNC Packet Total DST SRC OF STS TNS 01 Offset Trans PLC sys address Size CMD Data max 244 bytes SRC DST 4p STS or 122 words The DATA field may be replaced by an EXT STS field if there is an error For this processor The starting address can be a word symbol file symbol plus a word offset or a block address The starting address must point to a word in a file logical binary address or a logical ASCII address of up to 51 bytes PLC 3 PLC 5 id Ie Y BT Of Communication Commands 7 35 word range write write block Writes to a word o
96. TNs FNC No of PLC 5 sys address Mask AND Mask OR Mask OF 79 Sets Length 2o0r4 2o0r4 je bytes re bytes Repeatable up to 243 bytes lt Repeated for ____ more sets Ly 5 If present CMD EXT SRC DST 4F STS TNS STS Reply The EXT STS field may be attached to the reply packet only when there is an error Reply includes low word low byte and low word high byte Optionally includes high word low byte and high word high byte The PLC 5 system address specifies the word that is modified Use more than one field to specify more than one word Must point to a word and can be either a logical binary address or a logical ASCII address Each PLC 5 system address field is followed by e Mask Length indicates the lengths of AND Mask and OR Masks e AND Mask specifies which bits in the word to reset 0 to reset a bit 1 to leave it the same e OR Mask specifies which bits in the word to set 1 to set a bit 0 to leave it the same These three fields along with the PLC 5 system address field can be repeated up to a length of 243 bytes Publication 1770 6 5 16 October 1996 7 22 Communication Commands e PLC 3 e PLC 5 read section size Reads the size of the section most fully addressed by the system address given The size represents the size of the memory addressed most fully expressed
97. TS TNS 68 Offset Trans PLC 5 sys address Sizo src ost MP sts ms a B Size number of elements to read from the specified system address A Type data parameter Used to specify e type of data you are writing or reading e size in bytes of each piece of data you are writing or reading B Data up to 240 bytes minus the number of bytes used in the type data parameter An EXT STS byte will replace A and B if there is an error The first byte of the type data parameter is the flag byte and has this format Flag Byte Bit 7 6 5 4 3 2 1 0 ID Size format ID value field format Size value tield field field l Data Type ID Data Type Size Data Type ID Bits 4 7 The following table contains a list of the types of data you can read and write and the ID value of each Communication Commands 7 29 Data Type Size Bits 0 3 If the data type defined in the ID Value field uses Then enter Data Type ID Type of Data 7 or fewer bytes for each piece of data zero 0 in bit 3 of the flag byte Enter the actual number of bytes used for each element of data in bits 0 1 and 2 Size Value Field bit bit string byte or character string integer Allen Bradley timer Allen Bradley counter Allen Bradley general control structure IEEE floating point array of similar elements address data binary coded decimal BCD
98. a DLE ENQ to see if re transmission is necessary Publication 1770 6 5 16 October 1996 14 6 Line Monitor Examples Full duplex PLC 3 Line Monitor Example In this example three word range reads CMD OF FNC 01 are sent e from a computer connected to a 1770 KF2 with DH node address 012 octal e tothe PLC 3 connected to a 1775 KA with DH node address 011 octal This example requires three commands and the corresponding replies to read 684 bytes of data from the PLC 3 processor The following describes the first command and reply fields only The fields of the second and third commands and their replies are the same except for the TNS PACKET OFFSET and BCC fields Command 1 DLE STX DST SRC CMD STS TNS Pathi 10 02 109 00 oF 00 02 00 Path 2 Reply 1 sometime later DLE STX DST SRC CMD STS TNS Pathi 10 02 oa 09 4F oo 02 00 Path 2 Command 2 DLE STX DST SRC CMD STS TNS Pathi 10 02 o9 00 oF 00 03 00 Path 2 Reply 2 sometime later DLE STX DST SRC CMD STS TNS Pathi 10 02 0A og 4F 00 03 00 Path 2 Command 3 DLE STX DST SRC CMD STS TNS Pathi 10 02 09 oo oF 00 04 00 Path 2 Reply 3 sometime later DLE STX DST SRC CMD STS TNS Path 1 10 02 0A 09 4F 00 04 00 Path 2 Publication 1770 6 5 16 October 1996 PACKET
99. ady downloading to the processor CMD FNC c osr sre i sts TNs E A peer 0 1 0 h I unused determine which operating mode is selected CMD R SRC DST AF STS TNS EXT STS or for some products remote lock The EXT STS field may be attached to the reply packet only when there is an error For this operating mode Ais Program Load processor idle I O disabled 00000000 Remote Test processor scanning I O disabled 00000001 Remote Run processor scanning I O enabled 00000010 No change only remote bit affected 00000011 Communication Commands 7 27 set timeout Sets the maximum amount of time that the asynchronous interface id i PLC 2 module waits for an acknowledgment to its message transmission j i PLC 3 The setting is expressed as the number of cycles of an internal clock E oe For example 40 cycles equals 1 second for the 1770 KF2 c CMD FNC DST SRC STS TNS og DATA R SRC DST are STS TNS See the following table for settings and defaults for the module you are setting Put the number of desired cycles in the DATA field DATA Module Cycles Sec Default 1770 KF2 40 128 cycles approx 3 sec 1771 KE KF 40 128 cycles approx 3 sec 1771 KG 38 38 cycles approx 1 sec 1771 KGM 63 63 cycles a
100. ages due to character with parity error M Bad messages due to character with framing error o Bad messages due to overrun error 14 Number of unexpected characters received If this counter is not zero it could indicate that an internal hardware problem has occurred This problem could be that the communication channel s receiver has been disabled but the DH485 driver is still receiving characters If the controller is operating properly this counter should remain at zero Publication 1770 6 5 16 October 1996 9 6 Diagnostic Counters Publication 1770 6 5 16 October 1996 1747 L541 L542 and L543 SLC 5 03 and SLC 5 04 processors DF1 Diagnostic Counters This counter byte Counts the number of RS 232 modem line status Bit 0 CTS input line status Bit 1 RTS output line status 0 1 eBit 2 DSR input line status eBit 3 DCD input line status eBit 4 DTR output line status 2 3 Total message packets sent 4 5 Total message packets received 6 7 Undelivered message packets 8 9 Message packets retried 10 11 Normal station poll list last scan time 100 ms increments 12 13 Normal station poll list maximum scan time 100 ms increments 14 15 Non response due to bad message packets detected 16 17 Unused 18 19 Duplicate message packets received 20 21 Priority station poll list last scan time 100 ms increments 22 23 DCD recovery field times D
101. an required The word specified by the PLC 3 address does not exist FO e Any of the DST words in the DST file do not exist eFor a file read the SRC and DST files are not the same size FO The file size decreased between packets of a multi packet transaction and became too small for the total transaction FO You tried to read or write past the end of a file FO Start bytes Publication 1770 6 5 16 October 1996 8 10 Message Packet Status Codes STS EXT STS Command PLC 3 bit write EXT STS Code STS Code Explanation r 10 More than four bytes of data exist after the PLC 3 address in the command message 30 The local PLC 3 interface module has executed a shutdown request 40 A backplane error memory parity timeout or disconnect has occurred 60 The keyswitch setting does not allow access to file 70 The local PLC 3 in the Program mode 1 FO There was an error in converting the block address major section gt 63 context gt 15 section gt 15 2 FO Three or fewer addressing levels specified for a PLC 3 word address 3 FO Conversion of a file address to a block address resulted in more than 9 addressing levels FO The symbolic address was not found FO The symbolic address is zero or more than eight bytes 6 FO eFile not found eThe DST address does not specify a PLC 3 word The PLC 3 address specifies more l
102. and the message buffer are reset and the receiver starts building a reply message While building a reply message all data symbols are stored in the message buffer and added to the BCC CRC If the buffer overflows the receiver continues summing the BCC CRC but the data is discarded If a parity overrun framing or modem handshaking error is detected it is recorded If a control symbol other than DLE STX or DLE ETX is received the message is aborted and a DLE NAK is sent to the transmitter When DLE STX or DLE ETX is received the error flag the BCC CRC the message size and the address optionally are all checked If any of the tests fail a DLE NAK is sent GET CHAR is defined as an implementation dependant function that returns one byte of data from the link interface hardware Publication 1770 6 5 16 October 1996 The following program describes the actions of the receiver in detail RECEIVER is defined as variables LAST HEADER is 4 bytes copied out of the last good message RESPONSE is the value of the last ACK or NAK sent BCC is an 8 bit block check accumulator LAST HEADER invalid LAST RESPONSE NAK loop reset parity error flag GET SYMBOL if DLE STX then begin BCC 0 GET SYMBOL while it is a data symbol begin if buffer is not overflowed put data in buffer GET SYMBOL end if the control symbol is not a DLE ETX then send DLE NAK else if error flag is set then send DLE NAK else if BCC is not zer
103. application layer e0 to 376 octal for DF1 destination e0 to 376 octal for DH SRC z F e0 to 77 octal for DH source sending message data link layer e0 to 31 decimal for DH485 When sending messages from asynchronous devices special consideration must be given to the SRC byte When sending a message from an asynchronous device connected Serine Sten 0 the module will set the byte to its own node number directly to a 1771 KG 10 octal Ifyou connect to channel 0 of a PLC 5 11 5 20 5 30 5 40 5 60 or 5 80 processor and you send a PLC 2 unprotected write protected write protected bit write or unprotected bit write what you put into the SRC byte is very important This determines the compatibility file This means that the value of the SRC byte specifies the data table file number that is written to the PLC 5 processor The source byte will not be overwritten by channel 0 For SLC 500 processors the compatibility file is always 9 to the network Publication 1770 6 5 16 October 1996 Application Layer Message Packets 6 5 CMD and FNC These bytes work together to define the activity that is to be performed by the command message at the destination node Values for these bytes are supplied by the application layer The message format depends on the CMD and FNC values CMD byte Bit 7 6 5 4 3210 0 ae Priority 0 Command 4 t A 4 always 0 always 0 command code
104. as no buffer 61 Broadcast messages received 62 Broadcast messages that were successfully received 63 Messages seen that were not for this node 64 DLE EOTs sent 65 Calls received 66 Times the phone was hung up by the module 67 Times DCD was lost 68 Times the phone was hung up because of a DCD timeout Diagnostic Counters 9 13 1770 KFC DF1 Diagnostic Counters This counter byte Counts the number of Total DF1 packets received low byte Total DF1 packets received high byte Total DF1 packets transmitted low byte Total DF1 packets transmitted high byte Number of DF1 retries Number of DF1 packets where the retry limit was exceeded Number of DF1 NAKs sent CO NI DD Cy A Co PO Number of DF1 NAKs received co Number of DF1 bad messages received oO Number of RS 232 line errors _ Total good ControlNet packets received low byte k M Total good ControlNet packets received high byte o Total bad ControlNet packets received low byte A Total bad ControlNet packets received high byte ol Total ControlNet packets transmitted low byte oa Total ControlNet packets transmitted high byte Publication 1770 6 5 16 October 1996 9 14 Diagnostic Counters 1771 Cat Nos Publication 1770 6 5 16 October 1996 Cat Nos Link Pages 1771 KA 1771 KA2 and 1774 KA DH 9 14 9 15
105. ata or file is too large A Transaction size plus word address is too large B Access denied improper privilege C Condition cannot be generated resource is not available D Condition already exists resource is already available E Command cannot be executed F Histogram overflow 10 No access 11 Illegal data type 12 Invalid parameter or invalid data 13 Address reference exists to deleted area 14 Command execution failure for unknown reason possible PLC 3 histogram overflow 15 Data conversion error 16 Scanner not able to communicate with 1771 rack adapter 17 Type mismatch 18 1771 module response was not valid 19 Duplicated label 22 Remote rack fault 33 Timeout These codes are for passthru froma DH link to a remote I O link 24 Unknown error 1A File is open another node owns it 1B Another node is the program owner 1C Reserved 1D Reserved 1E Data table element protection violation 1F Temporary internal problem Remote STS and EXT STS Codes Message Packet Status Codes STS EXT STS 8 5 DH485 EXT STS Codes Hex Code Explanation 07H Insufficient memory module size 0000h is returned OBH Access denied privilege violation OCH Resource not available or can not do OEH CMD can not be executed 12H Invalid parameter 14H Failure during processing 19H Duplicate label 1AH File open by another node owner s local node address 1 byte 1BH Program owned by another node pro
106. ate communication This chapter includes these sections Section Page DF1 Protocol 2 2 Character Transmission 2 5 Transmission Symbols 2 6 Important The 1784 KT and 1784 KT2 cards connect directly to DH the 1784 KR card connects directly to DH 485 As a result an asynchronous RS 232 interface is not used and the information in this chapter does not apply to software written for these cards which use the Standard Driver software Publication 1770 6 5 16 October 1996 2 2 Understanding DF1 Protocol DFi Protocol Publication 1770 6 5 16 October 1996 A link protocol is a set of programming rules for interpreting the signals transmitted over a physical link A protocol such as DF1 carries a message error free from one end of the link to the other It has no concern for the content of the message the function of the message or the ultimate purpose of the message For example with full duplex DF1 protocol it accomplishes this by attaching a check character BCC or check characters CRC to the end of each command and reply The device receiving the command or reply then verifies the BCC or CRC and returns an ACK if the BCC or CRC is acceptable or an NAK f the BCC or CRC does not check e indicates failure with an error code Internally the link protocol must delimit messages detect and signal errors retry after errors and control message flow DF1 protocol is an Allen Bradley data link layer pro
107. atus of modem connection 1 lost Bits 6 7 reserved e1 Bits 8 11 mode of serial port 0000 system 0001 1 user Bits 12 14 reserved set to 0 Bit 15 input buffer overflow user mode only More than 256 characters have been received before the execution of an ASCII read instruction 2 3 Messages sent indicating retries 4 5 Messages received with proper BCC or CRC 6 7 Undelivered messages 8 9 ENQs sent For this protocol This is the number of full duplex ENQs sent half duplex message retries 10 11 NAKs received 12 13 ENQs received 14 15 Bad packets received packets received with incorrect BCC or CRC 16 17 NAKs sent 18 19 Duplicate messages received 20 21 Received errors user mode only Number of characters thrown away due to parity overflow and framing errors 22 23 Number of times DCD went low and then high DCD recovered 24 25 Number of times modem connection was lost Publication 1770 6 5 16 October 1996 9 32 Diagnostic Counters Publication 1770 6 5 16 October 1996 1785 L20E L40E L40L L60L L80E DH Diagnostic Counters This counter byte Counts the number of 0 ACK timeouts 1 NAKs due to no memory received 2 Claim tokens 3 NAKs due to no memory sent 4 CRC errors 5 Duplicate packets 6 Token timeouts 7 Retries 8 9 Messages sent high byt
108. blication 1770 6 5 16 October 1996 Diagnostic Status Information 10 23 Bytes Bits Contents Description 19 all Debug mode 0 OFF 0 ON 20 21 all Hold point file used if Debug mode is ON Low byte first 22 23 all Hold point element used if Debug mode is ON Low byte first 24 25 all Edit time stamp seconds Low byte first 26 27 all Edit time stamp minute Low byte first 28 29 all Edit time stamp hour Low byte first 30 31 all Edit time stamp day Low byte first 32 33 all Edit time stamp month Low byte first 34 35 all Edit time stamp year Low byte first 36 all Port number this command received on 5130 Cat Nos For status information from these cat nos See page 5130 RM1 RM2 PLC 5 250 controllers 10 23 5130 RM1 RM2 PLC 5 250 Status Bytes Bytes Bits Contents Description 1 0 2 Operating status of 0 Program load PLC 5 250 processor 1 Not used 2 Run mode 3 Not used 4 Remote program load 5 Remote test 6 Remote run 7 Not used 3 0 Normal 1 Major processor fault 4 0 Normal 1 Download mode 5 0 Normal 1 Off line 6 0 Not testing edits 1 Testing edits 7 0 No edits in processor 1 Edits in processor 2 0 3 Processor Type OE expansion byte 4 7 DO PLC 5 250 3 all ID 4 0 Forces active if 1 1 Backup system active if 1 2 Partner system acti
109. bly of messages Provides recovery from transmission errors Network layer establishes connections for communication between network nodes Data link layer runs protocol to guard against errors detects errors and corrects errors Packages data and puts it onto the physical cable Manages the flow of the data bit stream into and out of each network node Physical layer transmits bits between communication devices In this chapter we discuss the physical data link and application layers We refer to the data link and application layers as the software layers This chapter contains these sections Section Page Physical Layer 1 2 Software Layers 1 7 Message Packet Structure 1 9 Publication 1770 6 5 16 October 1996 Network Layers Physical Layer mim C0 DF1 link I network link i I IBM PC XT AT or compatible computer RS 232 Network Interface DH DH DH485 link i i ControlNet y yik Publication 1770 6 5 16 October 1996 The physical layer is a set of cables and interface modules that provides a channel for communication between the nodes A node is a connection point onto a network typically containing a unique address When you connect a computer serially to your DH DH DH 485 or ControlNet link the interface module acts as an interface between the e DF1 link RS 232 or RS 422 A e network link DH DH DH485 Cont
110. cation 1770 6 5 16 October 1996 The type data parameter is a variable length field The most significant bit of each nibble determines additional bytes used The value of this field can be extended to a 7 byte unsigned integer The bytes are ordered least to most significant All zero most significant bytes are permitted but the fields generated by them are no different than those that omit these insignificant bytes The following three descriptors are all permitted and equivalent Important Your software must be able to handle all three cases Case 1 Case 2 Case 3 0100 0011 0100 1001 0100 1010 0000 0011 0100 0011 0000 0011 0000 0000 These all have an ID value of 4 and a size value of 3 Example 1 Type data parameter for writing or reading integer data This example shows the type data parameter for writing or reading integer ID 4 data with each element of data 2 bytes long 0 1 0 0 0 0 1 0 flag byte type ID data size type ID contained data size contained in bits 6 5 4 in bits 2 1 0 Communication Commands 7 37 Example 2 Type data parameter for writing or reading integer data This example shows the type data parameter for reading an array ID 9 The array data type includes an additional byte called the descriptor byte located after the ID byte The descriptor byte is a second flag byte which describes the type of data in the array You include the descriptor byt
111. cation layer protocol 6 1 Application program how it sends and receives messages 6 2 Apply port configuration 7 4 ASCII codes _15 1 numerical values _15 1 Asynchronous link description of 1 2 asynchronous link definition _1 2 Asynchronous link status code STS byte 8 2 Asynchronous link status codes 8 1 Basic command set diagnostic counters reset _7 22 Diagnostic loop 7 8 Diagnostic read 7 12 7 19 diagnostic status 7 6 protected bit write 7 15 protected write 7 16 7 19 Set ENQs 7 25 set NAKs 7 25 set timeout 7 27 set variables 7 27 unprotected bit write 7 30 unprotected read 7 31 Basice command set unprotected write 7 32 Binary 11 3 Binary coded decimal 11 3 Block check character determining the value of 5 5 c Character transmission _2 5 CMD 6 5 byte format 6 5 6 6 6 7 definition 6 3 Command and reply 1 9 Command executers 6 2 Command initiators 6 2 Commands delivery order 1 10 types 1 11 Comparable memory segments 7 33 counters 9 1 Cyclic redundacy check CRC 5 6 D Dat Highway Plus diagnostic counters PLC 5 9 32 DATA definition 6 3 Data bytes description of 1 9 Data encoding 11 1 Data Highway baud rate 1 3 description 1 3 floating master 1 3 node limit 1 3 trunkline limit 1 3 Data Highway diagnostic counters 1770 KF2 9 8 1771 KA 9 14 1771 KA2 9 14 1771 KC 9 16 1771 KE KF 9 8 1771 KG 9 19 1771 KGM
112. cc eee eee 10 14 1784 Cat NOS ecrin a en a a mentation ef eu ees 10 15 1784 KR Status Bytes 0 0 00 ccc eee 10 15 1784 KT KT2 Status Bytes 0 10 15 1785 Cat NOS cse pri tka dea aaa e e e E E a 10 16 1785 KA Status Bytes 0 00 cece eee 10 16 1785 KA5 Status Bytes 0 0 cece eee eee 10 17 1785 KA3 Status Bytes 00 0 cece eee ee 10 17 1785 KE Status Bytes 0 00 cece eee ee 10 19 Table of Contents 1785 LT PLC 5 15 and 6008 LTV PLC 5 VME Stat s BYES 2 ace aoe tasdan ppr Oer I Onat 1785 LT3 PLC 5 12 and 1785 LT2 PLC 5 25 Status Bytes nunnana 1785 L11B L20B L20E L30B L40B L40E L40L L60B L60L Status Bytes 5130 Cat NOS 6 000 cet es a nna d e a a tied eai 5130 RM1 RM2 PLC 5 250 Status Bytes Data Encoding 2 00 eee eee eee een eens Numbering Systems 0 000 eee eee eee eee D cima ceire toros weRhoudayns PVRs ieee eee Y Decimal Representation Number 239 Binay skp c cade kaka Oh Se Kd ek ae Ss eee ee eee Binary Representation Number 239 Binary Coded Decimal 0000 c ee eeeeee BCD Representation of Decimal 239 Hexadecimal sos koh sudee ed Send eka sieSecde sy Hexadecimal Representation of Decimal 423 Octal s 2etsue Sater cebe ted Sen pa eee eee Octal Representation of Decimal 239 Binary Floatin
113. command message 0 normal priority 0 reply message 1 high priority 10 High priority only applies to DH links It does not apply to DH DH485 or DHII links This byte Defines the And has these values CMD command type sa see table that begins on ie specific function under that command type page 7 2 function Example code PLC 2 command enter download mode send 00000111 07 hex reply 01000111 47 hex high priority send DH only 00100111 27 hex high priority reply DH only 01100111 67 hex Publication 1770 6 5 16 October 1996 6 6 Application Layer Message Packets STS and EXT STS These bytes work together to indicate the status of the message transmission This byte In this message Has this value command The application program sets 0 STS i 0 when the command has executed with no status reply error one of the status codes listed in Chapter 8 EXT STS reni Message Packet Status Codes STS EXT extended status pY STS This byte will also 0 if an error occurs EXT STS is part of the message only if STS FO Four high bits of STS byte all 1 F0 hex EXT STS byte STS byte 7654 32 10 no EXT STS byte a 4 1 Application layer uses these bits and in some cases the EXT STS byte Link layer uses these bits to report local errors errors that occur to report remote errors errors that occur when t
114. d 13 Bad CRC in received frame 14 NAKs illegal protocol operation sent 15 NAKs bad LSAP sent 16 NAKs no memory sent 17 Received frames that were too short 18 Received frames that were too long 19 Times received a retransmission of a frame 20 Received frames aborted line noise 21 22 Messages successfully sent low byte first 23 24 Messages successfully received low byte first 25 26 Commands successfully sent low byte first 27 28 Replies successfully received low byte first 29 20 Commands successfully received low byte first 31 32 Replies successfully sent low byte first 33 Replies that could not be sent 34 Number of active nodes Diagnostic Counters 9 25 1784 Cat Nos Cat Nos Link Pages 1784 KR DH485 9 3 1784 KT KT2 DH 9 25 1784 KT and 1784 KT2 DH Diagnostic Counters This counter byte Counts the number of Times received ACKs with a bad CRC Timeouts expired with no ACK received Transmit retries exhausted NAK or illegal protocol operations received NAKs bad LSAP received NAK no memory received Received ACKs NAKs that were too short Received ACKs NAKs that were too long Times something other than an ACK NAK received CO CO NI G1 AJ CO PS Duplicate tokens found oO Token pass timeouts kr Token pass retries exhausted N Claim token sequence entered se
115. d DSR to DTR You designate one node as master to control which node has access to the link All other nodes are slaves and must wait for permission from the master before transmitting Each slave node has a unique node number between 0 and 254 decimal The master can send and receive messages to and from each node on the multidrop link and to and from every node on network links connected to the multidrop link If the master is programmed to relay messages then nodes on the multidrop link can engage in virtual slave to slave communication This communication is transparent to the application Multiple masters are not allowed except when one acts as a backup to the other and does not communicate unless the primary is shut down Slave to slave communication In slave to slave communication the master looks at the packet received from the slave If the packet is not for the master the master reassembles the packet as a master packet and sends the packet to slave devices Publication 1770 6 5 16 October 1996 2 4 Understanding DF1 Protocol Publication 1770 6 5 16 October 1996 Full duplex Protocol Use full duplex protocol e over a point to point link that allows two way simultaneous transmission e over a multidrop link where interface modules are able to arbitrate transmission on the link e for high performance applications where it is necessary to get the highest possible throughput from the available medium If
116. d the next message available from the message source is sent or a DLE EOT When a DLE NAK is received the transceiver takes messages from the source until it is empty Each message is discarded with an error code sent back to the message source This can be used by the master to clear up the message source buffers of all slaves after the master has been down The following figures show events that occur on various interfaces Link layer data bytes are represented by xxxx and corrupted data is represented by These figures show the steps that occur on the data link layer when a single command message packet is sent they do not show the steps involved when the receiving node returns a reply message packet For this transfer See page normal message transfer 3 12 message transfer with invalid BCC 3 12 message transfer with ack destroyed 3 13 poll with no message available 3 13 poll with message returned 3 14 duplicate message transmission 3 15 message sink full case 1 3 16 message sink full case 2 3 17 Publication 1770 6 5 16 October 1996 3 12 Using Half duplex Protocols to Send and Receive Messages Publication 1770 6 5 16 October 1996 Normal Message Transfer In this transfer e data bytes are sent from the source to the master and transmitted to a slave e the sink sends a not full message e the data is sent to the sink and a DLE ACK is sent to the master e the master tells the source t
117. d to the reply packet only when there is an error download completed Use after downloading a complete system to place the processor back in the mode that it was in For PLC 5 processors it returns to the mode it was in prior to executing download all request CMD FNC C DST SRC OF STS TNS 52 CMD EXT R SRC DST 4F STS TNS STS The EXT STS field may be attached to the reply packet only when there is an error Publication 1770 6 5 16 October 1996 7 8 Communication Commands e PLC 3 1774 PLC MicroLogix 1000 PLC 2 PLC 3 PLC 5 PLC 5 250 receive only SLC 500 SLC 5 03 SLC 5 04 Publication 1770 6 5 16 October 1996 download request download privilege Used by a computer to inform an interface module that it wants to perform a download If the module grants the download privilege the computer may begin issuing physical reads or physical writes If another node already has the download privilege the second node is denied the privilege Before performing an upload download issue diagnostic status to get the last word of memory to read or write Bytes 11 14 in the diagnostic status reply return E60 0 0 this is the start of unused memory Start your read or write at 00 00 00 00 CMD FNC C DST SRC OF STS TNS 05 CMD EXT R SRC DST AF STS TNS STS The EXT STS field may be attach
118. d typed logical write three address fields 7 18 read link parameters 7 20 reading and writing using SLC terminology 7 38 set link parameters 7 25 Software layers 1 7 SRC 6 4 status bytes 1771 KA2 1771 KA 1771 KG 1771 KCKD 10 7 1771 KE KF 1771 KGM 1770 KF2 10 7 Index I 5 Status codes asynchronous link 8 1 Status DATA 1770 KF3 10 7 1773 KA 10 11 1779 KP5 10 14 1784 KR 10 15 1784 KT KT2 10 15 1785 KA 10 16 10 17 1785 KA3 10 17 1785 KE 10 19 1785 LT PLC 5 15 10 20 1785 LT3 PLC 5 12 10 21 10 22 5130 RM1 RM2 PLC 5 250 10 23 6008 LTV PLC 5 VME 10 20 SLC APS 10 2 SLC 5 01 10 3 10 4 10 6 STS 6 6 definition 6 3 STS byte description 8 2 Symbol definition _2 6 Symbols for full duplex _2 8 for half duplex _2 7 T TNS 6 7 definition 6 3 Transmitter operation DLE ACK 4 5 4 8 DLE ENQ 4 5 DLE NAK 4 5 software logic 4 6 Type Data parameter data type ID _7 29 date type size 7 29 flag byte 7 28 PLC 5 12 3 PLC 5 15 Series B rev E and earlier 12 4 PLC 5 15 Series B rev F and later and other PLC 5 12 5 Upload and download 12 1 constraints 12 1 12 4 Uploadable memory segments _7 33 Allen Bradley uy Publication Problem Report If you find a problem with our documentation please complete and return this form Pub Name DF1 Protocol and Command Set Reference Manual Check Problem s T
119. d write commands in PLC 3 PLC S or SLC 500 processors the address is not a byte address it is a logical binary logical ASCII or SLC address with multiple address fields SIZE The SIZE byte specifies the number of data bytes to be transferred by a message This field appears in read commands where it specifies the number of data bytes that the responding node must return in its reply message The SIZE varies with the type of command For PLC 5 and PLC 5 250 typed read and typed write commands the SIZE field specifies the number of elements not bytes In PLC 5 typed read and typed write commands the SIZE field is two bytes long transmit low byte first and high byte second e PLC 3 A processors that can use the command Chapter 7 Communication Commands This chapter contains the format you should use when sending communication commands to Allen Bradley processors Use this key to help learn the conventions that depict the communication commands listed in this chapter command gt command name This text describes how the command is used command description command format reply R format command code function code y data varies up to a maximum number of bytes gt C CMD FNC A CMD each block represents one byte Unless otherwise stated values are shown in hexadecimal gt Message packets The message packets for the
120. ddress even if it is a 0 so that the actual number of levels in a particular address can be determined A 1 in the mask bit corresponding to a particular address level signifies that that particular address level is encoded in the bytes which follow Only those address levels with a 1 in the corresponding mask bit are encoded For example 00001111 means that there are 4 levels in the address and all 4 levels are encoded 00000101 means there are 3 levels in the address and level 2 uses the default value the default is always 0 for level 2 Only levels 1 and 3 are encoded This byte is required the first level of the address not using the default value up to 4 levels of addressing Important If the value of the mask or a level of the address is greater than or equal to 255 you cannot encode it into 1 byte You must flag this case by programming an FF hex at the level address to signify that the level address is greater than or equal to 255 and the next 2 bytes will contain the level address Then code the level into the following two bytes After 255 FF hex you send the bytes with low byte first high byte second The following figures show examples of PLC 5 logical binary addresses Publication 1770 6 5 16 October 1996 13 12 PLC Addressing PLC 5 Logical Binary Address to Access the Address N7 30 1 Byte o o o 0 Data table area level 1 7 File level 2 30 Element le
121. disabled full duplex 010 none BCC enabled full duplex 110 even BCC enabled full duplex 001 none BCC disabled half duple X 101 even BCC disabled half duple X 011 none CRC enabled full duplex 111 none CRC disabled half duple X Asynchronous link baud rate 0 110bps 1 300bps 2 600bps 3 1200bps 4 2400bps 5 4800 bps 6 9600 bps 7 19200 bps Publication 1770 6 5 16 October 1996 10 10 Diagnostic Status Information Bytes Bits 10 4 3 0 Contents Settings of the option switches on the node interface module Description 1771 KGM Module 0 second module 1 first module 0 accept physical unprotected reads and writes disabled 1 accept physical unprotected reads and writes enabled Binary values Value Parity Error Embedded Protocol Check Responses 001 none BCC disabled half duplex 101 even BCC disabled half duplex 011 none CRC enabled half duplex Asynchronous link baud rate 0 110bps 1 300bps 2 600bps 3 1200bps 4 2400bps 5 4800 bps 6 9600 bps 7 19200 bps 1774 KA Module 0 Unprotected commands enabled 1 Unprotected commands disabled not used 0 Physical writes enabled 1 Physical writes disabled 0 Transmission of unprotected commands enabled 1 Transmission of unprotected commands disabled 0 DH port B is connected 1 DH port A is connected 0 PLC outputs held in last state 1 PLC outputs turned o
122. dresses PLC 5 250 Logical Binary Address to access the LP address 1N5 300 Byte mask byte indicates the module ID byte and 5 levels of 1 0011111411 addressing will be encoded 2 0 0 0 1 14 14 1 1 Module ID byte LP class x 10 pushweel value 31 3 00 00 0 0 1 0 leveli value 2 4 0000 0 0 0 0 level2 value 0 5 0000 0 0 0 1 evel3 value 1 6 0000 0 1 0 1 level4 value 5 7 1 1 11 1 141 1 1 level 5 flag value FF hex 8 0 0 10 1 1 0 0 44 lower byte of word 9 0 0 00 0 0 0 1 256 upper byte of word Byte 8 Byte 9 300 PLC 5 Logical Binary Address to access the RS address 1 007 Byte 1 0 0 0 0 0 1 1 1 mask byte indicates 3 levels in the address 2 00 00 0 0 O 1 leveli value 1 3 00 00 0 0 0 1 Ievel2 value 1 4 00 00 Oo level 3 value 7 PLC 5 250 Logical Binary Address to access the LP address 2F0 0 Byte mask byte indicates the module ID byte will be encoded 1 00 10 1 0 1 1 andthere are 5 levels in the address Levels 2 and 4 use the default 0 Therefore only levels 1 3 and 5 will be en coded Even though level 5 is a 0 it must be encoded be cause it is the last level in the address 2 0 0 10 0 0 0O 0 module ID byte LP class x 10 pushwheel value 32 3 0000 0 0 1 0 leveli value 2 4 0000 0 1 0 O level 3 value 4 5 0 000 0 0 O 1 level 5 value 0 the default but must be encoded because it is the last level P
123. e Use the SIZE field to specify the number of bytes to be read To specify a number of PLC words SIZE should ay o e 1774 PLC be an even value because PLC words are two bytes long Data bytes cee are transferred low byte first The address of a word should be even e PLC 5 e SLC 500 c pst src OMD sts mns ADDR SIZE e SLC 5 03 e SLC 5 04 CMD 5 e MicroLogix 1000 R SRC DST 4 STS TNS DATA max 244 bytes SLC 500 MicroLogix 1000 Reads data from a common interface file CIF The SLC 500 CIF is data file number 9 the MicroLogix 1000 CIF is integer file 7 This command is implemented as a protected file read in SLC processors and is used by non SLC 500 devices to read information from SLC 500 devices C DST SRC o STS TNS ADDR SIZE R SRC DST pe STS TNS DATA Address Logical offset into the CIF SLC 500 SLC 5 01 and SLC 5 02 SLC 5 02 prior to series C FRN 3 processors use word addressing SLC 5 02 series C FRN 3 and later SLC 5 03 and SLC 5 04 processors select word or byte addressing for S 2 8 0 default word addressing is used for S 2 8 1 byte addressing is used Size Number of bytes to read starting from the offset for SLC 500 SLC 5 01 and SLC 5 02 processors valid range is 0 95 bytes odd or even for SLC 5 03 and SLC 5 04 processors with internet protocol valid
124. e Transfer with Message Source Full on the Reply oo _ T ne in joo in joo ig Li iiy Li Li Niy uF ine co r co im Ko hr Eee i aes Po via INO ag _ Se Vag ao I a _ on I i gt y hk sS F oe T ne i co T 5S T D T on T ip l io l io T in NO se I im o im gt z N Data link Layer Message Frames Half duplex Protocol Message Frames Polling Frame Master Message Frame Slave Message Frame Full duplex Protocol Message Frames From user application program From common application routines Data link layer frame BCC and CRC Fields BCC Field Half duplex protocol example Full duplex protocol example CRC Field Table of Contents Full duplex and half duplex slave protocol Half duplex master protocol Use this frame to validate the CRC Application Layer Message Packets How Your Application Program Sends and Receives Messages Message Packet Format Command 0005 Reply 0 0 c cece e eee DST and SRC Command 000 Reply 0 ccc cece eee Communication Commands commandname apply
125. e a missing e The message can be too long or too short e A spurious control or data symbol can occur outside a message e A spurious control symbol can occur inside a message The DLE ACK response can be lost causing the transmitter to send a duplicate copy of a message that has already been passed to the message sink Waits for message The slave is always in a passive mode until it receives a message While waiting for a message any message other than the DLE SOH or DLE ENQ is ignored In a single circuit system the slaves must be able to safely ignore everything sent by other slaves Receives message If a DLE SOH is received the BCC CRC and the message buffer are reset The next symbol received must be a data symbol and must equal the node address or 255 if the node can receive broadcast messages If the node address and the symbol Then the node ignores the rest of the message do not match and continues waiting for the start of the message match itis added to the BCC CRC The next symbol is received and must match the DLE STX if the symbol address doesn t match the node ignores the rest of the message and the symbol starts building a message Builds a message While building a message all data symbols are stored in the message buffer and added to the accumulated BCC CRC The slave sets an error flag to indicate the occurrence of a parity buffer overrun message framing or modem handshaking error Publication
126. e as part of the data field size Bit 76543210 flag byte 10010111 00001001 01000010 00000000 00000000 11111110 11111111 11111111 00000000 Bits 4 7 Data Type ID in next one byte Bits 0 3 bytes per data type equals seven 6 data bytes plus 1 descriptor ID Value 9 array Integer descriptor size 2 bytes each Integer 0 LS Value 0 MS Integer 1 LS Value 2 MS Integer 2 LS Value 255 MS Not all sizes are legal for all formats The B data type always has a size value of one The F data type has either a size value of four single precision or eight double precision Each of the Allen Bradley predefined structures has a fixed size Example 3 PLC 5 processor requesting 10 integer words 10011010 00001001 00010101 00000000 01000010 Bits 4 7 Data Type ID in next byte Bits 0 3 Size encoded in next two bytes after type ID Value 9 array Extended size 15he 21 First byte of extended size LS 21 one byte for type and twenty bytes of data to follow Second byte of extended size MS Bits 4 7 Data Type 4 integer Bits 0 3 Size two bytes per element Publication 1770 6 5 16 October 1996 7 38 Communication Commands SLC 500 Information Important There are also some limitations on the basic commands SLC 500 family nodes support Command Limitation Diagnostic
127. e first 10 11 Messages received high byte first 12 13 Commands generated high byte first 14 15 Requests executed high byte first 16 17 Replies sent high byte first 18 Rack 1 timeouts 19 Rack 2 timeouts 20 Rack 3 timeouts 21 Rack 1 CRC errors 22 Rack 2 CRC errors 23 Rack 3 CRC errors 24 Rack 1 B T errors 25 Rack 2 B T errors 26 Rack 3 B T errors 27 Rack 1 re tries 28 Rack 2 re tries 29 Rack 3 re tries 30 Adapter timeouts 31 Undeliverable replies 5250 Cat Nos Cat Nos Diagnostic Counters 9 33 Link Pages 5250 LP1 LP2 LP3 LP4 processors DH 9 33 PLC 5 250 processors 5250 LP1 LP2 LP3 LP4 DH Diagnostic Counters This counter byte 0 1 Counts the number of Messages sent successfully 2 3 Messages received successfully not counting duplicate messages 4 Undeliverable messages message was NAKed or retries were used up 5 Response timeouts 6 NAKS received 7 Message retries as a result of CRC error illegal length DST not equal to this node SRC not equal to node that message was sent to or timeout 8 NAKs sent due to memory available 9 NAKs sent due to message s undefined LSAP 10 Duplicate messages received 11 Token pass retries 12 Packets received that were aborted early 13 Packets received that had a CRC error 14 Packets received that had an illegal size greater than 271 byte
128. e is an error the poll is ignored If the poll is accepted there are three possible situations The transceiver could still be holding a message that it had transmitted previously but had not been ACKed There is a limit on the number of times each reply message can be sent If this limit is Then when the poll is received the reply message is returned to the exceeded message source with an error indication and the transceiver tries to send the next message from the message source notexceeded the response to the poll is to re send the current reply message e Ifno message is currently being held the transceiver tries to get one from the message source If Then the transceiver initializes its re try counter and transmits it a message is available in response to the poll no message is available the response to a poll is to transmit a DLE EOT Transmits a message Receives DLE ACK Receives DLE NAK Half Duplex Protocol Diagrams Using Half duplex Protocols to Send and Receive Messages 3 11 When a message is transmitted after receiving a poll its format is identical to a full duplex message packet After sending a message the transceiver holds the message until a DLE ACK is received or the number of times the message has been polled exceeds the limit When a DLE ACK is received the message currently held is discarded and the message source is notified of a successful delivery When the next poll is receive
129. e of one to three messages Publication 1770 6 5 16 October 1996 Using Full duplex Protocol to Send and Receive Messages 4 7 How the Receiver Operates The receiver must be capable of responding to adverse situations Some of the problems that can occur are the message sink is full so the receiver has nowhere to put a message a message can contain a parity error the BCC or CRC can be invalid the DLE STX or DLE ETX BCC CRC may be missing the message is too long or too short a false control or data symbol occurs outside a message a false control symbol occurs inside a message the DLE ACK response is lost causing the transmitter to send a duplicate copy of a message already passed to the message sink Publication 1770 6 5 16 October 1996 4 8 Using Full duplex Protocol to Send and Receive Messages The receiver keeps a record of the last response sent to the transmitter The value of this response is either DLE ACK or DLE NAK Itis initialized to DLE NAK When a DLE ENQ enquiry is received from the transmitter the receiver sends the value of the last response The receiver ignores all input until a DLE STX or DLE ENQ is received If anything other than a DLE STX or DLE ENQ is received on path one the receiver sets the last response variable to NAK When this symbol is received Then the from the transmitter DLE ENQ last response is sent and the receiver continues waiting for input DLE ACK BCC CRC
130. e same message e the master sends a DLE ACK but discards the duplicate message To implement duplicate message detection the master must either e poll anode repeatedly without polling any other node until it receives a DLE EOT e keep a record if each node is polled only once per cycle of the 4 link layer data bytes of the last message packet sent by each slave node since other nodes may transfer messages before a node retransmits The master must buffer the entire reply until it can transmit the reply to the slave Source Source Sink Master Link Slave Sink not full DLE ENQ STNBCC __ __ lt XXxXx m DLE STX xxxx DLE ETX BCC CRC __ lt XXXX DL CK gt sometime later DLE ENQSTNBCG gt lt DLE STX xxxx DLE ETX BCC CRC DLE ACK gt m OK gt discard retransmission Publication 1770 6 5 16 October 1996 3 16 Using Half duplex Protocols to Send and Receive Messages Publication 1770 6 5 16 October 1996 Message Sink Full Case 1 In this transfer the slave s message sink is full If a slave does not respond to a command then this might indicate that the slave s buffers are full If the slave s buffers are full then a poll by the master results in the slave transmitting a reply other than 1004 DLE EOT Source Source Sink Master Link Slave Sink XXXX gt gt
131. eading SLC 500 data using SLC and PLC 2 terminology SLC Logical Address N9 0 N9 1 N9 2 N9 3 N9 4 N9 5 N9 6 N9 7 N9 8 N9 9 N9 10 N9 255 High Byte Low Byte Byte 1 Byte 0 Byte 3 Byte 2 Byte 5 Byte 4 Byte 7 Byte 6 Byte 9 Byte 8 Byte 11 Byte 10 Byte 13 Byte 12 Byte 15 Byte 14 Byte 17 Byte 16 Byte 19 Byte 18 Byte 21 Byte 20 Byte 511 Byte 510 Octal Address 000 001 002 003 004 005 PLC 2 006 Memory Map 007 010 011 012 377 Publication 1770 6 5 16 October 1996 7 40 Communication Commands Example Reading the 18th and 19th bytes shown in the example on page 7 39 Publication 1770 6 5 16 October 1996 These examples compare two methods for reading SLC 500 data from an SLC 500 assumes S 2 8 0 so that word addressing is selected and from a PLC 2 processor When using the SLC 500 method you do not multiply by two as in step 2 below as you do with the PLC 2 method Read N9 9 from SLC 500 processor b Convert decimal element to hex 9 decimal gt _ 0009 hex Put low byte first in address field Size xxh Address 09 00h Put 02 hex in size field 2 bytes 1 word Size 02h Address 09 00h Read octal word 011 from PLC 2 processor b Convert octal element to hex 11 octal 0009 hex Multiply by 2 0009h x 2 0012h Put low byte first in addr
132. ease notes 1771 KA2 DH PLC 2 Family Communication Adapter Module 1771 5 2 switch settings 1771 6 5 1 user manual 1771 KG PLC 2 Family RS 232 Interface Module 1771 2 32 product data 1771 6 5 8 user manual 1771 6 5 8 DU1 document update 1771 KGM SCADA Communication Master Module for PLC 2 Family 1771 2 85 product data 1771 6 5 39 user manual 1771 KE KF DH RS 232 Interface Module 1771 6 5 16 user manual 1771 6 5 16 DU1 document update 1775 KA DH PLC 3 Communication Adapter Module 1775 6 5 1 user manual 1775 S5 SR5 PLC 3 I O Scanner Module 1775 6 5 5 user manual 1784 KR DH485 Personal Computer Interface Module 1784 2 23 installation data 1784 2 23 RN1 release notes 1784 KT DH PC Interface Module 1784 2 31 installation data 1784 KT2 B DH PS 2 Interface Module 1784 2 21 installation data 1784 KT2 C 1784 6 5 16 user manual 1784 KTX DH PC Interface Module 1784 6 5 22 user manual 1784 KTXD DH PC Interface Module 1784 PCMK DH DH485 PCMCIA communication interface 1784 6 5 19 user manual 1785 KA DH DH Communication Interface Module 1785 2 6 product data 1785 6 5 1 user manual 1785 KA3 DH PLC 2 Family Communication Adapter Module 1785 2 6 product data 1785 6 5 3 user manual 1785 6 5 3 DU1 document update 1785 KA5 DH DH485 Communication Interface Module 1785 6 5 5 user manual 1785 KE DH RS 232 Interface Module 1785 6 5 2 user manual 5130 RM1 RM2 PLC 5 250 Resou
133. ed to the reply packet only when there is an error echo Checks the integrity of transmissions over the communication link The command message transmits up to 243 bytes of data to a node interface module The receiving module should reply to this command by transmitting the same data back to the originating node C DST SRC Pn STS TNS r Data max 243 bytes R SRC DST ay sts TNS Data max 243 bytes For SLC 500 SLC 5 01 and SLC 5 02 processors maximum data size is 95 bytes for SLC 5 03 and SLC 5 04 processors maximum data size is 236 bytes e 1774 PLC e 1774 PLC e PLC 2 enable outputs Communication Commands 7 9 Returns control of the outputs to the 1774 PLC ladder diagram program Use this command to cancel the effect of disable outputs CMD FNC c pst src M sts ms H R SRC DST a STS TNS enable PLC scanning Restarts the 1774 PLC processor s program scanner after a physical write has been performed CMD FNC C DST SRC 07 STS TNS 03 R SRC DST p STS TNS enter download mode Puts the PLC 2 processor in the download mode Use this command on a PLC 2 node before sending a physical write to the node CMD FNC DST SRC 07 STS TNS 04 src pst CMP sts Ns Important For early revisions of the 177
134. efore sending a PLC 2 1774 PLC command to a PLC 3 node you must first allocate a PLC 3 input file with the same file number as the PLC 2 1774 PLC s octal node address on the network This file helps the PLC 3 to simulate PLC 2 1774 PLC memory Data is read from or written to this file number Transmitting commands from PLC 3 processors To transmit commands from a PLC 3 processor to your computer set up a computer buffer to simulate a PLC 3 file and write computer application programs that are capable of interpreting all the types of addressing formats that appear in the command messages PLC Addressing 13 5 PLC 3 Logical Addressing PLC 3 processors use a form of logical addressing known as extended addressing With extended addressing you specify the address for each level or sub division of PLC 3 memory down to the smallest subdivision you want to access You can use this method to specify up to 6 levels of extended addressing which is enough to address any particular word in PLC 3 memory For more information on PLC 3 extended addressing refer to your PLC 3 Family Programming and Operations Manual To send a PLC 3 command message to a PLC 3 node put the extended address of the node in the PLC 3 LOGICAL ADDR field The first byte in the PLC 3 address field is a flag byte Flag byte 7 6 5 4 3 2 1 0 0 1 1 1 0 1 1 0 always set to zero associated with levels 1 6 of a PLC 3 extended addr
135. ent a packet that did not get acknowledged or wait acknowledged 6 Received NAKS 7 Message retries as a result of CRC error illegal length DST not equal to this node SRC not equal to node that message was sent to or timeout 8 NAKS sent no memory was available 9 NAKs sent message had undefined LSAP 10 Duplicate messages received 11 Token pass retries 12 Packets received that were aborted early 13 Packets received that had a CRC error 14 Packets received that had an illegal size greater than 271 bytes or less than 3 bytes 15 Duplicate tokens detected 16 Node recoveries from duplicate node condition 17 18 Link dead timeouts Publication 1770 6 5 16 October 1996 9 24 Diagnostic Counters 1779 Cat Nos Publication 1770 6 5 16 October 1996 Cat Nos 1779 KP5 Link DH 1779 KP5 DH Diagnostic Counters This counter byte Counts the number of Pages 9 24 0 ACKs received with bad CRC 1 Timeouts that expired with no ACK received 2 Times transmit retries exhausted 3 NAK or illegal protocol operations received 4 NAKs bad LSAPs received 5 NAKs no memory received 6 Received ACKs NAKs that were too short 7 Received ACKs NAKs that were too long 8 Times something other than an ACK NAK received 9 Token pass timeouts 10 Token pass retries exhausted 11 Claim token entered 12 Token claime
136. er transceiver sink lt gt to other slaves physical link lt packet source OK slave transceiver packet OK sink The source and sink are defined in the next section Half duplex Protocol Environment To define the environment of the protocol the transceiver e needs to know where to get the message it sends the message source We assume the message source supplies one message at a time upon request from the transceiver requires notification of the success or failure of the transfer before supplying the next message e must have a means of disposing of messages it receives the message sink When the transceiver has received a message successfully it attempts to give it to the message sink If the message sink is full the transceiver will receive an indication that the sink is full Publication 1770 6 5 16 October 1996 3 4 Using Half duplex Protocols to Send and Receive Messages Publication 1770 6 5 16 October 1996 The following program describes the actions of the transceiver in detail TRANSCEIVER is defined variables LAST HEADER is 4 bytes copied out of the last good message BCC is an 8 bit block check accumulator LAST HEADER invalid loop reset parity error flag GET CODE if it s a DLE SOH then begin GET CODE if it s a data code and it matches the station number or it is 255 the broadcast address
137. ers 9 27 1785 KA3 DH Diagnostic Counters 9 28 1785 KA5 DH Diagnostic Counters 9 29 1785 KA5 DH485 Diagnostic Counters 9 30 1785 L11B L20B L30B L40B L60B and L80B DH Channel Diagnostic Counters 00 cece eee eee 9 30 1785 L20E L40E L40L L60L L80E DH Diagnostic COUNEIS esens s tE ieee awed cap ea dee sac 9 32 5250Ga k NOS niu oe raens a Kesh iwe eee Resewas ae 9 33 5250 LP1 LP2 LP3 LP4 DH Diagnostic Counters 9 33 Diagnostic Status Information 10 1 1747 Gab NOS ne cidwaddeceet shee bkewa Gibewdes 10 2 1747 KE Status Bytes 20 0 0 cece eee ee 10 2 1747 L20 L30 L40 L511 L514 L524 SLC 500 SLC 5 01 and SLC 5 02 processors Status Bytes 10 3 1747 L532 L541 L542 L543 SLC 5 03 and SLC 5 04 processors Status Bytes oss gk ee dead Reve eew eee RSS aes os 10 4 1761 1770 and 1771 Cat Nos 0005 10 5 1761 L16AWA L16BBB L16BWB L32AWA L32BWA L32BWB MicroLogix 1000 processors Status Bytes 10 6 1770 KF3 Status Bytes 0 0 cece eee 10 7 1771 KA2 KA KC KD KE KF KG KGM 1770 KF2 Status BYES ci ociceceeaidaenededentedactees 10 7 1773 1775 and 1779 Cat Nos 00 00 eee 10 11 1773 KA Status Bytes 00 0 cece eee eee 10 11 1775 KA S5 and SR5 Status Bytes 10 13 1779 KP5 Status Bytes 0 0 00 c
138. es sent 4 5 Messages received with errors 6 7 Messages sent with errors 8 9 Messages unable to receive 10 11 Network dead 12 13 Claims won 14 15 Claims lost 16 17 New successor 18 19 Token retry 20 21 Token failed 22 23 Started linear scan 24 25 Linear scan failed 26 27 Duplicate node 28 29 Dropped token 30 31 Received SDA 32 33 Received bad packets 34 35 Received SDA re transmission 36 37 Received SDA but full 38 39 Received SDA SAP off 40 41 Transmit SDA confirm 42 43 Transmit SDA NAK misc 44 45 Transmit SDA timeout 46 47 Transmit SDA not ACKed 48 49 Transmit SDA retry 50 51 Transmit SDA failed 52 53 Transmit SDA NAKed full 54 55 Transmit SDA NAKed inactive SAP 56 57 Transmit SDN confirm 58 59 Transmit SDN failed 60 61 Solicit rotations 62 63 Receive SDN Diagnostic Counters 9 5 1747 L541 L542 and L543 SLC 5 03 and 5 04 processors DH485 Diagnostic Counters This counter byte Counts the number of Total message packets received low byte Total message packets received high byte Total message packets sent low byte Total message packets sent high byte Message packet retries Retry limit exceeded NAK no memory sent NAK no memory received Total bad message packets received olo NI o om A ww rm e oO Bad messages due to illegal type i e control byte bad oO Bad messages due to bad CRC a Bad mess
139. esponds to the poll with a DLE EOT but consistently fails to ACK a message its sink is probably full You must wait for the buffers to clear before sending another message Buffer full condition Some devices hold data indefinitely To get the data and relieve the buffer full condition you must poll the device When a node s message source and sink share a common memory pool an abundance of messages in the message source may cause a message sink full indication In this case the master can poll the node to receive messages and make memory available Waiting for the memory to clear on its own may not work on all devices the only way to free memory is to have the master poll the node Simplified Network Layer To allow peer to peer communication on the multidrop your master must use a simplified network layer This network layer resides just above the data link layer and performs routing and relaying of messages For more on the network layers refer to Chapter 1 Network Layers Using Half duplex Protocols to Send and Receive Messages 3 9 Slave Transceiver Actions Since input sent to the transceiver can often be affected by noise from the physical world the transceiver must be capable of responding to many adverse situations such as The message sink can be full leaving nowhere to put a message A message can contain a parity error The BCC CRC can be invalid The DLE SOH DLE STX or DLE ETX BCC CRC may b
140. ess If a bit is set to 0 This address level Has this default value 1 3 data table 2 1 current context all others 0 If a bit is set to 1 you must specify a value for the corresponding address level Important You must specify the last level of a PLC 3 address in the address field even though it is equal to the default value lf Then the address values can be specified in one byte each you can code the values directly you must use a delimiter byte of value FF hex before each two byte address Any two byte value must be encoded low byte first it takes two bytes to specify an address The following example shows how to enter a PLC 3 extended address in logical binary format in the address message packet field Publication 1770 6 5 16 October 1996 13 6 PLC Addressing Publication 1770 6 5 16 October 1996 Example PLC 3 logical binary addressing format Datatablearea level1 _ Context level 2 Section level 3 Structure level 5 Word level 6 E3 1 8 260 0 0 File level 4 76 54 3 21 0 bt N D on A oe Ph level Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Bytes 003101 10 0 flag byte specifies that the default values are used for levels 1 2 and 5 00001 00 0 level 3 value 8 1111111 1 level 4 delimiter used to signal that the level 4 address uses the next two bytes 0000 0 10 0 level4 low byte 00 00
141. ess field Size xxh Address 12 00h Put 02 hex in size field 2 bytes 1 word Address Size 12 00h 02h Chapter 8 Message Packet Status Codes STS EXT STS Use this chapter to help interpret status codes that appear in asynchronous link message packets You use asynchronous link status codes to determine the status of a command sent from your computer to another device on your DH DH or DH485 link Asynchronous link status codes are passed in the message packet in these bytes status STS byte e extended status EXT STS byte for some commands This chapter contains these sections Section Page STS Byte 8 2 EXT STS Byte 8 3 Remote STS and EXT STS Codes 8 5 Publication 1770 6 5 16 October 1996 8 2 Message Packet Status Codes STS EXT STS STS Byte The STS byte provides information about the execution or failure of the corresponding command that was transmitted from the computer If the reply returns a code of 00 the command was executed at the remote node All other codes can be divided into two types This error type Occurs when the local node is unable to transmit a message to the remote node local The local node interface turns the command around stuffs the STS byte with the appropriate code and returns it to the computer the command is successfully transmitted to a remote node but the remote node is unable to execute the command The remote node formats a reply message with the appro
142. ess of the segment The second 4 bytes contain the ending address of the segment C number of comparable memory segments D eight bytes for each segment specified in C The first four bytes contain the starting address of the segment The second four bytes contain the ending address of the segment A B C D These fields may be replaced by an EXT STS field if there is an error If you are using a PLC 5 family processor other than a PLC 5 15 Series A or Series B Revision E or earlier you also receive data about uploadable and comparable memory segments Segment Description Contiguous segments of the PLC 5 memory that must be uploadable memory uploaded Uploadable contiguous memory segments that you can compare to an uploaded segment to verify the contents For example a comparable memory segment of memory that contains ladder logic is comparable but a segment that contains data table memory is not because because data table memory is constantly changing Publication 1770 6 5 16 October 1996 7 34 Communication Commands e PLC 5 e PLC 5 VME e PLC 3 e PLC 3 e PLC 5 Publication 1770 6 5 16 October 1996 upload completed After uploading a complete system use to return the processor to the mode it was in prior to executing the upload all request command CMD FNC c pst src OMPI sts TNS x CMD EXT R SRC DS
143. essors for 1771 KA2 0 Protected commands enabled disabled for 1771 KA2 1 Protected commands disabled enabled for 1771 KA2 0 Unprotected commands enabled disabled for 1771 KA2 1 Unprotected commands disabled enabled for 1771 KA2 not used 0 Physical writes enabled disabled for 1771 KA2 1 Physical writes disabled enabled for 1771 KA2 0 Transmission unprotected commands enabled disabled for 1771 KA2 1 Transmission unprotected commands disabled enabled for 1771 KA2 1771 KG Module Series A 0 Full duplex protocol 1 Half duplex protocol 0 Physical writes disabled 1 Physical writes enabled 0 Unprotected commands disabled 1 Unprotected commands enabled 0 Embedded responses disabled 1 Embedded responses enabled 0 No parity 1 Even parity Asynchronous link baud rate 0 110 bps 1 300 bps 2 600 bps 3 1200 bps 5 4800 bps 6 9600 bps 4 2400 bps 7 19200 bps Publication 1770 6 5 16 October 1996 Bytes Bits 4 3 0 Contents Diagnostic Status Information 10 9 Description 1771 KG Module Series B 0 second module 1 first module 0 accept physical unprotected reads and writes disabled 1 accept physical unprotected reads and writes enabled Binary values Value Parity Error Embedded Protocol Check __ Responses 000 none BCC disabled full duplex 100 even BCC
144. evels than required The word specified by the PLC 3 address does not exist 9 FO The file is larger than 65 535 words B FO The remote node does not have access to the DST file Publication 1770 6 5 16 October 1996 E Module Diagnostics Ei Diagnostic Counters Chapter 9 Diagnostic Status Information Chapter 10 Chapter 9 Diagnostic Counters Diagnostic counters are bytes of information stored in RAM in each module The counters occupy a block of the module s internal scratch RAM Most are single byte counters that wrap around to zero when they overflow They are used to record events that can be used in debugging and long term reliability analysis These counters provide a useful tool for diagnosing problems For example the ACK timeout counter and the false poll counter are useful for diagnosing bad cabling a noisy link or an overloaded link installation You can also use the counters to determine the ratio of messages transmitted successfully returned an ACK from the remote node versus the commands sent This chapter lists interface module diagnostic counters and describes what they contain It contains these sections Section Page 1747 Cat Nos 9 3 1761 Cat Nos 9 7 1770 Cat Nos 9 8 1771 Cat Nos 9 14 1775 Cat Nos 9 21 1779 Cat Nos 9 24 1784 Cat Nos 9 25 1785 Cat Nos 9 26 5250 Cat Nos 9 33 Publication 1770 6 5 16 October 1996 9 2 Diagnostic Counters Publication 1770 6 5
145. evices can talk at the same time Full duplex protocol can be likened to a two lane bridge traffic can travel in both directions at one time To compare full duplex to half duplex protocol refer to Chapter 3 Using Half duplex Protocols to Send and Receive Messages Read this chapter to help learn how to use full duplex protocol to send and receive messages It contains these sections Section Page Full duplex Protocol Message Transmission 4 2 Full duplex Protocol Environment 4 3 Message Characteristics 4 4 Transmitter and Receiver Message Transfer 4 4 Full duplex Protocol Diagrams 4 10 gt Link arbitration You can use these Allen Bradley interface modules to automatically handle the link arbitration 1747 KE 1771 KE 1775 KA via modem port 1770 KF2 1771 KF 1785 KE 1770 KF3 1771 KG 5130 RM1 channel one 1770 KFC 5130 KA 5130 RM2 Publication 1770 6 5 16 October 1996 4 2 Using Full duplex Protocol to Send and Receive Messages Full duplex Protocol With full duplex protocol a link uses two physical circuits for Message Transmission two way simultaneous message transmission command or reply message packets These two physical circuits provide communication on four logical paths Figure 4 1 Data paths for two way simultaneous operation path 1 gt transmitter A receiver B path 2 circuit 1 circuit 2 path 3 path 4 On the first circuit
146. ex the exact error is contained in an EXT STS extended status byte For more information on STS codes see page 8 2 In our example the message is successful status code 00 hex TNS transaction 02 00 Indicates a specific transaction value for each message The TNS value for the reply message is the same 2 bytes as the TNS value for the command message This allows the computer to keep track of commands and their associated replies Since our example has three commands each command must have a different TNS field DATA 228 bytes In our example the computer reads 228 bytes 114 words of actual data from the PLC 3 data table starting at B10 0 Each word of data is presented low byte first The second read command starts at B10 114 and the third at B10 228 based on the packet offset field DLE ETX 2 10 03 Indicates the termination of the reply message bytes BCC block check Used to check the accuracy of the message transmission You can optionally use CRC bytes here character The BCC value must equal the 2 s compliment of the 8 bit sum of all data bytes between DLE STX and DLE ETX DLE ACK 10 06 Sent from the computer back to the module 1770 KF2 to indicate that the computer successfully received the message If the BCC value calculated by the module does not match the BCC value in the message packet the module sends a DLE NAK 10 15 hex instead of the DLE ACK hex If the module does not receive a DLE ACK or DLE NAK
147. f 35 Messages routed to RS 232 port 36 Commands routed to command executor 37 Replies routed to reply processor 38 Messages sent to self 39 Routing errors on inbound messages 40 Routing errors on outbound messages 41 Messages with incorrect network address 42 43 Messages sent by command initiator 44 45 Commands received by command executor 46 47 Replies sent by command executor 48 49 Replies received by command initiator 50 Breaks sent to IT 51 Re syncs sent to PLC 1775 Cat Nos Diagnostic Counters 9 21 Cat Nos Link Pages 1775 KA DH 9 21 1775 S5 SR5 DH 9 21 PLC 3 processors 1775 KA S5 SR5 DH Diagnostic Counters DH Port Counters This counter byte Counts the number of Bad CRCs on acknowledgment Timeouts that occurred before an ACK was received 2 Contentions while master detected message transmission by another node 3 ACKs containing an error 4 Returned messages local errors and lost replies 5 Waits no receive buffer space at destination node 6 Poll time outs master failed 7 False polls failure to transfer 8 ACKs received when not master 9 Times the message size was too small less than 5 bytes 10 Incorrect DST or SRC is equal to DST 11 Times memory was not available for receive buffer 12 Received messages with bad CRC value
148. f user memory low word first low byte first Series and revision of the PLC 5 0 Revision A 1 Revision B etc 0 Series A 1 Series B etc Processor number on DH Link all I O address Address of the processor if it is an adapter If it is a scanner value is OFDH I O and communication parameters 0 Double density 1 Adapter mode 1 Module group 4 top half 1 Adapter is half rack 1 Data Highway Plus at 115K baud 12 13 Number of data table files low byte first 14 15 Number of data type files low byte first 16 Forcing status 1 Forces active 1 Forces are present in the tables 1 Forces are present in the tables 17 Memory protect indication non zero means memory is protected 18 Bad RAM indication non zero means RAM is bad must be cleared Publication 1770 6 5 16 October 1996 10 22 Bytes Bits Diagnostic Status Information 1785 L11B L20B L20E L30B L40B L40E L40L L60B L60L Status Bytes Contents Operating status of PLC 5 processor Description 0 Program load 1 Not used 2 Run mode 3 Not used 4 Remote program load 5 Remote test 6 Remote run 7 Not used 0 Normal 1 Major processor fault 0 Normal 1 Download mode Not used 0 Not testing edits 1 Testing edits 0 Not testing ed
149. ff 0 57 600 bits per second DH baud rate 1 undefined 2 undefined 3 undefined 1770 KF2 Module 0 57 600 bits per second Data Higway or Data Highway Plus baud rate 1 undefined 2 undefined 3 undefined Not used Logical complement of the state of option switch SW 2 switches 1 through 5 Publication 1770 6 5 16 October 1996 1773 1775 and 1779 Cat Nos For status information from these cat nos Diagnostic Status Information 10 11 See page 1773 KA 10 11 1775 KA 1775 55 and 1775 SR5 10 13 1779 KP5 10 14 1773 KA Status Bytes Contents Bytes Bits Operating status of controllers on loop Description 1 Jo Operating statusof 1ifcontroler HL isactve tt ti ti s s S 1 if controller 2 is active 1 if controller 3 is active 1 if controller 4 is active 1 if controller 5 is active 1 if controller 6 is active 1 if controller 7 is active 1 if controller 8 is active OIN O oy A OJN I eo Node interface and processor type 8 1773 KA DH port 9 1773 KA RS 232 C port 12 1775 S5 SR5 new revisions only 8 PLC 4 Microtrol processor 5 7 8 15 DH port options 0 57 600 bits per second DH baud rate 1 Undefined Not used 0 Privileged commands enabled 1 Privileged commands di
150. fore any physical writes on the PLC 2 processor The enter download mode command must precede this command c CMD FNC DsT sRC STS TNS fog DATA R sRC DST oy sTs TNS DATA enter the number of bytes of memory that you want to allocate to the PLC 2 data table Since PLC words are two bytes long the DATA value is double the number of words in the PLC 2 data table If lt 512 bytes the number must be a multiple of 4 If 512 bytes the number must be a multiple of 128 DATA is also equivalent to the physical address of the start of the processor s program memory To determine allowable data table sizes see the appropriate programming manual Important Using a data table size that is larger than the processor s available memory causes a PLC 2 fault the next time the processor is put into Run or Remote Run mode el id e PLC 2 e PLC 3 Ie Hy BT Of e PLC 5 e Df Be 0 fe LLa e SLC 500 e SLC 5 03 e SLC 5 04 Channel 0 configured for DH485 e PLC 2 e PLC 3 e PLC 5 Communication Commands 7 25 set ENQs Sets the maximum number of ENQs that the asynchronous interface module issues per message transmission Put the number in the DATA field The default setting for most modules is 10 ENQs per transmission 3 ENQs for the 1771 KG and 1771 KE 9 ENQs for the 1785 KE c CMD FNC DST SRC
151. from the computer within approximately three seconds it sends a DLE ENQ to see if re transmission is necessary Publication 1770 6 5 16 October 1996 Chapter 15 ASCII Codes ASCII Hex Binary Decimal ASCII Hex Binary Decimal NUL 00 00000000 0 29 00101001 41 SOH 01 00000001 1 2A 00101010 42 STX 02 00000010 2 2B 00101011 43 ETX 03 00000011 3 2C 00101100 44 EOT 04 00000100 4 2D 00101101 45 ENQ 05 00000101 5 2E 00101110 46 ACK 06 00000110 6 l 2F 00101111 47 BEL 07 00000111 7 0 30 00110000 48 BS 08 00001000 8 1 31 00110001 49 HT 09 00001001 9 2 32 00110010 50 LF 0A 00001010 10 3 33 00110011 51 VT 0B 00001011 11 4 34 00110100 52 FF 0c 00001000 12 5 35 00110101 53 CR 0D 00001101 13 6 36 00110110 54 sO 0E 00001110 14 7 37 00110111 55 SI OF 00001111 15 8 38 00111000 56 DLE 10 00010000 16 9 39 00111001 57 DC1 11 00010001 17 3A 00111010 58 DC2 12 00010010 18 3B 00111011 59 DC3 13 00010011 19 lt 3C 00111100 60 DC4 14 00010100 20 3D 00111101 61 NAK 15 00010101 21 gt 3E 00111110 62 SYN 16 00010110 22 3F 00111111 63 ETB 17 00010111 23 40 01000000 64 CAN 18 00011000 24 A 41 01000001 65 EM 19 00011001 25 B 42 01000010 66 SUB 1A 00011010 26 C 43 01000011 67 ESC 1B 00011011 27 D 44 01000
152. g point e eee ee eee Order of Transmission 2 2 2 2s4 e008 setss cues A 16 Bit Word in PLC Memory A 16 Bit Computer Word with Left to Right Byte and BIOMED eseng ceri eE sects A 16 Bit Computer Word with Right to Left Byte and Bit Order lt 2 cccsretaresuvesoetaueraeee as A 16 Bit Computer Word with Left to Right Byte Order and Right to Left Bit Order 0 005 Uploading and Downloading with A B Processors Uploading from the Processor 2 0 0005 Uploading from a PLC 2 Processor Uploading from a PLC 3 Processor Uploading from a PLC 5 Processor Procedure 1 PLC 5 15 B processors revision E and earlier 00 000 ccc cece Procedure 2 00 c cece eee eee eee Uploading from an SLC 500 Processor Downloading to the Processor 00eeeeeee Downloading to a PLC 2 Processor Downloading to a PLC 3 Processor Downloading to a PLC 5 Processor Procedure 1 PLC 5 15 B rev E and earlier PIGCCUWIG 2 cedex ekiy Gace etdetans cine errai vii ok Y he NO i Po Po T ge ss ihe gt i io r D i T D iw N it oo ere ine oo ad iim to k i viii Table of Contents Downloading to an SLC 500 Processor
153. ge can be re transmitted for each module If this limit is exceeded the message source is informed of the failure and the transmitter proceeds with the next message If the timeout expires before a response is received the transmitter sends a DLE ENQ to request a retransmission of the last response It restarts the timeout and waits for a response You can also set a limit to the number of timeouts that are allowed per message If the enquiry ENQ limit is exceeded the transmitter signals the message source that the transmission has failed and the transmitter proceeds to the next message There are three responses defined DLE ACK DLE NAK DLE ENQ If the transmitter receives an different response the transmitter ignores it TRANSMITTER is defined as loop Message GET MESSAGE TO SEND Status TRANSFER Message SIGNAL RESULTS Status end loop loop WAIT for response on path 2 or timeout if received DLE ACK then return SUCCESS else if received DLE NAK then if nak limit is exceeded then return FAILURE else begin count NAK re tries SEND MESSAGE message start timeout end else if timeout if eng limit is exceeded then return FAILURE else begin count ENQ re tries send DLE ENQ on path 1 start timeout end end loop SEND message is defined as begin BCC 0 send DLE STX on path 1 for every byte in the message do begin add the byte to the BCC send the corresponding data symbol on path 1 end send DLE ETX BCC on pa
154. gram owner s local node address 1 byte For these codes See remote STS codes from a PLC 2 or 1774 PLC processor section below remote STS and EXT STS codes from a PLC 3 processor page 8 6 Remote STS Codes from a PLC 2 or 1774 PLC Processor STS codes that may be sent from your PLC 2 or 1774 PLC processor to your computer include STS Code Explanation 10 The command message command code sub command code size of the command or requested reply size was incorrect 20 There are verification errors within the host PLC processor 30 A condition exists at the PLC 2 processor that requires manual intervention such as ethe cable between the module and the processor is unplugged ethe processor is faulted 40 A communication error on the cable or on backplane access between the module and the processor has aborted message execution 50 An attempt to access an illegal address in the PLC 2 processor has aborted message execution Illegal access may result from access outside ethe data table as defined by the PLC 2 ea memory access window protected commands only Illegal access may also mean that the PLC 2 processor has attempted to communicate with a PLC 3 PLC 5 or an SLC 500 processors that does not have the proper compatibility file 60 Execution of a command at the PLC 2 processor is disabled by a switch option 70 The PLC 2 processor is in Program or Remote Program mode or the 1771 KA is in Download mode
155. h no ACK received 2 Mastership contentions 3 Errors in received ACK 4 Sum of bytes 1 2 and 4 5 WACKSs received stopped sending for a while 6 Times the master died assumed mastership 7 False polls no answer to poll of size 1 8 ACKs received when not master 9 Received frames that were too small 10 Received frames that were with SRC DST 11 Unused 12 Received frames containing a bad CRC 13 Received frames that were too long 14 Times there was no buffer for the received message WACK sent 15 Frame re transmissions received 16 Received frames aborted line noise 17 18 Messages successfully sent low byte first 19 20 Messages successfully received low byte first 21 22 Commands successfully sent low byte first 23 24 Replies successfully received low byte first 25 26 Commands successfully received low byte first 27 28 Replies successfully sent low byte first 29 Replies that could not be sent Diagnostic Counters 9 27 1785 KA DH Diagnostic Counters This counter byte Counts the number of 0 Times received ACKs with a bad CRC 1 Timeouts expired with no ACK received 2 Transmit re tries exhausted 3 NAK illegal protocol operations received 4 NAK bad LSAP received 5 NAK no memory received 6 Received ACKs NAKs too short 7 Received ACKs NAKs too long 8 Times something other t
156. han an ACK NAK received 9 Duplicate tokens found 10 Duplicate nodes found 11 Token pass timeouts 12 Token pass re tries exhausted 13 Claim token sequences entered 14 Tokens claimed 15 Bad CRC in received frames 16 NAKS illegal protocol operations sent 17 NAKs bad LSAP sent 18 NAKs no memory sent 19 Received frames that were too small 20 Received frames that were too long 21 Frame re transmissions received 22 Received frames aborted line noise 23 24 Messages successfully sent low byte first 25 26 Messages successfully received low byte first 27 28 Commands successfully sent low byte first 29 30 Replies successfully received low byte first 31 32 Commands successfully received low byte first 33 34 Replies successfully sent low byte first 35 Replies that could not be sent 36 Active nodes Publication 1770 6 5 16 October 1996 9 28 Diagnostic Counters Publication 1770 6 5 16 October 1996 1785 KA3 DH Diagnostic Counters This counter byte Counts the number of 0 Received ACKs with a bad CRC 1 Timeouts that expired with no ACK received 2 Transmit retries exhausted 3 NAKs sent due to an illegal protocol operation 4 NAKs sent due to a bad LSAP 5 NAKs sent due to memory available 6 Received ACKs NAKs that were too short 7 Received ACKs NAKs that were to
157. has just been powered up there should be only one node that has this counter incremented Times this node has tried to relinquish mastership and the node that was expected to take over failed to respond Happens on a noisy link because the noise is mistaken for a poll response and the wrong node is selected as the next master When this occurs the old master resumes polling Also happens on a long link if the poll response is very attenuated and is not picked up by the carrier detect circuit If the new node responds but the old master does not hear it the old master records a false poll and continues polling The new master starts polling also This usually leads to the second node detecting contention and relinquishing Times the receiver received a status frame instead of a message frame This occurs only if a poll timeout is imminent a master has had mastership for more than 170ms and the node has disabled its address recognizer to test for any valid traffic This counter byte 9 Diagnostic Counters 9 15 Counts the number of Frames that were rejected because the header was incomplete This is counted only because of undebugged software or in the unlikely event that a bad frame fooled the CRC checker 10 Frames that were rejected because the destination address was incorrect This can have the same cause as counter byte 8 This counter also detects frames that have the same source and destination address
158. hat a required action always returns a reply with some sort of status either zero status for a good reply or non zero status as an error code The application layer protocol distinguishes a command from a reply The data area of a command and its corresponding reply depend on the type of command Publication 1770 6 5 16 October 1996 1 10 Network Layers Publication 1770 6 5 16 October 1996 Message Priority You specify the priority level for each DH command in the message command code The node that receives a command message must establish the same priority level for its corresponding reply message This link Classifies a message as high priority or normal priority Priority levels of messages determine the order in which nodes transmit DH messages on a DH link In the polling process nodes with high priority messages will always be given priority over nodes with normal priority messages DH normal priority DH485 normal priority Important Nodes with high priority messages are given priority over nodes with normal priority messages throughout the command reply message cycle For this reason a command should be given a high priority designation only when special handling of specific data is required Using an excessive number of high priority commands defeats the purpose of this feature and could delay or inhibit the transmission of normal priority messages Delivery Order of Commands The sending node the netw
159. hat the message was delivered Source Sink Master Link Slave Source Sink XXXX gt OK gt sometime later DLE SOH STN DLE STX xxxx DLE ETX BCC CRC _ lt DLE ACK DLE ENQ STN BCC gt poll DLE STX xxxx DLE ETX BCC CRC DLE ACK Message Transfer with Invalid BCC CRC In this transfer e the master sends a message with an invalid BCC CRC e the master receives no ACK and times out lt not full m XXXX gt e the master retransmits with a valid BCC CRC and proceeds with a normal message transfer Source Source Sink Master Link Slave Sink XXXX gt DLE SOH STN DLE STX DLE ETX BCC CRC _ gt timeout DLE SOH STN DLE STX xxxx DLE ETX BCC CRC _ lt not full _XXXX 2 gt lt DLE ACK lt OK Using Half duplex Protocols to Send and Receive Messages 3 13 Message Transfer with ACK Destroyed In this transfer e the master sends a message e the slave accepts the message and returns a DLE ACK but the DLE ACK is destroyed e the master re transmits and proceeds with a normal message transfer e If duplicate detect is enabled the duplicate message is discarded Source Source Sink Master Link Slave Sink XXXX gt DLE SOH STN DLE STX xxxx DLE ETX BCC CRC __ gt lt not full
160. he command executor when the link layer attempts to transmit a message across the link at the destination node tries to execute the command message gt STS and EXT STS error codes For more information on STS and EXT STS error codes see Chapter 8 Message Packet Status Codes STS EXT STS Publication 1770 6 5 16 October 1996 Application Layer Message Packets 6 7 TNS The TNS transaction bytes contain a unique 16 bit transaction identifier Generate this number by maintaining a 16 bit counter Increment the counter each time your command initiator application program creates a new message and store the counter value in the two TNS bytes of the new message In a multi tasking environment you must use only one TNS counter and the procedure to read and increment the TNS must be indivisible Command executor copies the TNS field of the command message into TNS the TNS field of the corresponding reply message command Command initiator checks TNS value of reply and matches it to one of its TNS command messages The low byte least significant bits of the TNS value reply is transmitted before the high byte most significant bits For command messages transmitted by a PLC the interface module assigns the TNS values your application level software The software must computer node f assign a unique 16 bit transaction number Important Do not change the TNS value in a reply
161. he other end of the link a software separator divides the message symbols from the response symbols The internal software sends the message symbols to the appropriate receiver and the response symbols to the appropriate transmitter e Although message symbols and response symbols on the same circuit operate independently of each other there is some interaction e For example a message on physical circuit AB will be delayed if a response symbol from receiver A is inserted in a stream of message symbols from transmitter A embedded response e Also any hardware problems that affect message symbols traveling over a circuit will also affect response symbols on the same circuit Full duplex Protocol To define the environment of the protocol Environment e the transmitter needs to know where to get the message it sends the message source We assume the message source supplies one message at a time upon request from the transmitter requires notification of the success or failure of the transfer before supplying the next message the receiver must have a means of disposing of messages the message sink If the Then the transmitter waits in an inactive state until a message source Is empty message is available receiver attempts to give it to the message sink If the message sink is full the receiver must be notified receiver has received a message successfully Publication 1770 6 5 16 October 1996 AA Using Full d
162. his counter also detects frames that have the same source and destination address 11 Times that the receiver sent an ACK without first being able to allocate a receive buffer This may result in a memory overflow error when the next message is received 12 Frames that were rejected because of a bad CRC This error is common on a noisy link 13 Times a message was received that contained more than 250 bytes 14 Times a message was received when buffer space was not allocated for it This usually follows a memory full error 15 Duplicate frames received A duplicate frame is sent by a transmitter when it fails to receive an ACK If the reason it failed to receive an ACK was that the ACK was lost rather than because the original message was lost the duplicate is redundant and should be discarded Any two successive messages between polls that have the same sequence number fields and the same command or reply bits are assumed to be duplicates 16 Aborts received The HDLC abort signal is not used on a DH link but can be detected by the serial input or output in certain circumstances Some nodes whose addresses match the ringing pattern after a transmitter shutoff can be particularly susceptible to this error nodes 36 76 and 176 for example These numbers depend on highway configurations 17 18 Messages successfully transmitted 19 20 Messages successfully received
163. ication 1770 6 5 16 Description Reference Weve reorganized the reference manual to make it easier to find information We include a map of this new organization Preface page Pug commands We ve added and updated the communication commands We ve also organized them alphabetically Additional commands include eapply port configuration echange mode eclose file edisable forces eget edit resources e initialize memory eopen file protected typed logical read with three address fields eprotected typed logical write with three address fields eread diagnostic counters eread section size ereturn edit resource Chapter 7 Communication Commands Publication 1770 6 5 16 October 1996 Table of Contents What s Changed in This Document soc i About This Document 00000 e eee eee Soc i Changes to This Document 0 000000 S0c i About This Manual 0 00cc ee eeeees P 1 Purpose of This Manual 0 000s eee eee P 1 Who Should Use This Manual 00 P 1 What This Manual Contains 00e00 eee P 2 Terms and Abbreviations 0 000 cece eens P 3 Related Publications 0 0 0 cece eee eee P 3 Related Products n n n citer ees agren tess Soe 5 P 4 Conventions Used in This Manual P 5 Network Layers 2 02 0 cece cece eee eens 1 1 Physical Layer cieu cdot eee ba deed
164. imes the network died 12 13 Claims won 14 15 Claims lost 16 17 New successors 18 19 Tokens retried 20 21 Tokens failed 22 23 Times linear scan started 24 25 Times linear scan failed 26 27 Duplicate nodes 28 29 Dropped tokens 30 31 Received SDAs 32 33 Received bad packets 34 35 Received SDA retransmissions 36 37 Received SDAs but full 38 39 Received SDAs SAP off 40 41 Transmitted SDA confirms 42 43 Transmitted SDA NAKs miscellaneous 44 45 Transmitted SDA timeouts 46 47 Transmitted SDA but not ACKed 48 49 Transmitted SDX retries 50 51 Transmitted SDA failed 52 53 Transmitted SDA NAKed full 54 55 Transmitted SDA NAKed inactive SAP 56 57 Transmitted SDN confirmed 58 59 Transmitted SDN failed 60 61 Solicited rotations 62 63 SDNs received Diagnostic Counters 9 31 Below are diagnostic counters for the channel 0 serial port These counters vary depending on whether the port is configured for e point to point full duplex e half duplex slave e half duplex master This counter byte 0 1 Counts the number of General status words Contains serial port information as defined below 0 BitO status of CTS 1 asserted 0 deasserted Bit 1 status of RTS 1 asserted 0 deasserted Bit 2 status of DSR 1 asserted 0 deasserted Bit 3 status of DCD 1 asserted 0 deasserted Bit 4 status of DTR 1 asserted 0 deasserted Bit 5 st
165. in hexadecimal It contains these sections Section Page Half duplex Line Monitor Example 14 2 Full duplex PLC 2 Line Monitor Example 14 3 Full duplex PLC 3 Line Monitor Example 14 6 Publication 1770 6 5 16 October 1996 14 2 Half duplex Line Monitor Example master slave master slave master slave Publication 1770 6 5 16 October 1996 DLE 10 DLE 10 DLE 10 DLE 10 DLE 10 DLE 10 SOH 01 ACK 06 ENQ 05 STX 02 ACK 06 EOT 04 Line Monitor Examples STN 11 STN DST 07 DLE 10 When monitoring half duplex protocol in two wire mode you need to monitor only one line The example below shows a message sent by the master and a reply sent by the slave in response to a poll Slave responses are in boldface Message from master to slave and slave acknowledgement DLE SOH stn DLE STX message DLE ETX CRC DLE ACK Message sent from slave to master in response to poll and slave acknowledgement DLE ENQ stn BCC DLE STX message DLE ETX CRC DLE ACK Poll with a DLE EOT in response DLE ENQ stn BCC DLE EOT Use the following CRC example to verify your CRC routine DLE STX DST SRC CMD STS TNS ADDR SIZE DLE ETX CRC 10 02 11 07 01 00 4100 1200 0c 10 03 CF40 BCC EF SRC CMD STS TNS DATA DLE ETX CRC 11 41 00 4100 00 00 00 00 00 00 00 00 00 00 00 00 10 03 CF40 ENQ STN BCC 05 11 EF Line Monitor Examples
166. in words If the address is more general than a file address the size also includes the overhead memory used to maintain the file structure If the address specifies a file user data is returned C DST SRC pi STS TNS a PLC sys address CMD EXT pic Size Size Count R SRC DST 4F STS TNS STS PLES Low word High word word i PLC 5 Size Count Data word word type Size Size Count Privilege Data PEG S S word High word word write read type iF 1774 PLC MicroLogix 1000 PLC 2 PLC 3 PLC 5 SLC 500 SLC 5 03 SLC 5 04 Publication 1770 6 5 16 October 1996 The EXT STS field may be attached to the reply packet only when there is an error Important Some PLC 5 processors return the PLC 5 250 format reset diagnostic counters Resets all the diagnostic timers and counters in the node interface module 0 CMD FNC C DST SRC 06 STS TNS 07 R SRC DST os sts TNS id Ie Y BT Of e PLC 3 Communication Commands 7 23 restart request restart Terminates an upload or a download The computer cannot issue this command until after it has successfully completed an upload or download operation with the destination node This command causes the interface module to revoke the upload and download privileges for the source
167. ing 00 2 cess FUILSINIKS pec dsiecat ang maid Sacer eae gees ieni Simplified Network Layer 0 000 cee eeae Slave Transceiver Actions 0000 cece ee aes Half Duplex Protocol Diagrams 4 Normal Message Transfer 00000 eeae Message Transfer with Invalid BCC CRC Message Transfer with ACK Destroyed Poll with No Message Available Poll with Message Returned 0000005 Duplicate Message Transmission Message Sink Full Case 1 00 000s Message Sink Full Case 2 0000 00s Using Full duplex Protocol to Send and Receive Messages 2eeeeeeeee Full duplex Protocol Message Transmission Full duplex Protocol Environment Message Characteristics 0 00 cee eeeeee Transmitter and Receiver Message Transfer How the Transmitter Operates 0 5 How the Receiver Operates 00 0005 Full duplex Protocol Diagrams 0005 Normal Message Transfer 00 0005 Message Transfer with NAK 00005 Message Transfer with Timeout and ENQ Message Transfer with Re Transmission Message Transfer with Message Sink Full Message Transfer with NAK on Reply Message Transfer with Timeout and ENQ for the Reply Messag
168. ing report generation communication arithmetic and data file manipulation A controller consists of central processor input output interface and memory A controller is designed as an industrial control system remote node The node sending the reply to the local node Abbreviation Definition ACK acknowledgement In communication ACK is a control code sent by the receiving node to indicate that the data has been received without error and the next part of the transmission may be sent DH Data Highway Plus Allen Bradley proprietary network protocol NAK negative acknowledgement Publication Name Publication Number DH DH DH II DH485 Cable Installation Manual 1770 6 2 2 DH Overview Product Data 1770 2 39 DH Overview Product Data 1785 2 6 SCADA System Selection Guide AG 2 1 SCADA System Application Guide AG 6 5 8 1770 6 5 16 October 1996 Related Products About This Manual and DH485 networks including Catalog Number Product Allen Bradley offers a wide range of interfaces for the DH DH Related Documentation 1747 KE DH485 RS 232 Interface Module 1747 2 3 7 product data 1747 6 12 user manual 1770 KF2 DH or DH Asynchronous RS 232 or RS 422 A Interface 1770 6 5 13 user manual Module 1770 6 5 13 RN1 release notes 1770 KF3 DH485 Asynchronous RS 232 Interface Module 1770 6 5 18 user manual 1770 6 5 18 RN1 release notes 1770 6 5 18 RN2 rel
169. ings or software configuration Either field allows you to verify the accuracy of each message frame transmission e The BCC algorithm provides a medium level of data security it cannot detect transposition of bytes during transmission of a frame it cannot detect the insertion or deletion of the value zero within a frame The CRC field provides a higher level of data security than BCC but is more difficult to implement BCC Field We ve included both half and full duplex BCC examples Half duplex protocol example If the master node wants to send the hexadecimal data symbols 08 09 06 00 10 04 and 03 to slave node 2046 40 octal the master message symbols are 1001 20 10 02 08 0906 0010 10 04 03 10 03 B2 STN DLE STX APP DATA DLE DLE DLE ETX BCC The sum of the STN and application layer data bytes in this message frame is 4E 1g The BCC is the 2 s complement of this sum or B246 This is shown in the following binary calculation 0100 1110 sum 4E 1011 0001 1 s complement 1 1011 0010 2 s complement B246 BCC To transmit the STN or data value 10 hex you must use the data symbol DLE DLE You must also use the data symbol DLE DLE if your STN value is 10 Only one of these DLE bytes however is included in the BCC sum For example to transmit the data values 08 09 06 00 10 04 and 03 hex a slave node uses the following message symbols 10 02 08 09 06 00 10 100403 10 03 D2 DLE STX AP
170. its 1 Testing edits AJ o I Processor Type B PLC 5 E Expansion byte Processor Expansion Byte 15 1785 L40B PLC 5 40 22 1785 LT4 PLC 5 10 23 1785 L60B PLC 5 60 28 1785 L40L PLC 5 40 29 1785 L60L PLC 5 60 31 1785 L11B PLC 5 11 32 1785 L20B PLC 5 20 33 1785 L30B PLC 5 30 4A 1785 L20E PLC 5 20E 4B 1785 L40E PLC 5 40E 55 1785 L80B PLC 5 25 59 1785 L80E PLC 5 80E 4 7 all Size of user memory low word first low byte first 8 0 4 Series and revision of the PLC 5 0 Revision A 1 Revision B etc 0 Series A 1 Series B etc Processor number on DH Link all I O address Address of the processor if it is an adapter If it is a scanner value is OFDH 11 I O and communication parameters 0 Double density 1 Adapter mode 1 Module group 4 top half 1 Adapter is half rack 1 Data Highway Plus at 115K baud 12 13 all Number of data table files low byte first 14 15 all Number of data type files low byte first 16 0 Forcing status 1 Forces active Sub revision number of the PLC 5 processor 1 Forces are present in the tables 1 Forces are present in the tables 17 all Memory protect indication non zero means memory is protected 18 all Bad RAM indication non zero means RAM is bad must be cleared Pu
171. later reply DLE STX x x DLE ETX BCC CRC DLE NAK gt DLE STX xxxx DLE ETX BCC CRC not full lt lt XXXX __ DLE ACK _ gt pos OK Publication 1770 6 5 16 October 1996 4 16 Using Full duplex Protocol to Send and Receive Messages Message Transfer with Timeout and ENQ for the Reply In this transfer the message is successfully transmitted on the network e the receiver sends a reply from the network but the transmitter sends back a DLE ACK that is corrupted the receiver times out waiting for the DLE ACK and sends a DLE ENQ e the transmitter sends back a DLE ACK Source Transmitter Link Receiver Sink command XXX gt DLE STX xxxx DLE ETX BCC CRC _ lt notfull XXXX gt lt DLEACK lt 0K _ sometime later reply lt DLE STX xxxx DLE ETX BCC CRC _ not full lt XX DL CK _______ Timeout lt DLEENQ DLE ACK _________ OK Publication 1770 6 5 16 October 1996 Using Full duplex Protocol to Send and Receive Messages 4 17 Message Transfer with Message Source Full on the Reply In this transfer so the transmitter sends back a DLE NAK so the transmitter returns a DLE ACK Source Transmitter Link Receiver the message is
172. layer DH DH DH DH data link DF1 network DH485 data layer DH485 link layer Data link Layer This layer controls the flow of communication over the physical link and e determines the encoding of data on the physical medium e controls who transmits data and who listens using an arbitration protocol e conveys data packets intact from the source node to the destination node over the physical link If your link is Then you do not need to program this layer Your application programs on the network are not involved with inter node protocol handshaking or control of the link a DH DH or DH485 link the interface modules automatically take a DF1 link between Allen Bradley care of this layer Your application interface modules program does not have to be involved with handshaking control a DF1 link between an Allen Bradley you must program this layer at your interface module and a computer computer Programming the data link layer You can program the data link layer using DF1 protocol For more information see Chapter 3 Using Half duplex Protocol to Send and Receive Messages or Chapter 4 Using Full duplex Protocol to Send and Receive Messages Publication 1770 6 5 16 October 1996 1 8 Network Layers Publication 1770 6 5 16 October 1996 Application Layer This layer controls and executes the actual commands specified in the communication between nodes This layer is the same for both
173. ld Use This Manual me Preface About This Manual Read this preface to familiarize yourself with this manual This preface includes information on e the purpose of this manual e who should use this manual e what this manual contains terms and abbreviations used in this manual e related publications e related products e conventions used in this manual Use this manual to e program a DF1 driver for a computer to interface to Allen Bradley DF1 products and to proprietary networks via protocol bridges e write applications for 1784 KT KT2 KTX KTXD PCMK communication interfaces using standard Rockwell Software Inc RSI driver products troubleshoot your network Read this manual before you attempt to write a DF1 driver or before attempting to troubleshoot your network We assume that you are already familiar with e your serial device e Allen Bradley PLC processors Before you begin writing your driver make sure you have e apocket calculator that adds subtracts multiplies and divides in decimal hexidecimal octal and binary e a serial protocol analyzer for displaying actual hex bytes sent to and from a DH DH or DH485 module Writing drivers As an alternative to writing your own driver RSI provides RSLINX C SDK cat no 9355 WABC and INTERCHANGE cat nos 9351 AIX DKTS HPUS OSF VS WES WKTS software These products provide an application programmer s interface API and
174. lete the single transaction The TOTAL 2 bytes TRANS equals 56 01 01 56 hex 342 words decimal or 684 bytes If a file does not contain as many bytes as the TOTAL TRANS field the transaction is rejected and you receive an error code in the status and extended status fields ADDRESS 2C 08 Specifies the PLC 3 data table address where the word range read will start The combination of these variable number 0A 00 bytes specifies the address flag data table area context section file structure and word location where the of bytes command will be executed Not all commands need to specify all six levels For information on converting a PLC 3 address see page 13 4 In our example we read PLC 3 binary file 10 word 0 which converts to 2C 08 0A 00 SIZE E4 Specifies how many bytes of PLC 3 data table information you read in this transaction The word range read command reads a maximum of 244 bytes per message packet In this example each of the three commands reads 228 bytes E4 hex DLE ETX 2 bytes 1003 Indicates the termination of the message BCC block check 6C Used to check the accuracy of the message transmission You can optionally use CRC bytes here character The BCC value must equal the 2 s compliment of the 8 bit sum of all data bytes between DLE STX and DLE ETX For more information on BCC and CRC error checking see page 5 4 DLE ACK 10 06 Sent from the module 1770 KF2 back to the computer to indicate that the module s
175. ly received 49 Messages seen that were not for this node 50 DLE EOTs sent 51 Calls received 52 Times the phone was hung up by the module 53 DCD was lost 54 Times the phone was hung up because of a DCD timeout Diagnostic Counters 9 11 1770 KF2 and 1785 KE DH and Asynchronous Link Diagnostic Counters This counter byte Counts the number of 0 Times received ACK with bad CRC 1 Times timeout expired with no ACK received 2 Transmit re tries exhausted 3 NAK illegal protocol operation received 4 NAK bad LSAP received 5 NAK no memory received 6 Received ACK NAK too short 7 Received ACK NAK too long 8 Something other than an ACK NAK received 9 Token pass timeouts 10 Token pass re tries exhausted 11 Claim token sequence entered 12 Tokens claimed 13 Bad CRCs in received frame 14 NAK illegal protocol operations sent 15 NAK bad LSAPs sent 16 NAK no memory sent 17 Received frame too small 18 Received frame too long 19 Received a re transmission of a frame 20 Received frame aborted line noise 21 22 Messages successfully sent low byte first 23 24 Messages successfully received low byte first 25 26 Commands successfully sent low byte first 27 28 Replies successfully received low byte first 29 30 Commands successfully received low byte first 31 32 Replies successfully sent low byte first 3
176. mal l Even low byte Odd high byte Value A576 hex after byte swapping Publication 1770 6 5 16 October 1996 Chapter 1 2 Uploading and Downloading with A B Processors Read this chapter to help you perform uploads from and downloads to Allen Bradley processors It contains these sections Section Page Uploading from the Processor 12 2 Downloading to the Processor 12 6 Upload and download constraints When using the upload and download procedures described in this chapter remember e You can download only to a processor of the same type model series and revision that you upload the image from e You cannot give the uploaded image to a programming software package e You cannot download the 6200 Series software archive file using these procedures If yov d like additional information on the commands used in this chapter refer to Chapter 8 Message Packet Status Codes STS EXT STS For more information on PLC addressing refer to Chapter 14 Line Monitor Examples Publication 1770 6 5 16 October 1996 12 2 Uploading and Downloading with A B Processors Uploading from the Processor Publication 1770 6 5 16 October 1996 To make sure the program image is stable during an upload the PLC interface prohibits program changes during an upload When you are using the following procedures the interface blocks all access to PLC memory
177. mand does not reset the communication configuration c pst src CMD sts qns FNC OF 57 CMD EXT R SRC DST AF STS TNS STS The EXT STS field may be attached to the reply packet if an error occurs modify PLC 2 compatibility file Changes the compatibility mode file so that communication from a PLC 2 processor or a node emulating a PLC 2 processor at the given node address uses the file specified This change in the default file for PLC 2 compatibility mode remains in effect until this command is issued again to change it or until memory is cleared Cycling the power to the PLC 5 processor does not reset the default The link ID and node address are one byte each The file number is two bytes T CMD FNC Link Node File C DST SRC OF STS TNS 5E ID Addr h mb r CMD EXT R SRC DST AF STS TNS STS The EXT STS field may be attached to the reply packet if there is an error e SLC 500 e SLC 5 03 e SLC 5 04 e 1774 PLC if PLC 2 k PLC 3 ia Communication Commands 7 13 open file Opens a file in an SLC 500 processor If the file is successfully opened a Tag low byte high byte is returned Protection c pst src MP sts mns NO y Fie He R src ost M sts TNS Tag Protection Oth read 02h not sup
178. mber Some command messages may not be recorded because they were not successfully sent or they were sent back to the originating node 23 24 Command messages that were received to be executed a the link This count does not depend on whether execution was successful For each message counted as received a reply message is sent 25 26 Reply messages received that resulted in the setting of a done or remote error bit 27 Breaks sent to the industrial terminal 28 Times the PLC driver has to re synchronize with the PLC processor This counter always counts at least one re synch because of powerup 29 Errors on the KA to IT cable counts down module 5 Every time this count reaches zero the 1771 KA does a handshake to reset the forced I O table in the PLC processor Publication 1770 6 5 16 October 1996 9 16 Diagnostic Counters Publication 1770 6 5 16 October 1996 This counter byte 30 Counts the number of Replies lost because they could not be delivered over the DH link Undeliverable commands can be signaled to the user because the user is located in PC memory and can always be reached If a reply message cannot be delivered over the link there is no way to signal the user of that message who is also over the highway that this node cannot signal a reply The local user is not concerned with the problems of the remote user and can take no meaningful action so there i
179. mputer from a PLC 3 node you must write computer application programs that are capable of accepting these commands and interpreting the symbolic addresses PLC 5 Addressing PLC Addressing 13 9 PLC 5 processors support logical and physical addressing For information on See page logical addressing 13 10 physical addressing 13 16 floating point 13 17 Transmitting commands from PLC 5 processors To transmit commands from a PLC 5 processor to your computer set up a computer buffer to simulate a PLC 5 file and write computer application programs The programs must be capable of interpreting all the types of addressing formats that appear in the command messages Important PLC 5 processors can receive and transmit PLC 2 1774 PLC type command messages with the PLC 2 1774 PLC logical addressing format Before sending a PLC 2 1774 PLC command to a PLC 5 node you must first allocate a PLC 5 file with a file number that is the decimal equivalent of the PLC 2 1774 PLC s octal node number This file helps the PLC 5 to simulate PLC 2 1774 PLC memory Data is read from or written to this file number Publication 1770 6 5 16 October 1996 13 10 PLC Addressing PLC 5 Logical Addressing PLC 5 processors like PLC 3 processors use a form of logical addressing With logical addressing you specify the address for each level or sub division of PLC 5 memory down to the smallest subdivision you want to access With this process
180. n set some Allen Bradley interface modules so that they do not implement duplicate message detection In full duplex protocol messages are sent from the source part of software that supplies message packet through a transmitter device that sends data and then a receiver device that receives data to the sink part of the software that accepts the received data For See page structured text on how the transmitter operates 4 5 a flowchart of how the transmitter operates 4 6 structured text on how the receiver operates 4 7 a flowchart of how the receiver operates 4 9 Using Full duplex Protocol to Send and Receive Messages 4 5 How the Transmitter Operates The following program describes the actions of the transmitter Whenever the message source can supply a message packet and the transmitter is not busy it sends a frame on the link to the destination address It then starts a timeout and waits for a response When this response is received from the receiving address The message packet DLE ACK has been successfully transferred After signaling the message source that the message packet was successfully transmitted the transmitter proceeds with the next message packet DLE NAK is retransmitted The transmitter restarts the timeout and waits again for a response If it receives a DLE ACK the transmitter starts a timeout This can be repeated several times You can set a limit to the number of times a messa
181. n 10 15 1784 Cat Nos For status information from these cat nos See page 1784 KR 10 15 1784 KT KT2 10 15 1784 KR Status Bytes Bytes Bits Contents Description 1 0 7 Mode Status 00 no modes 2 0 7 Type Extender FE 3 0 7 Extended Interface Type 24 4 0 7 Not used 00 5 0 4 Series Revision 0 release 1 release 2 etc 5 7 0 series A 1 series B etc 6 16 all Bulletin Number Name in ASCII 1784 KR 17 24 all Product Specific Information 00 1784 KT KT2 Status Bytes Bytes Bits Contents Description 1 0 7 PLC Mode 00 2 0 7 Interface Type FE 3 0 7 Interface Type Extension 1B 4 6 all Reserved 7 0 7 Pointer to Diagnostic Counters 44 low byte 8 0 7 41 high byte 9 0 7 Revision 03 10 0 7 Option Switches 00 11 18 all Unused 20 Publication 1770 6 5 16 October 1996 10 16 1785 Cat Nos Diagnostic Status Information For status information from these cat nos See page 1785 KA 10 16 1785 KA3 10 17 1785 KE 10 19 1785 KA5 10 17 1785 LT PLC 5 15 and 6008 LTV PLC 5 VME controllers 10 20 1785 LT3 PLC 5 12 and 1785 LT3 PLC 5 25 controllers 10 22 1785 KA Status Bytes Bytes Bits Contents Description 1 Operating status of PLC processor For the 1785 KA this byte has one of these values 0 standby mode 1 on line mode 2 0 3 Type of interface module and processor E Check interface module expansion byte byte 3 4 7
182. n 1770 6 5 16 October 1996 4 14 Using Full duplex Protocol to Send and Receive Messages Publication 1770 6 5 16 October 1996 Message Transfer with Message Sink Full In this transfer e the transmitter sends a message but the message sink is full so the receiver sends back a DLE NAK e the transmitter retransmits and the sink is no longer full so the receiver returns a DLE ACK e areply is successfully returned Source Transmitter Link Rece iver Sink command XXXX gt lt 0K sometim reply not full lt XXX DLE STX xxxx DLE ETX BCC CRC _ gt DLE NAK DLE STX xxxx DLE ETX BCC CRC _ gt DIENAK DLE STX xxxx DLE ETX BCC CRC a e later DLE ACK lt DLE STX xxxx DLE ETX BCC CRC DLE ACK _ gt Full Full lt not full c xx OK gt Using Full duplex Protocol to Send and Receive Messages 4 15 Message Transfer with NAK on Reply In this transfer the message is successfully transmitted on the network the reply is corrupted and the transmitter responds with a DLE NAK the reply is sent again and is successful Source Transmitter Link Receiver Sink command XXXX gt DLE STX xxxx DLE ETX BCC CRC lt not full XXXX gt DLEACK lt OK _ sometime
183. nd revision level of interface 0 Revision A module 1 Revision B etc 5 7 0 Series A 1 Series B etc 10 0 1 Settings of the option switches on the 0 Undefined 1 Undefined node interface module 2 Undefined 3 not used 2 0 PLC 2 processor 1 All other PLC 2 Family processors 3 0 Protected commands disabled 1 Protected commands enabled 4 0 Unprotected commands disabled 1 Unprotected commands enabled 5 Not used 6 0 Physical writes disabled 1 Physical writes enabled 7 0 Transmission unprotected commands disabled 1 Transmission unprotected commands enabled 11 0 0 No terminal directly connected 1 Terminal directly connected 1 0 No terminal is editing over DH link 1 A terminal is editing over DH link 2 0 Directly connected terminal is not editing 1 Directly connected terminal is editing 3 7 Not used will be set to zeros 12 0 2 Indicates the number of I O racks the 3 PLC 2 is configured for 0 No I O points are currently forced on or off 1 An I O point has been forced on or off since the last time the directly connected terminal was connected Important This bit is set until the directly connected terminal is disconnected or returns to the mode select screen even if the forces have subsequently been removed Publication 1770 6 5 16 October 1996 Diagnostic Status Information 10 19 1785 KE Status Bytes Bytes Bits C
184. ng as 100 feet 30 48 meters each Each node is at the end of a drop cable and connects to the DH link through a station connector cat no 1770 SC This is the only configuration tested and supported by Allen Bradley This processor Connects to a DH link through the f DH PLC 2 family communication adapter module PUEA famiy cat nos 1771 KA2 KG PLC 3 DH PLC 3 family communication adapter module cat nos 1775 KA S5 SR5 PLC 5 250 Resource manager module cat nos 5130 KA RM1 RM2 DH DH communication module praetor cat no 1785 KA Although a PLC 5 processor does not directly connect to a DH link it can communicate with devices on a DH link via the 1785 KA module A DH link implements peer to peer communication through a scheme called the floating master With this arrangement each node has equal access to become the master The nodes bid for temporary mastership based on their need to send information Publication 1770 6 5 16 October 1996 1 4 Network Layers Unlike a master slave relationship a floating master relationship does not require the current master to poll each node to grant permission to transmit Therefore it provides a more efficient network because there is less overhead e time per transaction
185. nitiator reply messages responsible for interpreting and executing the command message command executor The executor must issue a reply message for each command it receives If the executor cannot execute a commana it must send the appropriate error code Internally Allen Bradley asynchronous interface modules use a routing subroutine and a message queue When the module receives a message over its asynchronous link it puts the message in its queue The routing subroutine then takes the message from the queue and transmits it over the DH DH or DH485 network The module also queues messages received from the network The routing subroutine takes these messages and retransmits them over the asynchronous link If this layer Cannot deliver a It should generate a reply message with the command message appropriate error code and send the reply to application the initiator destroy the reply without notification to the reply message Py g command executor message over the return an error message to the command data link ats asynchronous link initiator Message Packet Format packet format Command Reply read write The bytes are shown from left to right in the order they are transmitted across the link Application Layer Message Packets Most devices send and receive messages using this message 6 3 DST Command specific SRC CMD STS TNS data packet
186. nt 11 Messages that could not be successfully sent 12 Reply messages that could not be forwarded and were destroyed 13 14 Messages received 15 16 ACKs sent 17 NAKs sent 18 ENQs received 19 Re transmissions received and ACKed A re transmission is a message that has a transparent word command and source that match the previous message 20 STX full duplex mode or SOH half duplex mode received This is a count of the number of messages that were started 21 Messages characters or message fragments that were ignored 22 Messages that were aborted by receipt of a DLE ENQ 23 Messages that were aborted by the receipt of an unexpected control code other than DLE ENQ 24 Times DLE ACK response was delayed because of a lack of buffer space for the next message 25 Times reply was changed from ACK to NAK because unexpected characters any besides DLE ENQ were received while waiting for memory to free up 26 Broadcast messages received 27 Broadcast messages that were successfully received 28 Messages seen that were not for this node 29 Poll messages received for this node 30 DLE EOTs sent 31 Calls received 32 Times phone was hung up by the module 33 Times DCD was lost 34 Times the phone was hung up because of a DCD timeout Publication 1770 6 5 16 October 1996 9 20 Diagnostic Counters Publication 1770 6 5 16 October 1996 Internal Event Counters This counter byte Counts the number o
187. nted by xxxx and corrupted data by For this diagram Seepage normal message transfer o A0 message transfer with NAK 4 11 message transfer with timeout amp ENQ 4 12 message transfer with re transmission 4 13 message transfer with message sink full 4 14 message transfer with NAK on reply 4 15 message transfer with timeout and ENQ for the reply 4 16 message transfer with message source full on the reply 4 17 Normal Message Transfer In this transfer e the transmitter sends the data to the receiver the sink sends a not full message e the receiver sends the data to the sink and sends a DLE ACK to the transmitter e the transmitter tells the source that the data was delivered e reply is successfully returned Source Transmitter Link Receiver Sink command XXXX gt DLE STX xxxx DLE ETX BCC CRC gt lt not full XXXX gt DLE ACK lt OK _ sometime later lt DLE STX xxxx DLE ETX BCC CRC reply not full lt lt XXX DLE ACK _ gt OK Publication 1770 6 5 16 October 1996 Using Full duplex Protocol to Send and Receive Messages 4 11 Message Transfer with NAK In this transfer the transmitter sends corrupted data to the receiver and the receiver responds with a DLE NAK e the transmitter retransmits and the transmission is successf
188. o long 8 Times something other than an ACK NAK received 9 Duplicate tokens found 10 Duplicate nodes found 11 Token pass timeouts 12 Token pass retries exhausted 13 Claim token sequences entered 14 Tokens claimed 15 Bad CRC in received frame 16 NAKs sent due to an illegal protocol operation 17 NAKs sent due to a bad LSAP 18 NAKs sent due to memory available 19 Received frames that were too short 20 Received frames that were too long 21 Frame retransmissions received 22 Received frames aborted line noise 23 24 Messages successfully sent low byte first 25 26 Messages successfully received low byte first 27 28 Commands successfully sent low byte first 29 30 Replies successfully received low byte first 31 32 Commands successfully received low byte first 33 34 Replies successfully sent low byte first 35 Replies that could not be sent low byte first 36 Number of active nodes 37 Breaks sent to the IT 38 PLC 2 resyncs 39 T3 errors to go before force table cleared max 5 40 Edit connections requested 41 Edit connections granted 42 Edit connections that timed out Diagnostic Counters 9 29 1785 KA5 DH Diagnostic Counters This counter byte Counts the number of 0 1 Timeouts that expired with no ACK received 2 Transmit retries exhausted 3 NAKs due to illegal protocol operations
189. o then send DLE NAK else if message is too small then send DLE NAK else if message is too large then send DLE NAK else if header is same as last message send a DLE ACK else if message sink is full send DLE NAK else begin send message to message sink send a DLE ACK save a last header end end else if DLE ENQ then send LAST RESPONSE else LAST RESPONSE NAK end loop GET SYMBOL is defined as loop GET CHAR if char is not DLE begin add char to BCC return the char and data flag end else begin GET CHAR if char is a DLE begin add char to BCC return DLE and data flag end else if char is an ACK or NAK send it to the transmitter else if char is an ETX begin GET CHAR add char to BCC return ETX with a control flag end else return char with a control flag end end loop Using Full duplex Protocol to Send and Receive Messages 4 9 The following flowchart is the software logic for implementing the receiver LAST NAK Received Yes DLE ENQ No Received message LAST NAK Yes LAST ACK y gt Send DLE LAST lt Publication 1770 6 5 16 October 1996 4 10 Using Full duplex Protocol to Send and Receive Messages Full duplex Protocol These transfer diagrams show events that occur on various Diag rams interfaces Time is represented as increasing from the top of the diagram to the bottom Link layer data bytes are represe
190. on download request see page 7 8 Shut down the PLC 3 processor using shutdown request For more on shutdown request see page 7 28 Download the information using one or more physical writes For more on physical write see page 7 14 Verify that the information transferred properly using physical read For more on physical read see page 7 13 Exit the download mode using restart request For more on restart request see page 7 23 Downloading to a PLC 5 Processor If you have this PLC 5 processor Then PLC 5 15 B Rev E and earlier Follow procedure 1 on page 12 9 ae pieso ePLC 5 12 o aE e PLC 5 40E eae P Rev E and laig e PLC 5 40L Follow procedure 2 on page 12 10 ePLC 5 20E SE ao ePLC 5 25 era ePLC 5 30 e PLC 5 80E Uploading and Downloading with A B Processors 12 9 Procedure 1 PLC 5 15 B rev E and earlier 1 Place the PLC 5 processor in Program or Remote Program mode using set CPU mode or the keyswitch on the front of the processor For more on set CPU mode see page 7 26 2 Place the PLC 5 processor in Download mode using download all request For more on download all request see page 7 8 This command locks out all other users from accessing the PLC 5 processor Important When you send a download all request a 90 second timer is started A write bytes physical resets this timer If the timer times out after 90 seconds the PLC 5 processor automatically returns to the previous mode of
191. ontents Description 1 all Operating status of PLC processor For the 1785 KE this byte is always 0 2 0 3 Type of interface module and processor E Check interface module expansion byte byte3 4 7 F Computer 3 all Interface Module Expansion Byte 19 1785 KE 4 all 00 not used 5 6 all This is a pointer to the Active Node low byte first Table 7 8 all This is a pointer to diagnostic counters low byte first 9 0 4 Series and revision level of the module 0 Revision A 1 Revision B etc 5 7 0 Series A 1 Series B etc 10 0 1 Settings of the option switched on the 0 57 600 bits per second Data Highway Plus baud rate 2 module DSR 3 7 Option Switch Settings bit set to 0 is ON Publication 1770 6 5 16 October 1996 10 20 Diagnostic Status Information 1785 LT PLC 5 15 and 6008 LTV PLC 5 VME Status Bytes Bytes Bits Contents Description 1 0 2 Operating status of PLC 5 processor 0 Program load 1 Not used 2 Run mode 3 Not used 4 Remote program load 5 Remote test 6 Remote run 7 Not used 3 0 Normal 1 Major processor fault 4 0 Normal 1 Download mode Not used 0 Not testing edits 1 Testing edits 7 0 No edits in processor 1 edits in processor 2 0 3 Processor Type B PLC 5 4 7 B 1785 LT PLC 5 15 C 6008 LTV PLC 5 VME 3 6 Size of user memory low word first low byte
192. operation If your download takes more than 90 seconds reset the timer using write bytes physical within the 90 second limit 3 Download the first 14 bytes of PLC 5 memory using write bytes physical For more on write bytes physical see page 7 35 4 Download the rest of PLC 5 memory starting at location OAO0 hex to 3FFO hex Downloading PLC 5 memory You can download all PLC 5 memory with 107 write bytes physical of 128 bytes plus one write byte physical of 112 bytes You can only write 112 bytes to address 3F80 hex If you write more an error is returned 5 Verify that the information is transferred properly by using read bytes physical For more on read bytes physical see page 7 19 6 Exit the download mode using download completed For more on download completed see page 7 7 Publication 1770 6 5 16 October 1996 12 10 Uploading and Downloading with A B Processors Publication 1770 6 5 16 October 1996 Procedure 2 1 Verify the processor type using diagnostic status For more on diagnostic status see page 7 6 Place the PLC 5 processor in Program or Remote program mode using set CPU mode or the keyswitch on the front of the processor For more on set CPU mode see page 7 26 Place the PLC 5 processor in Download mode using download all request For more on download all request see page 7 7 Send PLC 5 memory information to the appropriate physical addresses in PLC 5 memo
193. or SIZE is 0 The command is an illegal request to read from the PLC 3 interface module s backplane window diagnostic status A backplane error occurred during determination of the physical address of the end of the ladder diagram program or of the end of user memory PLC PLC 2 word write 10 A two byte ADDR field is expected after the TNS word but only one byte is present There is an odd number of data bytes in the command packet eThe ADDR value is odd that is it does not specify a word address The local PLC 3 interface module has executed a shutdown request to the local PLC 3 processor Local PLC 3 backplane error either memory parity timeout or disconnect e The destination file does not exist in PLC 3 memory e The destination word does not exist in the destination PLC 3 file The length of the destination file is greater than 65 535 words Local keyswitch setting prohibits writing into desired destination file The local PLC 3 processor is in Program mode There may be a major system fault Publication 1770 6 5 16 October 1996 Command PLC PLC 2 read Message Packet Status Codes STS EXT STS 8 7 EXT STS Code STS Code 10 Explanation e The required two byte ADDR field and one byte SIZE field are missing in the command message e The ADDR value is odd that is it does not specify a word address The value of SIZE is 0 The value of SIZE i
194. or You can specify up to PLC 5 4 levels of extended addressing which is enough to address any word in PLC 5 memory PLC 5 250 7 levels of extended addressing which is enough to address any word in PLC 5 250 memory To send a command message to a PLC 5 node you put the extended address of the node in the field labelled PLC 5 SYSTEM ADDRESS in the message block formats of your program See Chapter 7 Communication Commands There are two types of PLC 5 logical addressing Logical Addressing Processors Description Page Type logical binary PLC 5 A series of bytes used to encode up 13 11 addressing to 4 levels of an address PLC 5 250 A series of bytes used to encode up 13 13 to 7 levels of an address logical ASCII PLC 5 and User specified address in the same 13 15 addressing PLC 5 250 form that you use at the programming node This addressing lets any device communicate with any other device without knowing the internal memory structure of the target device Publication 1770 6 5 16 October 1996 PLC Addressing 13 11 PLC 5 Logical Binary Addressing yte 1 ontents the mask byte This byte determines which four levels of the address are specified The mask is read from the LSB to the MSB If a level of an address is not specified it uses the default value which is always 0 except for the file number which has a default of 1 You must always specify the last level of an a
195. orcing function for I O All forcing data is ignored but remains intact c pst src CMD sts ts FNC OF 41 e MicroLogix 1000 CMD EXT PCS R SRC DST AF STS TNS STS e PLC 5 250 receive only e SLC 500 e SLC 5 03 e SLC 5 04 disable outputs e 1774 PLC Turns off all of the 1774 PLC processor s outputs Use this command to disable the outputs before sending a physical write CMD FNC C DST SRC 07 STS TNS 00 R SRC DST T STS TNS Publication 1770 6 5 16 October 1996 id Ie Y BT of g ps e PLC 5 e PLC 5 250 receive only e PLC 5 VME e PLC 5 PLC 5 250 receive only PLC 5 VME SLC 500 SLC 5 03 SLC 5 04 Communication Commands 7 7 download all request download Places a PLC 5 processor in Download mode before downloading a complete system A no privilege error is returned if the requestor does not have privilege to place the processor in Download mode This error occurs when e the processor is in Run or Remote Run mode must be in Program or Remote Program mode e the processor is being edited some other node is already downloading to the processor CMD FNC C DST SRC OF STS TNS 50 CMD EXT R SRC DST AF STS TNS STS The EXT STS field may be attache
196. ork and the receiving node execute commands based on network conditions including but not limited to e nodes buffering commands e retries due to noise on the network e priority levels If your application requires that commands be delivered in a specific order your logic must control the initiation of one command at a time on the network and verify delivery before initiating additional commands This verification is completed by e adone bit or an error bit in a PLC processor areply message in a computer A done bit or a successful reply causes the next command to be initiated If an error bit or a reply with non zero status is returned you must decide the appropriate action based on your application Important If any node on the network initiates multiple commands for example the sending node sets multiple bits at any one time the order in which these commands get executed at the receiving node cannot be guaranteed Network Layers 1 11 Types of Commands From your computer on a DF1 link to a node on a DH DH or DH485 link you can send four types of commands e read e write e diagnostic e upload download For additional information on the commands you can send see Chapter 7 Communication Commands Error Codes When your computer sends a command on the asynchronous link a status code is returned in the reply message This code tells you the status of the command sent from your computer You mu
197. ors SLC 5 03 and 5 04 processors 1747 KE DH485 Diagnostic Counters This counter byte Counts the number of Total message packets received low byte Total message packets received high byte Total message packets sent low byte Total message packets sent high byte Message packet retries Retry limit exceeded non delivery NAK no memory sent NAK no memory received Total bad message packets received Ol WOIN DBD om A ws rm oOo Reserved 1747 L20 L30 L40 L511 L514 L524 SLC 500 5 01 and 5 02 processors 1747 PA2x SLC APS COM1 1770 KF3 and 1784 KR DH485 Diagnostic Counters This counter byte Counts the number of Total message packets received low byte Total message packets received high byte Total message packets sent low byte Total message packets sent high byte Message packet retries Retry limit exceeded NAK no memory sent NAK no memory received Total bad message packets received Ol MOI N oa om amp wo me o Bad messages due to illegal type Publication 1770 6 5 16 October 1996 9 4 Diagnostic Counters Publication 1770 6 5 16 October 1996 1747 L541 L542 and L543 SLC 5 04 processors DH Diagnostic Counters This counter byte Counts the number of 0 1 Messages received 2 3 Messag
198. physical address for each command When you store PLC 5 memory information to an archive file in your computer you must also store this information to perform the download procedure e physical addresses from where the memory information came number of bytes uploaded from each PLC 5 physical address contained in read bytes physical Exit Upload mode using upload completed For more on upload completed see page 7 34 Verify the upload by repeating the steps 1 and 2 but instead of writing the data to a file compare it to the data that you previously stored in the file Terminate the processor upload operation using upload completed For more on upload completed see page 7 34 Publication 1770 6 5 16 October 1996 12 6 Uploading and Downloading with A B Processors Downloading to the Processor Publication 1770 6 5 16 October 1996 Uploading from an SLC 500 Processor 1 Open the directory to be read using open file For more on open file see page 7 13 2 Read the directory using file read For more on file read see page 7 10 File read This may take more than one transaction 3 Read all other processor files using logical reads For more on logical reads see page 7 17 4 Close the program file 0 using close file For more on close file see page 7 5 A download replaces the program in an SLC processor Important This process may take several seconds to complete Therefore you mu
199. place value that is a multiple of 16 To convert a hexadecimal number to its decimal equivalent multiply each hexadecimal digit by its corresponding place value and add the results of the multiplications Hexadecimal Representation of Decimal 423 Publication 1770 6 5 16 October 1996 0x23 0 0x168 0 0x22 0 m 0x2 0 0x20 0 0x23 0 1x162 256 0x22 0 0x2 0 1x20 1 1x 23 8 10 x 16 160 0x22 0 1x2l 2 0x2 0 0x2 0 7x16 7 1x22 4 1x21 2 0x2 1 0 010 011 1101101 0 11 11 Data Encoding 11 5 Octal The octal number system is another easy way to represent binary data This system uses the eight digits 0 through 7 Each group of three data bits represents one octal digit between 0 and 7 This factor presents a slight conversion problem because bytes and words usually contain an even number of bits Thus an 8 bit byte can have an octal value between 0 and 377 while a 16 bit word can have an octal value between 0 and 177777 Each digit of an octal number has a place value that is a multiple of 8 To convert from octal to decimal multiply each octal digit by its corresponding place value and add the results of the multiplications Octal Representation of Decimal 239 1x21 2 3x82 192 1x20 1 1x22 4 5x8l 40 0x21 0 m 1x20 4 1x22 4 7x80 7 1x21 2 1x20 1 1 1 14 0 1 41
200. port configuration bit write write bit change mode COSE ile 2 cancax ws aca eaaawean diagnostic status disable forces 000 eee disable outputs download all request download download completed download request download privilege T 7 ba ne T N 7 ne hi rh ih joo i joo T joo S joo i p gt T A T p gt i on T D i N iy N T N T ak is ne T co T joo T joo ra A T A T A T cn a D T N ia for a co ih ss i i E iy E T on D o I s D ji D ii D T N 7 N fi fo iv Table of Contents OCNO vcs eet iyon wee Rew ee eae ee SN Se ae ee enable outputs 0 eee eee enable PLC scanning 0 0 0 cece eee e ees enter download mode 0 cc cece eee eee aes enter upload Mode 1 ee eee exit download upload mode 00eee eens file read read file 1 0 ccc eee ees file write write file 2 ee eee eee get edit resource nnan cece eee ees initialize memory wk ee ees modify PLC 2 compatibility fle OPONING Soe san aeni ia dean eee eee physical read 2 eee eens physical write nanan eee eee protected bit write 2 0 0 cece eee eee eee protected typed file read 1 eee eee protected typed file w
201. ported 03h read write Tag is used to access the open file using a protected type file read or protected type file write Tag is also used to close the file The Tag field may be replaced by an EXT STS field if there is an error physical read Uploads data from the PLC data table or program memory 1774 PLC and PLC 2 C pst src ae STS TNS ADDR SIZE R SRC DST He STS TNS Data max 244 bytes Use the SIZE field to specify the number of bytes to be read To specify a number of PLC words SIZE should be an even value because PLC words are two bytes PLC 3 For PLC 3 processors the destination interface module accepts this command only after the source node has successfully transmitted a shutdown request DST SRC ye STS TNS a PLC 3 phys address Size CMD Data max 244 bytes SRG DST 4F STS TNS or 122 words This command must request an even number of bytes The EXT STS field may replace the DATA field if there is an error Publication 1770 6 5 16 October 1996 7 14 Communication Commands e PLC 2 e 1774 PLC e PLC 3 Publication 1770 6 5 16 October 1996 physical write Downloads data into the PLC data table or program memory Use this command to download the contents of a computer file into PLC memory PLC 2 For PLC 2 processors enter download mode
202. pprox 1 sec 1775 KA 40 128 cycles approx 3 sec 1785 KE 29 128 cycles approx 4 5 sec set variables Sets the maximum ENQs NAKs and timeout all at once i e PLC 2 This command is a combination of the set NAKs set CPU mode and Bul e PLC3 set timeout commands LJ e PLC 5 a EE C DST SRC H STS TNS i DATA 3 bytes R SRC DST oe STS TNS DATA Put the timeout setting in the first byte the NAKs setting in the second byte and the ENQs in the third byte Publication 1770 6 5 16 October 1996 7 28 Communication Commands e PLC 3 ie So i e PLC 5 e PLC 5 VME e SLC 5 03 e SLC 5 04 p Publication 1770 6 5 16 October 1996 c shutdown Asks the interface module to initiate either a PLC 3 shutdown if the computer has download privileges or a freeze on file allocations if the computer has upload privileges The computer cannot issue this command until it has successfully transmitted an upload or download request to the module The EXT STS field may be attached to the reply packet only when there is an error CMD FNC C DST SRC OF STS TNS 07 CMD EXT R SRC DST AF STS TNS STS typed read read block Reads a block of data from the processor starting at the PLC 5 system address plus the packet offset T T CMD FNC Packet Total DST SRC OF S
203. present a logical address Before using a symbolic address in a message you must first define the symbol at the PLC 3 processor that is to receive the message For more information refer to your PLC 3 user manual The symbolic address field can be from 1 to 8 bytes long e The first byte contains the ASCII code for the first character in the symbol name e The second byte contains the ASCII code for the second character e and so on If the symbol name is more than 8 characters long encode only the first 8 characters This module Accepts 1775 KA ASCII symbols 1775 S5 SR5 eASCII symbols elogical ASCII All revision levels of 1775 S5 SR5 accept PLC 5 type reads and type writes 1775 S5 SR5 series A revision E or later can also use logical ASCII with a PLC 3 word range read or word range write Example of logical ASCII 00 N0 0 00 hex ASCI hex byte byte l To use a symbolic address in a command message encode the symbol in the field labelled ASCII symbol in the command message formats See Chapter 7 Communication Commands The message formats show a byte of value zero before and after the symbolic address field You must include these zero bytes because they act as delimiters to distinguish the symbolic address from other fields in the message Important Only PLC 3 controllers can transmit commands that contain symbolic addresses If you plan to transmit this type of command message to your co
204. priate remote error code in the STS byte remote The STS byte is divided into two nibbles 4 bits each Bt 7 6 5 4 3 2 1 0 contains errors found by the Remote E Local E remote node receiving the gt Omare Emar oca Error contains errors found by command Nibble Nibble the local node Local STS Error Codes The local STS error code nibble contains errors found by the local node Error codes in hex that you may find in the local error code nibble include Code Explanation 00 Success no error 01 DST node is out of buffer space 02 Cannot guarantee delivery link layer The remote node specified does not ACK command 03 Duplicate token holder detected 04 Local port is disconnected 05 Application layer timed out waiting for a response 06 Duplicate node detected 07 Station is offline 08 Hardware fault Local STS codes 09 through OF hex are not used Publication 1770 6 5 16 October 1996 Message Packet Status Codes STS EXT STS Remote STS Error Codes The remote STS error code nibble contains errors found by the remote node receiving the command Error codes in hex that you may find in the remote error code nibble of the STS byte include Code Explanation 00 Success no error 10 Illegal command or format 20 Host has a problem and will not communicate 30 Remote node host is missing disconnected or shut down 40 Ho
205. r file starting at a specified address A special case of this command is the single word write where the data field is only one word long e PLC 3 eS PEGS CMD FNC Packet Total f acke ola Data max 240 bytes C DST SRC OF STS TNS 00 Offset Trans PLC system address the PLC address field CMD EXT R SRC DST AF STS TNS STS The EXT STS field may be attached to the reply packet only when there is an error For this processor The starting address can be a PLC 3 word symbol file symbol plus a word offset or a block address The starting address must point to a word in a file PLC 5 logical binary address or a logical ASCII address of up to 51 bytes write bytes physical physical write Performs a download only after receiving a reply that the download or upload all request has been successfully performed e PLC 5 e PLC 5 VME C DST SRC m STS TNS m PLCs phys address A CMD EXT R SRC DST AF STS TNS STS The EXT STS field may be attached to the reply packet only when there is an error PLC 5 physical address contains the address you are writing to A Up to 238 bytes can be written with a single command low byte of the word first Must be an even number of data bytes Publication 1770 6 5 16 October 1996 7 36 Communication Commands PLC 5 Type Data Parameter Examples Publi
206. r loss 1 high byte startup protect fault 2 load memory module on error 3 load memory module always 4 load memory module and run 5 major error processor halted 6 locked 7 first pass bit 21 0 7 program ID low byte 22 0 7 high byte 23 0 7 processor RAM size in Kbytes 24 0 directory file corrupted not used 0 2 7 program owner node address 00 1F program owner node address 3F no program owner SLC 5 02 processors only Publication 1770 6 5 16 October 1996 10 4 Diagnostic Status Information 1747 L532 L541 L542 L543 SLC 5 03 and SLC 5 04 processors Status Bytes Bytes Bits Contents Description 1 0 5 mode status 00 6 testing edits 7 edits in processor 0 7 type extender EE 0 7 extended interface type 20 DH485 on port 0 RS 232 31 DH on port 1 via domino plug 34 DF1 full duplex protocol on port 0 36 DF1 half duplex protocol on port 0 4 0 7 extended processor type 49 rack type 1747 15340 5B rack type 1747 L534 5 0 4 series revision 0 firmware release1 1 firmware release 2 etc 5 7 0 series A 1 series B etc 6 16 all bulletin number name 5 03 1747 L532 in ASCII 5 04 1747 L542 Product specific Information 17 all major error word low byte 18 all major error word high byte 19 0 4 processor mode status control word 00000 download 00001 remote PROG 00011
207. r physical writes See Chapter 7 Communication Commands A physical address is made of 24 bits These bits are inserted in the message packet physical address field as follows Bits are labelled Al to A24 respectively Function FNC Field First byte A24 A23 A22 A21 A20 A19 A18 A17 Second byte 0 0 0 0 0 0 0 0 Third byte A8 A7 A6 A5 A4 A3 A2 A1 Fourth byte A16 A15 A14 A13 A12 A11 A10 A9 Size Field For example to address a command message to physical word address 12 200 decimal 002FA8 hex you use the following binary code in the address field First byte 0 0 0 0 0 0 0 0 value 00 hex Second byte 0 0 0 0 0 0 0 0 always 00 hex Third byte 1 0 1 0 1 0 0 0 values A8 hex Fourth byte 0 0 1 0 1 1 1 1 value 2F hex The recommended procedure for uploading or downloading PLC 3 memory is to begin at physical address 0000 and proceed sequentially to the end of memory Therefore each successive physical read or write begins at the next physical address after the one where the previous command stopped Since a single physical read or write command can transfer only about 120 words of data it takes many such commands to upload or download the entire PLC 3 memory Publication 1770 6 5 16 October 1996 13 8 PLC Addressing Publication 1770 6 5 16 October 1996 PLC 3 Symbolic Addressing Symbolic addressing uses ASCH symbols to re
208. r than 65 535 FO The source node does not have access to the DST file Publication 1770 6 5 16 October 1996 Command PLC 3 physical reads Message Packet Status Codes STS EXT STS 8 9 EXT STS Code STS Code 10 Explanation There is more than one byte of data after the byte address e The number of bytes to read is an odd number equals zero is greater than the maximum allowed in a reply packet 244 eThe sum of packet offset and size of data in words is greater than 65 535 e The sum of packet offset and size of data in words is greater than the total transaction size 30 The local PLC 3 interface module has executed a shutdown request 40 A backplane error memory parity timeout or disconnect has occurred 70 The local PLC 3 processor is in Program mode FO There was an error converting the block address major section gt 63 context gt 15 section gt 15 FO Three or fewer addressing levels specified for a PLC 3 word address FO The conversion of a file address to a block address resulted in more than nine addressing levels FO The symbolic address was not found FO The symbolic address is zero or more than eight bytes FO The file was not found e DST address does not have enough levels to specify a PLC 3 word for word range reads or a file for file reads eThe PLC 3 address specifies more levels th
209. range is 0 225 bytes odd or even without internet protocol valid range is 0 236 bytes odd or even Publication 1770 6 5 16 October 1996 7 32 Communication Commands 1774 PLC PLC 2 PLC 3 PLC 5 SLC 500 MicroLogix 1000 Publication 1770 6 5 16 October 1996 unprotected write 1774 PLC PLC 2 PLC 3 PLC 5 Writes words of data into any area of PLC and PLC 2 data table memory In PLC 3 and PLC 5 processors the data is written into the PLC 2 compatibility file C DST SRC oe STS TNS ADDR Data max 244 bytes R SRC DST he sts TNS SLC 500 MicroLogix 1000 Writes data to a common interface file CIF The SLC CIF is data file number 9 the MicroLogix CIF is integer file 7 Data size implied by CMD Address C DST SRC g STS TNS Low High data sent R SRC DST oe STS TNS Address Logical offset into the CIF Value is in words or bytes as shown below SLC 500 SLC 5 01 and SLC 5 02 SLC 5 02 prior to series C FRN 3 processors use word addressing SLC 5 02 series C FRN 3 and later SLC 5 03 and SLC 5 04 processors select word or byte addressing for S 2 8 0 default word addressing is used for S 2 8 1 byte addressing is used Data Data to be written This size of the data is implied by the number of data bytes sent for SLC 500 SLC 5 01 and SLC 5 02 p
210. rce Manager Module 5000 6 2 1 design manual 5000 6 2 10 installation manual 9351 AIX INTERCHANGE Software DKTS HPUS OSF VS WES WKTS 9355 WABC RSLINX C SDK Software 1770 6 5 16 October 1996 5000 6 4 21 reference manual 9398 WABCTD 11 21 95 data sheet Conventions Used in This Manual About This Manual P 5 Communication diagnostic and driver software DH 6001 NET Network Communications Software Series 6001 provides a DH driver for many DEC computers For more information refer to the DH DH DH II Network Communication Software Overview publication 6006 2 3 We use these conventions in this manual This convention Is used to p call attention to helpful information 2 refer you to other Allen Bradley documents that might be useful 1770 6 5 16 October 1996 E Network Basics iil Network Layers Chapter 1 Chapter 1 Network Layers Your network is made up of several layers including ge Nodes send data through the layers mim C10 Application layer serves as the window through which applications access communication services including file transfers virtual terminal functions and email g Presentation layer manages data formats for the applications Session layer establishes and terminates network communications between applications Transport layer performs segmentation and re assem
211. rite 2 0 20 0 cee eee ee eee protected typed logical read with three address fields protected typed logical write with three address fields protected write 2 1 cece eee read bytes physical physical read 0 read diagnostic counters 6 ees read link parameters 0 cece cece neces read modify write write bit 0 0 00 c ee eae read modify writeN 2 20 ce eee eee eee read section size civic cust ech ewy eed Veron tees nees reset diagnostic counters 00 eee eee eee restart request restart 0 ke eee return edit resource 2 eee eee eee eee eee set data table size 2 0 ceca veces eee ce eee eases SCLENOS oc ci saeesvesaacdous E a a E EEREN set link parameters 2 0 0 0 ccc cee ees S NAKS 2ct02decarptatseanndes eae S gt ia lad cee set CPU mode o2ivoo3 5420 be Seta danibanins 1255 set timeout 0 ccc eee ees set variables 0c cece eens eee e sees enes shutdown 0 c cette aes typed read read block 00 c cee ce eee typed write write block 0 0 0 cece eee eee unprotected bit write 0 ce eee eee ees unprotected read 6 cee ees unprotected write 2 1 ccc eee ees upload all request upload 00 000 upload completed 00 00 cece cee ee eens UplOad gt c sas ain dake ewe Que ikeewe wat ee eke Table of Contents v word range read read block nnua 1 34
212. rn a NAK if BCC is not zero then return a NAK if message is too small then return a NAK if message is too large then return a NAK return an ACK end else end GET CODE is defined as loop variable GET CHAR if char is not a DLE begin add char to BCC return the char and a data flag end else begin GET CHAR if char is a DLE begin add char to BCC return a DLE and a data flag end else if char is an ETX begin GET CHAR add char to BCC return ETX with a control flag end else return char with a control flag end end end GET CHAR is defined as an implementation dependent function that returns one byte of data from the link interface hardware SEND Message is defined as send DLE STX for every byte in the message do begin subtract the byte from the BCC send the corresponding data code end send DLE ETX BCC end Publication 1770 6 5 16 October 1996 Using Half duplex Protocols to Send and Receive Messages The following flowchart shows the software logic for implementing half duplex protocol from the master node s point of view Does master have message to send Yes y No Select node y lt Send poll Y Start timeout j Receive DLE EOT Node in active list Yes Add node to active list Get message from application layer 43 Send message Y Start timeout Received DLE
213. rocessors valid range is 0 94 bytes odd or even for SLC 5 03 and 5 04 processors with internet protocol valid range is 0 223 bytes odd or even without internet protocol valid range is 0 234 bytes odd or even id Ie Y e PLC 5 e PLC 5 VME Communication Commands 7 33 upload all request upload Places a PLC 5 processor in Upload mode before uploading a complete system A T50 terminal displays download mode A no privilege error is returned if the programmed device does not have the privilege of placing the processor into Upload mode This error occurs when e the processor is being edited e some other node is already uploading or downloading to the processor If you have an earlier version of a PLC 5 processor this error may occur if your processor is not in Program or Remote Program mode CMD FNC DST SRC OF STS TNS 53 PLC 5 15 Series A and Series B Revision E and earlier CMD EXT 4F STS SRC DST STS TNS PLC 5 15 Series B Revision F and later and all other PLC 5 family processors SRC DST iy sts ms A B c o The EXT STS field may be attached to the reply packet only when there is an error A number of uploadable segments of PLC 5 memory in the remote PLC 5 processor B eight bytes for each segment specified in A First 4 bytes contain the starting addr
214. rolNet link DF1 Link A DFI link provides e master slave communication through a half duplex protocol peer to peer communication through a full duplex protocol This manual provides information necessary to write your own driver for an intelligent device on a DF1 link See Software Layers on page 1 7 for the layers your software driver must implement so that your intelligent device can talk to other DH DH DH485 or ControlNet nodes Network Link These network links are available for peer to peer communication This link Connects And allows ePLC 2 PLC 3 processors color graphic systems personal computers ehost computers e programmable RS232 RS 422 devices See page DH up to 64 nodes 1 3 esame devices as DH ePLC 5 processors e SLC 5 04 processor DH up to 64 nodes 1 5 e SLC 500 processors color graphic systems personal computers DH485 up to 32 nodes 1 6 ePLC 5 processors e1 O devices e personal computers e operator interface devices ControlNet up to 99 nodes o Using bridges e g 1785 KA modules you can extend the length of your DH network to contain up to 255 nodes Network Layers 1 3 DH Link A DH link is a local area network LAN designed for factory floor applications This link accepts 64 devices and can transmit 57 6 K bits of data per second A DH link consists of a trunk cable up to 10 000 feet 3 048 meters long and drop cables as lo
215. rs Series A revision M PLC 5 40 5 40L 5 60 5 60L Series A revision J PLC 5 30 Series A revision H PLC 5 11 5 20 Series B revision J PLC 5 40 5 40L 5 60 5 60L Series C revision G PLC 5 11 5 20 5 20E 5 30 5 40 5 40L 5 V40 5V40L 5 60 5 60L 5 80 5 80E 5 V80 This command has no FNC byte SLC 500 refers to any SLC 500 SLC 5 01 SLC 5 02 SLC 5 03 or SLC 5 04 processor Receive only Processors with this note cannot send the command they receive the command from a computer Publication 1770 6 5 16 October 1996 Communication Commands 7 3 Command CMD FNC Processors Page Micro gic SiC SLC 1774 PLC 5 PLCS mes 500 sos 504 pio PIOA PLCS PLCS nee protected typed file write OF AF S J J 4 7 16 wihinscadaesetons F Z s X v v v 7 17 wihinscadaesstons F a Age ve 7 18 protected write 00 S w4 S S 7 19 read bytes physical OF 17 w4 se w4 7 19 read diagnostic counters 06 01 w4 S S S w4 S S w4 se 7 19 reset diagnostic counters 06 07 w4 S S S S w4 S w4 se 7 22 read link parameters 06 09 w4 S S S 7 20 read modify write OF 26 w4 se w4 7 20 read modify write N OF 79 se 7 21 read section size OF 29 J w4 se 7 22 restart request OF 0A J 7 23 return edit resource OF 12 S 7 24 set CPU mode OF 3A w4 w4 se 7 26 set data table size 06 08 S 7 24 set ENQs o6 06 s 4 se
216. ry using write bytes physical with the information stored in the archive file from the upload procedure For more on write bytes physical see page 7 35 Exit Download mode using download complete For more on download complete see page 7 7 Downloading to an SLC 500 Processor If you have this SLC processor Then SLC 500 SLC 5 01 or SLC 5 02 Follow procedure 1 on page 12 11 SLC 5 03 or SLC 5 04 Follow procedure 2 on page 12 12 Uploading and Downloading with A B Processors 12 11 Procedure 1 SLC 500 SLC 5 01 and SLC 5 02 Processors 1 10 11 Determine the current mode of the SLC processor using diagnostic status CMD 06H FNC 03H For more on diagnostic Status see page 7 6 Place the processor in Program mode using change mode CMD OFH FNC 80H For more on change mode see page 7 5 Disable forces using disable forces CMD OFH FNC 41H For more on disable forces see page 7 6 Get the maximum node address parameter using read link parameters CMD 06H FNC 09H For more on read link parameters see page 7 20 Initialize memory using initialize memory CMD OFH FNC 57H For more on initialize memory see page 7 12 Put back the previous maximum node address using set link parameters CMD 06H FNC OAH For more on set link parameters see page 7 25 Open the directory to get ownership of the processor using open file CMD OFH 81H For more on open file see page 7 13
217. s Numbering System Page decimal 11 2 binary 11 3 binary coded decimal 11 3 hexadecimal 11 4 octal 11 5 binary floating point 11 5 Important You must design your computer application programs to make any necessary conversions from one numbering system to another Once you have selected the numbering system that is best for your applications use that numbering system and convert all data values to that base Decimal The decimal numbering system is easy to use because it is most familiar It uses the digits 0 through 9 and each digit has a place value that is a power of 10 Despite the convenience of decimal numbers it is often easier to convert binary data to a numbering system other than decimal Decimal Representation Number 239 2x 10 200 3x10 30 9x10P 9 239 2 3 9 i 10 Data Encoding 11 3 Binary The binary numbering system is a simple method for computer and PLC applications because it is the most natural way to represent data bits However since the binary system uses the digits 0 and 1 it is cumbersome to show values in binary format Each digit in a binary number has a place value expressed as a power of 2 You calculate the decimal equivalent of a binary number by multiplying each binary digit by its corresponding place value and then adding the results of the multiplications Binary Representation Number 239
218. s refer to your module s user manual Publication 1770 6 5 16 October 1996 2 6 Understanding DF1 Protocol Transmission Symbols Publication 1770 6 5 16 October 1996 Both half duplex and full duplex protocols are character oriented They use the ASCII control characters in the tables below extended to eight bits by adding a zero for bit 7 Table 2 A Half duplex Protocol Abbreviation Hexadecimal Value Binary Value STX 02 0000 0010 SOH 01 0000 0001 ETX 03 0000 0011 EOT 04 0000 0100 ENQ 05 0000 0101 ACK 06 0000 0110 DLE 10 0001 0000 NAK OF 0000 1111 Table 2 B Full duplex Protocol Abbreviation Hexadecimal Value Binary Value STX 02 0000 0010 ETX 03 0000 0011 ENQ 05 0000 0101 ACK 06 0000 0110 DLE 10 0001 0000 NAK OF 0000 1111 For the standard definition of these characters refer to the ANSI X3 4 CCITT V 3 and ISO 646 standards A symbol is a sequence of one or more bytes having a specific meaning to the link protocol The component characters of a symbol must be sent one after another with no other characters between them DF1 protocol combines the characters listed in the tables above into control and data symbols Control symbols are fixed symbols required by the DF1 protocol to read a particular message e Data symbols are variable symbols which contain the application data for a particular message Understanding DF1 Protocol 2 7 Table 2 C
219. s Information 1761 L16AWA L16BBB L16BWB L32AWA L32BWA L32BWB MicroLogix 1000 processors Status Bytes Bytes Bits Contents Description 1 0 7 mode status 00 2 0 7 type extender EE 3 0 7 extended interface type 34 DF1 full duplex protocol on port 0 20 DH485 0 7 extended processor type 58 0 4 series revision 0 firmware release1 1 firmware release 2 etc 5 7 0 series A 1 series B etc 6 16 all bulletin number name in ASCIl Product specific Information 17 all major error word low byte 18 all major error word high byte 19 0 4 processor mode 00000 download status control word 00001 remote PROG 00011 idle due to SUS instruction 00110 RUN 00111 TEST continuous scan 01000 TEST single scan 5 forces active 6 forces installed 7 communication active 20 0 processor mode status control fault override 1 word high byte startup protect fault 2 reserved 3 reserved 4 always run 5 major error processor halted 6 locked 7 first pass bit 21 0 7 program ID low byte 22 0 7 high byte 23 0 7 processor RAM size in Kbytes 8 24 0 directory file corrupted 1 not used 0 2 7 program owner node address 3F no program owner Publication 1770 6 5 16 October 1996 Bytes Diagnostic Status Information 10 7 1770 KF3 Status Bytes Contents Description Mode Status 00 no modes
220. s a diagnostic status command Chapter 11 Data Encoding Chapter 12 Uploading and Downloading Chapter 13 PLC Addressing Chapter 14 Line Monitor Examples Chapter 15 ASCII Codes e data encoding and conversion information e upload and download procedures for the PLC 2 PLC 3 and PLC 5 processors e information on addressing PLC 2 PLC 3 PLC 5 and PLC 5 250 processors e line monitor examples that show actual commands being sent and provide an explanation of each example e hex and binary values for ASCII characters Terms and Abbreviations Related Publications local node About This Manual P 3 Definition The node sending the command node The point at which devices such as programmable controllers interface to the network Each device on a network must have a unique node address In some Allen Bradley documentation you may find the term station used in place of the term node physical link Cable and associated hardware such as transmitter and receiver circuits PLC controller An Allen Bradley programmable controller See programmable controller protocol Set of programming rules for interpreting the signals transmitted over the physical link by nodes programmable controller a solid state control system that has a user programmable memory for storage of instructions to implement specific functions such as I O control logic timing count
221. s for the expanded element address low address byte first Addresses sub elements 0 254 only For higher addresses setting Sub element this byte to FF expands this field to three bytes Use the second and Number third bytes for the expanded sub element address low address byte first eFor SLC 5 01 or SLC 5 02 82 bytes 41 words DATA e For SLC 5 03 or 5 04 223 bytes with IP does not apply to DF1 drivers 234 bytes without IP applies to DF1 drivers id Ia Y BT f id jaca yi Bl bE TEER 1774 PLC PLC 2 PLC 3 PLC 5 PLC 5 250 e PLC 5 e PLC 5 250 receive only e PLC 5 VME 1774 PLC MicroLogix 1000 PLC 2 PLC 3 PLC 5 PLC 5 250 receive only SLC 500 SLC 5 03 SLC 5 04 Communication Commands 7 19 protected write Writes words of data into limited areas of the PLC data table memory Its access is limited by memory access rungs in the communication zone of the processor s ladder diagram program pst src CMD sts Ns ADDR 00 Data max 244 bytes SRC DST py STS TNS read bytes physical physical read Performs an upload after receiving a reply that an upload download all request has been successfully performed C DST SRC A STS TNS Beg PLC 5 phys address Size CMD R SRC DST 4F STS TNS A Data up to 2
222. s greater than 244 The SIZE value specifies an odd number of bytes 30 The local PLC 3 interface module has executed a shutdown request to the local PLC 3 processor 40 Local PLC 3 backplane error either memory parity timeout or disconnect 50 e A destination DST file does not exist The DST file is too small The source SRC file is more than 65 535 words long 70 PLC 3 processor is in Program mode PLC PLC 2 bit write 10 Incomplete bit description because the number of bytes after the TNS word is not a multiple of 4 30 The local PLC 3 interface module has executed a shutdown request to the local PLC 3 processor 40 Local PLC 3 backplane error either memory parity or timeout disconnect 50 eA DST file does not exist eThe DST bits do not exist in the destination file e Length of the SRC file is greater than 65 535 words 60 The keyswitch setting at local PLC 3 processor prohibits access 70 The local PLC 3 processor is in Program mode Publication 1770 6 5 16 October 1996 8 8 Message Packet Status Codes STS EXT STS Command PLC 3 word write EXT STS Code STS Code 10 Explanation There are not at least two bytes of data after the end of the block address There is an odd number of data bytes after the end of the block address eThe sum of packet offset and size values specifies more than 65 535 words eThe
223. s leading technology companies S_ i A Worldwide representation mmm Argentina Australia e Austria e Bahrain e Belgium e Brazil e Bulgaria e Canada e Chile e China PRC e Colombia Costa Rica Croatia e Cyprus e Czech Republic e Denmark Ecuador Egypt El Salvador e Finland France e Germany Greece e Guatemala e Honduras e Hong Kong e Hungary e Iceland e India e Indonesia Ireland e Israel e Italy e Jamaica e Japan e Jordan Korea e Kuwait e Lebanon e Malaysia e Mexico e Netherlands e New Zealand Norway e Pakistan e Peru e Philippines e Poland e Portugal e Puerto Rico e Qatar e Romania Russia CIS e Saudi Arabia e Singapore Slovakia e Slovenia South Africa Republic e Spain e Sweden Switzerland e Taiwan Thailand Turkey United Arab Emirates United Kingdom e United States e Uruguay e Venezuela e Yugoslavia Allen Bradley Headquarters 1201 South Second Street Milwaukee WI 53204 USA Tel 1 414 382 2000 Fax 1 414 382 4444 Publication 1770 6 5 16 October 1996 PN 4046109 05 Supersedes Publication 1770 6 5 16 November 1991 Copyright 1996 Allen Bradley Company Inc Printed in USA
224. s not much to do but destroy the message and count it Important An intelligent device can read the memory of the 1771 KC it is connected to by setting the destination equal to the module address 1771 KC DH Diagnostic Counters This counter byte 0 Counts the number of Bad CRCs on ACK 1 Times the sender timed out waiting for an acknowledgement This is a common error and is one of the first to respond to reflections or low level noise on the link It seems to be especially sensitive to problems with longer cables It also shows up if the cable connection are loose Times contention was detected This also shows up quickly on noisy or cables that are too long This counter corresponds to error 93 Times the ACK was successfully received but contained a non zero status code other than memory full Times the highway driver returns a message to sender with a non zero status code because a reply was not received from a remote node Each count corresponds to one local error bit set or one reply message lost Times the receiving node s memory was full Each time this happens the message is placed on a waiting queue for 0 5s Each message is re tried five times for memory overflow before it is returned to sender Times this node grabbed mastership of the highway because it timed out while waiting to hear a valid frame On a DH link that has just been powered up there should be only one node that has
225. s or less than 3 bytes 15 Duplicate tokens detected 16 Recoveries from duplicate node condition 17 Link dead timeouts Publication 1770 6 5 16 October 1996 Chapter 1 0 Diagnostic Status Information In chapter 8 we showed you the diagnostic status message packet format When you send diagnostic status to a node the node returns bytes of data Use this chapter to interpret the data returned from the node DH DH or DH485 interface that received the diagnostic status It contains these sections Section Page 1747 Cat Nos 10 2 1761 1770 and 1771 Cat Nos 10 5 1773 1775 and 1779 Cat Nos 10 11 1784 Cat Nos 10 15 1785 Cat Nos 10 16 5130 Cat Nos 10 23 Important The values shown in the following tables are in hexadecimal format For more on the hexadecimal numbering system refer to Chapter 11 Data Encoding Publication 1770 6 5 16 October 1996 10 2 Diagnostic Status Information 1747 Cat Nos For status information from these cat nos See page 1747 KE 10 2 1747 L20 L30 L40 L511 L514 L524 10 3 SLC 500 SLC 5 01 and SLC 5 02 processors 1747 L532 L542 SLC 5 03 and SLC 5 04 processors 10 4 1747 KE Status Bytes Bytes Bits Contents Description 1 1 Mode Status 00 no modes 2 2 Type Extender FE 3 3 Extended Interface Type 2C 4 4 Not used 00 5 0 4 Series Revision 0 release1 1 release 2 etc 5 7 0 series A 1 series B e
226. sabled 0 Unprotected commands enabled 1 Unprotected commands disabled 0 Protected commands enabled 1 Protected commands disabled Not used Octal node number 5 6 0 1 3 RS 232 C port options 0 Even parity 1 No parity Baud rate 0 19 200 bps 3 2 400 bps 6 300 bps 1 8 600 bps 4 1 200 bps 7 110 bps 2 4 800 bps 5 600 bps Not used 0 Protected commands enabled 1 Protected commands disabled 0 Embedded responses enabled 1 Embedded responses disabled 0 Unprotected commands enabled 1 Unprotected commands disabled 0 Privileged commands enabled 1 Privileged commands disabled 0 Half duplex protocol 1 Full duplex protocol Starting byte address of diagnostic timers and counters Publication 1770 6 5 16 October 1996 10 12 Diagnostic Status Information Bytes Bits Contents Description 9 0 4 Module series and revision level 0 Revision A 1 Revision B etc 5 7 0 Series A 1 Series B etc 10 all Not used 11 to Eight 13 byte groups of processor If a particular controller on the loop is not active or does not 114 status data one group for each of eight respond to the diagnostic status commana its 13 status possible controllers on the loop bytes are all zeros Otherwise each group of processor status bytes contains the following Byte OnNOarwhD
227. se 7 25 set link parameters 06 0A w4 S S w4 7 25 set NAKS o6 05 v 4 se se 7 25 set timeout 06 04 s 4 VO se 7 27 set variables 06 02 ov 4 se se T27 shutdown OF 07 4 7 28 typed read OF 68 w4 w4 v v s 7 28 typed write oF 67 SINS v v S 7 30 unprotected bit write 05 S S S S S 7 30 unprotected read 01 w4 w4 w4 s ov 4 4 v J 7 31 unprotected write 08 w4 w4 w4 ov 4 ov v v J 7 32 upload all request upload OF 53 4 se 4 7 33 upload completed OF 55 4 se ov 7 34 upload OF 06 J 7 34 word range read OF 01 J v v 7 34 word range write OF 00 J S S 7 35 write bytes physical OF 18 w4 se S 7 35 lt Thin AAmmand nana neka Buanitodhu ahannain ate DIEM clon EMA EMA RIOR me CON nena SCC This command cannot be executed by channel 0 of a PLC 5 11 5 20 5 30 5 40 5 60 or 5 80 processor The following processors can initiate these commands but cannot respond to them Processor Series Revision Processors Series A revision M PLC 5 40 5 40L 5 60 5 60L Series A revision J PLC 5 30 Series A revision H PLC 5 11 5 20 Series B revision J PLC 5 40 5 40L 5 60 5 60L Series C revision G PLC 5 11 5 20 5 20E 5 30 5 40 5 40L 5 V40 5V40L 5 60 5 60L 5 80 5 80E 5 V80 This command has no FNC byte SLC 500 refers to any SLC 500 SLC 5 01 SLC 5 02 SLC 5 03 or SLC 5 04 processor Receive only Processors with this note cannot send the command
228. se commands include STS and possibly EXT STS fields that contain status and error code information For more information on these bytes see Chapter 8 Message Packet Status Codes STS EXT STS Protecting data files from write access Using a PLC 5 11 5 20 5 30 5 40 5 60 or 5 80 processor you can also specify privileges to protect data files from write access on a DH link Using an SLC 5 02 5 03 or 5 04 processor you can specify static file protection to protect data files from write access from any of the communication channels Important In some cases switch settings on an interface module can disable a command at a PLC SLC node For additional information on your module s switch settings refer to that module s user documentation For a list of related publications and products refer to the preface of this manual In addition to the commands listed in this chapter we ve also included examples Section Page PLC 5 Type Data Parameter Examples 7 36 SLC 500 Information 7 38 Reading and Writing SLC 500 Data using SLC terminology 7 38 Reading and Writing SLC 500 Data using PLC 2 terminology 7 38 Publication 1770 6 5 16 October 1996 7 2 Communication Commands Use this table to locate commands you want to use For additional information on the commands refer to the specified pages ATTENTION Using command codes not listed will produce unpredictable results
229. shifted out on the right the CRC register is exclusive ORed with this 16 bit constant 1010 0000 0000 0001 As each additional byte is transmitted it is included in the value in the register the same way After the ETX value is transmitted the value in the CRC register is transmitted right bit first The receiver also calculates the CRC value and compares it to the received CRC value to verify the accuracy of the data received Data link Layer Message Frames 5 7 The full duplex and half duplex slave and master protocol examples below provide you with procedures for determining the CRC 16 value Full duplex and half duplex slave protocol data_byte all link layer data ETX CLEAR CRC_REGISTER FOR each data_byte GET data_byte XOR data_byte right eight bits of CRC_REGISTER PLACE RESULT in right eight bits of CRC_REGISTER DO 8 times on CRC register_ Shift bit right shift in 0 at left IF bit shifted 1 XOR CONSTANT CRC_REGISTER PLACE RESULT in CRC_REGISTER END IF END DO END FOR TRANSMIT CRC_REGISTER as 2 byte CRC field low byte high byte Half duplex master protocol data_byte STN STX all link layer data ETX CLEAR CRC_REGISTER For each data_byte GET data_byte XOR data_byte right 8 bits of CRC_REGISTER PLACE RESULT in right 8 bits of CRC_LREGISTER DO 8 times Shift bit right shift in 0 at left IF bit shifted 1 XOR CONSTANT CRC_REGISTER PLACE RESULT in CRC_REGISTER END IF END DO END FO
230. siderations ATTENTION Identifies information about practices or circumstances that can lead to personal injury or death property damage or economic loss Attention statements help you to e identify a hazard e avoid the hazard recognize the consequences Important Identifies information that is critical for successful application and understanding of the product PLC 5 DH PLC 2 PLC 3 PLC SLC 500 SLC SLC 5 01 SLC 5 02 SLC 5 03 SLC 5 04 ControlNet MicroLogix and PLC 2 15 are trademarks of Allen Bradley Company Inc All other trademarks are property of their respective companies Summary of Changes What s Changed in This Document About This Document This document contains important information concerning the DF1 Changes to This Document Change organization Protocol and Command Set Reference Manual This information extends and explains information provided in the Data Highway Data Highway Plus DH 485 Communication Protocol and Command Set Reference Manual publication 1770 6 5 16 November 1991 Changes to this document are indicated by a revision bar in the margin The look and feel of your Allen Bradley documentation has changed We re constantly trying to improve our documentation to make it more usable for you If you have questions or comments about this document complete the enclosed Publication Problem Report In addition we ve also made the following changes to publ
231. sion of the previous message For more information on these fields see pages NO TAGNO TAG and NO TAG E Master Polling The master polling algorithm varies depending on the expected flow Responsibilities of traffic through the system A simple master continuously polls each slave in round robin fashion If a message is received it is handled then the next node is polled In addition to general responsibilities masters are responsible for e detecting duplicates e polling inactive slaves e relieving full sinks e using simplified network layer e slave to slave message relaying Duplicate Detection Duplicate detection information must be kept for each node unless the master polls each node repeatedly until it is empty before proceeding to the next Then duplicate detection information only needs to be kept for the current node Inactive Slave Polling If a slave fails to respond to a poll the master removes the slave from the list of active slaves To save time the master polls the active slaves on a regular basis and polls the inactive slaves occasionally to see if they respond When an inactive slave does not respond to a poll it is put back into the active slave list Publication 1770 6 5 16 October 1996 3 8 Using Half duplex Protocols to Send and Receive Messages Publication 1770 6 5 16 October 1996 Full Sinks When a node times out to a message command poll the node to see if it responds If it r
232. sors 12 3 Uploading from a PLC 5 Processor Important Uploads cannot be performed on a PLC 5 processor that is memory protected You set or remove memory protection by using switch settings on either the I O rack or on your PLC 5 family processor For more information refer to your processor s installation manual If you have this PLC 5 processor Then PLC 5 15 B Rev E and earlier Follow procedure 1 on page 12 4 ae Posu ePLC 5 12 ePLC 5 60L ePLC 5 15 B Rev F and later e PLC 5 40E ePLC 5 20 ePLC 5 40L Follow procedure 2 on page 12 5 PLC 5 20E ee ePLC 5 25 e PLC 5 80 e PLC 5 30 e PLC 5 80E Publication 1770 6 5 16 October 1996 12 4 Uploading and Downloading with A B Processors Publication 1770 6 5 16 October 1996 Procedure 1 PLC 5 15 B processors revision E and earlier 1 Place the PLC 5 processor in Program or Remote Program mode using set CPU mode or the keyswitch on the front of the processor For more on set CPU mode see page 7 26 2 Place the PLC 5 processor in Upload mode using upload all request This locks out all other users from accessing PLC 5 memory For more on upload all request see page 7 33 If a T50 is connected it displays Download mode Important Once upload all request is issued the PLC 5 processor starts a 90 second timer After 90 seconds the processor automatically returns to the previous mode of operation If your upload takes more than 90 seconds you must reset the timer
233. ss levels and the module ID byte with a 1 in the corresponding mask bit are encoded For example 01111111 means that the module ID byte and 7 levels are specified 00111010 means the module ID byte uses the default value There are 7 levels in the address and level 2 uses the default value the default is always 0 This byte is required 2 the module ID byte if there is a 1 in the LSB of the mask byte otherwise it contains the first level of the address not using the default value Memory Type Module ID Byte Value System memory RM 0 Module memory LP class x 10 pushwheel number where LP class 3 I O memory RS 1 This byte is required 3 the first level of the address not using the default value if the module ID byte is encoded Otherwise it contains the second level of the address not using the default value 4 the next level of the address not using the default value n up to 7 possible levels of addressing Publication 1770 6 5 16 October 1996 13 14 PLC Addressing Important If the value of the mask or a level of the address is greater than or equal to 255 then you cannot encode it into 1 byte You must flag this case by programming an FF hex at the level address to signify that the level address is greater than or equal to 255 and the next 2 bytes contain the level address Then code the level into the following two bytes The following figures show examples of PLC 5 250 logical binary ad
234. ssion In this transfer Source noise destroys the DLE ACK while also producing invalid characters at the receiver because of the invalid characters the receiver changes its last response variable to a DLE NAK since the DLE ACK was destroyed the transmitter sends a DLE ENQ enquiry and the receiver returns the DLE NAK the transmitter retransmits the message and the receiver sends an ACK the receiver discards the duplicate message if duplicate message detection is enabled on your module reply is successfully returned Transmitter Link Receiver Sink command lt OK reply lt lt XXxXxX __ XXX gt not full DLE STX xxxx DLE ETX BCC CRC _ gt lt not full m _ XXXX_ gt lt DL CK timeout 22 gt timeout DLE ENQ ________ DLENAK a DLE STX xxxx DLE ETX BCC CRC duplicate message lt DLE ACK sometime later lt DLE STX xxxx DLE ETX BCC CRC DLE ACK gt OK In this transfer the receiver has no way of knowing that the DLE ACK it sent to the transmitter was destroyed If the transmitter s ACK timeout is large enough it is possible that the reply i e DLE STX xxxx DLE ETX BCC CRC comes back before the transmitter sends the DLE ENQ Therefore the reply comes in before the DLE ACK is received by the transmitter Publicatio
235. st could not complete function due to hardware fault 50 Addressing problem or memory protect rungs 60 Function not allowed due to command protection selection 70 Processor is in Program mode 80 Compatibility mode file missing or communication zone problem 90 Remote node cannot buffer command AO Wait ACK 1775 KA buffer full BO Remote node problem due to download Co Wait ACK 1775 KA buffer full DO Not used E0 Not used FO Error code in the EXT STS byte EXT STS Byte You have an EXT STS byte if your STS code is FO hex Definitions for this byte vary depending on the command code or type of command in your message packet CMD code hex Type of code in EXT STS byte Refer to 00 to 08 No EXT STS byte not applicable OF DH DH codes page 8 4 OB 1A or 1B DH485 codes page 8 5 Publication 1770 6 5 16 October 1996 8 4 Message Packet Status Codes STS EXT STS Publication 1770 6 5 16 October 1996 EXT STS Codes for CMD 0F Hex Code Explanation 0 Not used 1 A field has an illegal value 2 Less levels specified in address than minimum for any address 3 More levels specified in address than system supports 4 Symbol not found 5 Symbol is of improper format 6 Address doesn t point to something usable 7 File is wrong size 8 Cannot complete request situation has changed since the start of the command 9 D
236. st program your computer to interpret this code For more information on codes and their meanings see Chapter 8 Message Packet Status Codes Error codes can be generated at two places e the sending node e the receiving node For codes that are returned from the sending node From this node Error codes are generated when ean application program used the wrong message format or issued illegal commands ethe sending node cannot complete a transaction due to network problems sending node an application problem exists at the receiving node Typically these involve ethe PLC processor being off line in Program mode for example receiving node or ethe command trying to access a memory area is blocked by the interface module or user application program i e the data table location does not exist or is restricted Publication 1770 6 5 16 October 1996 E Protocol m Understanding DF1 Protocol Chapter 2 Using Half duplex Protocols to Send and Receive Messages Chapter 3 Using Full duplex Protocols to Send and Receive Messages Chapter 4 Chapter 2 Understanding DF1 Protocol If you are connecting an interface module to a computer you must program the computer to understand and issue the proper protocol character sequences This chapter describes the DF1 protocol you can use with your DF1 link driver for e peer to peer two way simultaneous communication e master slave two way altern
237. st stop the PLC processor during download to prevent the PLC processor from executing a program that is changing The SLC processor s interface must prevent other stations from accessing the data table during download because it may only be partially complete The interface must also prevent a programming terminal from accessing the program during download To help make sure that your SLC interface prevents access to the data table during download use these download procedures To download information to See page PLC 2 processors 12 7 PLC 3 processors 12 8 PLC 5 processors 12 8 SLC 500 processors 12 10 Uploading and Downloading with A B Processors 12 7 Downloading to a PLC 2 Processor 1 Place the PLC 2 processor in Download mode by setting the mode selector switch on the PLC 2 processor to the RUN PROG or PROG position ATTENTION Leaving outputs on during a download can cause unexpected machine motion If you are downloading to a PLC 2 20 or mini PLC 2 processor in RUN or RUN PROGRAM mode the only way to turn an output off is to use physical write to set all output image bits to 0 2 Place the PLC 2 processor in Download mode using 3 4 enter download mode For more on enter download mode see page 7 9 This command e inhibits program scan e inhibits access by a programming terminal e does not allow the PLC 2 processor to send commands e allows the PLC 2 processor to only receive downloading and diagno
238. ster Polling Responsibilities 3 7 Slave Transceiver Actions 3 9 Half duplex Protocol Diagrams 3 11 Publication 1770 6 5 16 October 1996 3 2 Using Half duplex Protocols to Send and Receive Messages Half duplex Protocol Message Transmission Publication 1770 6 5 16 October 1996 Half duplex protocol e is a multidrop protocol for one master and one or more slaves e provides a lower data throughput than full duplex e allows communication with each node on the multidrop link e allows communication with nodes on links connected to the multidrop link If the master is programmed to relay messages then nodes on the multidrop can engage in virtual slave to slave transfers Half duplex protocol operates on a multidrop link with all nodes interfaced through half duplex modems There may be from 2 to 255 nodes simultaneously connected to a single link In half duplex mode one node is designated as master and it controls which node has access to the link All other nodes are called slaves and must wait for permission from the master before transmitting Allen Bradley devices with master and slave capabilities include Devices with master capability Devices with slave capability eSLC 5 03 and 5 04 on channel 0 1747 KE 1771 KGM DH SCADA Master module 1770 KF2 KF3 KFC 5130 RM1 RM2 KA channel 1 1775 KA via modem port 5130 RM2 1785 KE ea user programmed intelligent device 1771 KE KF
239. stic commands e places a PLC 2 05 2 15 2 16 2 17 or 2 30 processor in program mode If the last state switch at each I O chassis is set to OFF the outputs are disabled lets the outputs of a PLC 2 20 or a mini PLC 2 remain enabled if the mode selector switch is in the Run or Run Program position If necessary set the data table size using set data table size For more on set data table size see page 7 24 Important Do not write beyond your PLC 2 memory If you need to change the size of your PLC 2 data table to download the new program refer to your PLC 2 processor user manual Download the information using one or more physical writes For more on physical write see page 7 14 Downloading programs 5 6 When you download a program write zeros into the unused portion of memory following the program Verify that the information transferred properly using physical read For more on physical read see page 7 13 Exit Download mode using exit download upload mode For more on exit download upload mode see page 7 10 Publication 1770 6 5 16 October 1996 12 8 Uploading and Downloading with A B Processors Publication 1770 6 5 16 October 1996 Downloading to a PLC 3 Processor 1 Determine if the destination PLC 3 processor exists using diagnostic status For more on diagnostic status see page 7 6 Request the right to download to a PLC 3 processor using download request For more
240. strial terminal communication CMD FNC C DST SRC 07 STS TNS 05 R src ost M sts TNs You must remove the temporary End statement from the beginning of the program and re insert the first byte of the program file read read file i Reads data starting at a file symbol or a block address This starting i address must point to a file of words I a PLC pst src 2 sts TNS FNC Packet Total Logical Address Sj Bx e PLC 5 250 C OF 04 Offset Trans 2 51 bytes zg 7 4 CMD R SRC DST F STS TNS Data max 244 bytes or 122 words J The DATA field may be replaced by an EXT STS field if there is an error Publication 1770 6 5 16 October 1996 id Ie Y BT Of e PLC 3 e PLC 5 250 PLC 5 PLC 5 250 receive only PLC 5 VME SLC 500 SLC 5 03 SLC 5 04 Communication Commands 7 11 file write write file Writes data starting at a file symbol or block address This starting address must point to a file of words DST CMD FNC Packet Total Logical Address SRC oF STS TNS 03 Offset Trans 2 51 bytes pata up to 239 bytes the PLC 3 logical address length must be an even number This reply is the same as the reply packet for all unprotected protected and privileged bit writes SRC CMD EXT DST jp STS TNS cto
241. successfully transmitted on the network the receiver sends a reply but the message source is full the receiver retransmits and the source is no longer full Sink command Xxxx gt lt K sometim reply Full gt not full lt XXX DLE STX xxxx DLE ETX BCC CRC _ gt lt e later DLE STX xxxx DLE ETX BCC CRC lt DLE STX xxxx DLE ETX BCC CRC DLE ACK DLE NAK gt DLE ACK ___ lt not full XXX gt OK Publication 1770 6 5 16 October 1996 E Message Packets i Data link Layer Message Frames Chapter 5 Application Layer Message Packets Chapter 6 Communication Commands Chapter 7 Message Packet Status Codes STS and EXT STS Chapter 8 Chapter 5 Data link Layer Message Frames In the data link layer of a message frame e half duplex protocol uses three types of message transmission e full duplex protocol implements its message fields at different network layers e at the end of each polling and message frame there is a one byte BCC field or a two byte CRC field Read this chapter to help learn the fields that your computer uses in the data link layer of a message frame It contains these sections Section Page Half duplex Protocol Message Frames 5 2 Full duplex Protocol Message Frames 5 3 BCC and CRC Fields 5 4 Publication 1770 6 5 16 October 1996
242. sum of packet offset and size is greater than total transaction size 30 The local PLC 3 interface module has executed a shutdown request 40 A backplane error either memory parity timeout or disconnect has occurred 60 The processor keyswitch setting does not allow access 70 The local PLC 3 processor is in Program mode FO There is an error in converting the block address major section gt 63 context gt 15 or section gt 15 FO Three or fewer addressing levels specified for a PLC 3 word address FO The conversion of a file address to a block address resulted in more than nine addressing levels FO The symbolic address was not found FO The symbolic address is of length zero or is longer than eight bytes FO The DST file was not found eThe DST address does not point to a word for word range writes or a file for file writes eThe DST address specifies more levels than required eThe first word of the DST location does not exist FO e Any word in the total transaction does not exist in the DST file eFor a file write the SRC and DST files are not the same size FO The DST file size changed between packets of a multi packet transaction and became too small for the total transaction FO There are more than 65 535 words in the SRC file FO The sum of total transaction size and the word level PLC 3 addressing is greate
243. t onto the link CMD FNC Address Size c pst jsrc STS ms FOG Oooo o R src DST a sts TNS Data Data the maximum node address that can be solicited 1 byte read modify write write bit Sets or resets specified bits in specified words of data table memory The interface that receives this command performs this procedure for each PLC 5 system address AND Mask and OR Mask in the message packet 1 Copies the specified word in the data table 2 Resets the bits specified in the AND mask 3 Sets the bits specified in the OR mask 4 Writes the word back to its location pst src CMD sts qns FNC PLC 5 sys address AND Mask OR Mask OF 26 Repeatable up to 243 bytes CMD EXT SRC DST 4p STS TNS STS The EXT STS field may be attached to the reply packet only when there is an error The PLC 5 system address specifies the word that is modified Use more than one field to specify more than one word Must point to a word and can be either a logical binary address or a logical ASCII address Each PLC 5 system address is followed by an AND Mask specifies which bits in the word to reset 0 and OR Mask specifies which bits in the word to set 1 These three fields can be repeated up to a length of 243 bytes AND and OR Masks two bytes each with the low byte first
244. t to left byte and bit order as in DEC PDP 11 34 or VAX 11 780 It also represents a 16 bit word in an 8 bit processor such as Zilog Z 80 or Intel 8088 microprocessor If your computer has this type of word order the conversion is straightforward Bit 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Decimal 1 0 1 0 0 1 0 1 0 1 1 1 0 1 1 0 Odd high byte Even low byte Value A576 hex A 16 Bit Computer Word with Right to Left Byte and Bit Order This figure shows a 16 bit computer word with left to right byte and bit order as in IBM Series 1 If your computer has this type of word order the conversion is more complex You will have to swap bytes into and out of buffers Bit 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Octal Even low byte Odd high byte Value A576 hex after byte swapping A 16 Bit Computer Word with Left to Right Byte Order and Right to Left Bit Order This figure shows a 16 bit computer word with left to right byte order and right to left bit order as in Zilog Z 8000 or Motorola 68000 microprocessors If your computer has this type of word order your communication driver must handle the task of byte swapping as it loads data into a buffer Successive bytes received from the PLC must be stored in the following order 1 0 3 2 5 4 7 6 9 8 Bit 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 Deci
245. tc 6 16 all Bulletin Number Name in ASCII 1770 KF3 17 24 all Product Specific Information 00 Publication 1770 6 5 16 October 1996 Diagnostic Status Information 10 3 1747 L20 L30 L40 L511 L514 L524 SLC 500 SLC 5 01 and SLC 5 02 processors Status Bytes Bytes Bits Contents Description 1 0 7 mode status 00 2 0 7 type extender EE 3 0 7 extended interface type 1F 4 0 7 extended processor type 1A 20 30 amp 40 I O SLC fixed controllers 18 1747 L511 L514 SLC 5 01 controller 25 1747 L524 and SLC 5 02 controller 5 0 4 series revision 0 firmware release1 1 firmware release 2 etc 5 7 0 series A 1 series B etc 6 16 all bulletin number name 500 20 1747 L20 SLC 500 fixed controller in ASCII 500 30 1747 L30 SLC 500 fixed controller 500 40 1747 L40 SLC 500 fixed controller 5 01 1747 L511 amp L514 5 02 1747 L524 Product specific Information 17 all major error word low byte 18 all major error word high byte 19 0 4 processor mode 0 download 1 program status control word 2 reserved 3 idle due to SUS instruction 4 reserved 5 reserved 6 run 7 test continuous scan 8 test single scan 9 31 reserved 5 forces active 6 forces installed 7 communication active 20 0 processor mode status control word protection powe
246. th 1 end GET MESSAGE TO SEND This is an operating system dependent interface routine that waits and allows the rest of the system to run until the message source has supplied a message to be sent SIGNAL RESULTS This is an implementation dependent routine that tells the message source of the results of the attempted message transfer WAIT This is an operating system dependent routine that waits for any of several events to occur while allowing other parts of the system to run TRANSFER Message is defined as initialize nak limit and eng limit SEND Message start timeout Publication 1770 6 5 16 October 1996 4 6 Using Full duplex Protocol to Send and Receive Messages The following flowcharts the software logic for implementing the transmitter retransmit same message lt A l message frame DLE STX Data ple Etx BOGICRC timeout loop Received DLE Nee Legend Ready to transmit next message Q y a a NAKs Yes Yes 3 ENQ eceived gt P p Recovery procedure for this sent message Default values used by the module No No y DLE ENQ Uo z Important Depending on network link traffic and saturation level you may need to wait for a reply from the remote node before transmitting the next message Implement an option that allows users to choose the maximum amount of outstanding messages that can exist at one time we suggest a selectable rang
247. tocol that combines features of subcategories D1 data transparency and F1 two way simultaneous transmission with embedded responses of ANSI x3 28 specification There are two categories of DF1 protocol e half duplex protocol master slave communication e full duplex protocol peer to peer communication Half duplex Protocol Half duplex protocol is a multidrop protocol for one master and one or more slaves With half duplex protocol you can have 2 to 255 nodes simultaneously connected on a single link this link operates with all nodes interfaced through half duplex modems For a list of devices that can be used as masters and slaves see page 3 2 For more on half duplex protocol refer to Chapter 3 Using Half duplex Protocol to Send and Receive Messages To implement half duplex protocol use the following communication characteristics 8 bits per character e no parity 1 stop bit Understanding DF1 Protocol 2 3 Using half duplex protocol When you use half duplex protocol the intended environment is a multidrop link with all nodes interfaced through half duplex modems Unless there is only one slave directly connected to a master you must use a modem Your modems must support these signals e request to send RTS e clear to send CTS e data carrier detect DCD e data set ready DSR e data terminal ready DTR If your modem does not support the DCD and DSR signals you must jumper DCD an
248. ublication 1770 6 5 16 October 1996 PLC Addressing 13 15 PLC 5 250 RM LP Memory for use with figures on page 13 14 level 1 1 public stat word 2 data level 2 level 3 level 4 level 5 level 6 level 7 0 system sect file element member submember 0 binary 1 integer 2 long integer 3 reserved 4 float 5 timer OEN 1 TT 2 DN 3 PRE 4 ACC 6 counter 0 CU 1CD 2DN 30V 4 UN 5 PRE 6 ACC 7 control 8 PID 9 message 10 string Logical ASCII Addressing Logical ASCII addressing is supported by PLC 5 250 PLC 5 and PLC 3 processors Logical ASCII addressing allows you to specify an address in the same form that you use at the programming node and lets any device communicate with any other device without knowing the internal memory structure of the target device A logical ASCII address starts with an ASCII NULL 0 character and a dollar sign to differentiate it from symbolic addressing The rest of the address then follows as a string of ASCII characters The string is terminated with another NULL character Logical ASCII address that accesses the 360th element in file 10 Byte ASCII HEX Contents 1 NUL 00 A null character that tells the PLC 5 processor that an ASCII address is to follow 2 24 An ASCII that differentiates a logical ASCII address from a symbolic address 3 N 4E A hex value that corresponds to one character in the PLC 5 4 1 31 ASCII address N10 360
249. uccessfully received the message If the BCC value calculated by the module does not match the BCC value in the message packet the module sends a DLE NAK 10 15 hex instead of the DLE ACK hex Publication 1770 6 5 16 October 1996 14 8 Line Monitor Examples Reply Field Value Function DLE STX 2 bytes 10 02 Indicates the start of the reply message DST destination 0A Indicates the node address that the reply is being sent back to In our example command message the 1770 KF2 put its address in the source SRC byte before sending the command message to the 1775 KA The 1775 KA takes the source byte from the command message and makes it the destination byte of the reply message In our example the reply message is sent back to the 1770 KF2 node address 012 octal 0A hex SRC source 09 p Indicates the Data Highway node address that is the source of the message In this example the reply is being sent from the 1775 KA at node address 011 octal 09 hex CMD command 4F Indicates the type of command In a reply packet 40 hex is added to the CMD byte to indicate that the packet is a reply In this example the CMD byte in the command message was OF hex unprotected read so the CMD byte in the reply message is 4F hex STS status 00 Indicates the status of the message If there is a problem with the message or the network a status code appears in this byte If the STS byte equals FO or E0 h
250. ul e the receiver sends a DLE ACK to the transmitter e reply is successfully returned Source Transmitter Link Receiver Sink command XXX gt DLE STX x x DLE ETX BCC CRC DENAK DLE STX xxxx DLE ETX BCC CRC gt lt notful m _ XXXX_ gt lt DLEACK lt K sometime later reply DLE STX xxxx DLE ETX BCC CRC not full lt XXXX DLE ACK gt OK gt Publication 1770 6 5 16 October 1996 4 12 Using Full duplex Protocol to Send and Receive Messages Message Transfer with Timeout and ENQ In this transfer e the receiver receives a transmission but sends back a DLE ACK that is corrupted e the transmitter times out waiting for the DLE ACK and sends a DLE ENQ e the receiver sends back a DLE ACK e areply is successfully returned Source Transmitter Link Receiver Sink command P DLE STX xxxx DLE ETX BCC CRC _ gt notfull c XXIX gt DL CK timeout DLE ENA ________ lt lt ________ DLEACK lt 0K _ sometime later reply DLE STX xxx DLE ETX BCC CRC _ not full lt lt XXXX __ DLE ACK _ gt LOK Publication 1770 6 5 16 October 1996 Using Full duplex Protocol to Send and Receive Messages 4 13 Message Transfer with Re Transmi
251. up is sent STS 00 Indicates the status of the message A command message should always set this field to 00 hex TNS transaction 02 00 Indicates a specific transaction value for each message The TNS value increments for each message 2 bytes packet This value makes each message uniquely different which helps you check for duplicate message packets In this example there are three commands and each must have a different TNS value FNC function 01 Used with the CMD byte this byte determines which command is sent The CMD byte specifies a group of commands and the FNC byte specifies a command within that group of commands In this example the FNC byte specifies command 01 of command group OF This is the word range read command PACKET OFFSET 0000 Contains the offset from the address in the address field In this example the computer sends three 2 bytes commands for one transaction Each command reads 114 words The first command starts at the address in the ADDR field with no offset The second command has an offset of 72 00 00 72 hex 114 decimal This means that the second command begins reading after the 114 words that were read by the first command Likewise the third command has an offset of E4 00 00 E4 hex 228 decimal TOTAL TRANS 56 01 Indicates the total amount of PLC 3 data table words low byte first that are transferred for the entire total transaction transaction In this example there are three commands to comp
252. uplex Protocol to Send and Receive Messages Message Characteristics Transmitter and Receiver Message Transfer Publication 1770 6 5 16 October 1996 Figure 4 3 shows the protocol environment for message symbols from transmitter A to receiver B path 1 and response codes from receiver B to transmitter A path 2 Figure 4 3 Protocol Environment Packt gt Path 1 Packet gt Source Transmitter A Receiver B Sink Path 2 lt Packet Status lt Sink Full Ideally the data link layer protocol is not concerned with the content or form of the message packet link layer data it is transferring However full duplex protocol places the following restrictions on link layer data submitted to it for transfer e minimum size of valid link layer data is 6 bytes e maximum size of valid link layer data depends on the application layer command e some protocol implementations e g point to point links to a 1771 KG module require that the first byte of the link layer data match the node address The receiver ignores messages that do not contain the correct address as part of the duplicate message detection algorithm the receiver compares the second third fifth and sixth bytes of the link layer data with the same bytes in the previous message If there is no difference between the sets of bytes the message is classified as a re transmission of the previous message You ca
253. ve Publication 1770 6 5 16 October 1996 PLC 5 Memory for use with figures on page 13 12 PLC Addressing 13 13 level 1 0 data table level 2 file number level 3 element number Default files 0 999 0 output 1 input 2 status 3 binary 4 timer 5 counter 6 control 7 integer 8 float 9 999 user config level 4 sub element number timer counter control 0 control 0 control N 10 360 1 preset 1 length 2 accumulated 2 position Displayed logical pp BT address symbol 0 Ui oe File type identifier 2 e 4 Kp 2 DLEN File number 6 Ki 3 data file Delimiter 8 Kd 4 element Element number 26 PV 5 rack grp slot MG 0 control 1 error 2 RLEN 3 DLEN All PD values are floating point values so they are two words long PLC 5 250 Logical Binary Addressing Byte Contents gt gt SS 1 mask byte The LSB determines whether the module ID byte is specified or use the default value which is always 0 bits 1 through 7 are associated with levels one through seven of a PLC 5 250 extended address You must always specify the last level of an address even if it is a 0 so that the actual number of levels in a particular address can be determined If a bit is set to 0 then a default value is assumed for the corresponding address level If a bit is set to 1 then you must specify a value for the corresponding address level in the bytes which follow Only those addre
254. ve if 1 3 Edit resource allocated if 1 4 Outputs reset if 1 5 Memory invalid if 1 6 SFC forces active if 1 7 Edit resource allocated by user if 1 5 all Processor Station Address on Link Publication 1770 6 5 16 October 1996 10 24 Diagnostic Status Information Bytes Bits Contents Description 6 7 all Program Change Sequence Count 1 word 8 9 all Data Change Sequence Count 1 word 10 11 all User Defined Data Change 1 word Sequence Count Publication 1770 6 5 16 October 1996 E Reference m Data Encoding Chapter 11 Uploading and Downloading with A B Processors Chapter 12 PLC Addressing Chapter 13 Line Monitor Examples Chapter 14 ASCII Codes Chapter 15 Chapter 1 1 Data Encoding This chapter provides e definitions of numbering systems you can use in your application e a message packet s order of transmission It contains these sections Section Page Numbering Systems 11 2 Order of Transmission 11 6 Publication 1770 6 5 16 October 1996 11 2 Data Encoding Numbering Systems Publication 1770 6 5 16 October 1996 In general PLC processors store binary data 1s and Os in 16 bit groups called words If you are looking at this data from a computer however you may interpret it in a number of different ways depending on your application needs You may use any one of the following numbering systems to represent data in your computer application program
255. vel 3 mask byte indicates 3 levels of addressing will be encoded level 1 value 0 data table level 2 value 7 file level 3 value 30 element or word 0 7 3 PLC 5 Logical Binary Address to Access the Address B3 300 1 Byte 0000 0 1 mask byte indicates 3 levels in the address Level 1 uses the default 0 Therefore only levels 2 and 3 will be encoded level 2 value 3 file FF flag indicating the next level is too large 300 to encode in one byte so it will be encoded into the next 2 bytes level 3 low byte value 44 element or word level 3 high byte value 256 element or word PLC 5 Logical Binary Address to Access the Address T4 2 ACC Byte 1 o o o o o o o o o o o o o o o o o o o o o o o o o mask byte indicates 4 levels of addressing to encode level 1 value 0 data table level 2 value 4 section level 3 value 2 element or word level 4 value 2 sub element Sub element 00 control 01 preset 02 accumulative PLC 5 Logical Binary Address to Access the Address PD12 10 SP Byte 1 ooo O o o o o o o o o o o o o mask byte indicates 4 levels of addressing to encode 0 level 1 value 0 data table 0 level 2 value 12 section 0 level 3 value 10 element or word 0 level 4 value 2 sub element Sub element 00 control 0 preset 02 accumulati
256. wece diocesa ras 1 2 DRUG crentes ie cote trinis ek ees E 1 2 Network Link 0 0 00 cece cece eee ees 1 2 DH Hink 2 veiaSeurrebadeinwetataudedhes outs 1 3 DHE NK cccutrcvancds cite hentidwadd ae dd dene 1 5 DH4SS LINK ociera Beebe iieii eden deaieod ees 1 6 Software Layers 0 0 cece eee ee eee 1 7 Data link Layer 1 0 ccc cee eee 1 7 Application Layer 2 0 0 ccc cee eee 1 8 Message Packet Structure 000eeeee 1 9 Command and Reply Message 2 1 9 Message Priority 00 cece eee eens 1 10 Delivery Order of Commands 005 1 10 Types of Commands 000 c cece eens 1 11 Error Codes anana nnn anana 1 11 Understanding DF1 Protocol 55 2 1 DFI Protocol orara dc0 oe eee denda ee a aa 2 2 Half duplex Protocol n n nananana nnna 2 2 Full duplex Protocol 00 0 0 cee eee eee eee 2 4 Character Transmission 00 0000 c cece eeees 2 5 Transmission Symbols 00cc cece cence 2 6 Table of Contents Using Half duplex Protocols to Send and Receive Messages 2 2eeeeeeeee Half duplex Protocol Message Transmission Transmitter and Receiver Message Transfer Half duplex Protocol Environment 05 Message Characteristics 00eeeeeeeee Master Polling Responsibilities 0200 Duplicate Detection 0 cece cece Inactive Slave Poll
257. y dified in th a dat bits to set to 1 in the which bits to reset to 0 in eel ee aa addressed PLC byte the addressed PLC byte table memory e Put the low byte least significant bits of the PLC address value into the first byte of the ADDR field Important eA 1 in the SET bit position means to set the corresponding bit in the addressed PLC byte to 1 eA 0 in the SET bit position means to leave the corresponding bit in the PLC byte unchanged eA 1 in a RESET bit position means to reset the corresponding bit in the addressed PLC byte to 0 eA 0 in the RESET bit position means to leave the corresponding bit in the PLC byte unchanged For some PLC processors the interface module at the receiving PLC node executes this command by making a copy of the addressed PLC byte It then sets or resets the appropriate bits and writes the byte back into PLC memory At the same time the PLC processor can change the states of the original bits in memory Because of this some data bits may unintentionally get overwritten Publication 1770 6 5 16 October 1996 7 16 Communication Commands MicroLogix 1000 SLC 500 SLC 5 03 SLC 5 04 MicroLogix 1000 SLC 500 SLC 5 03 SLC 5 04 Publication 1770 6 5 16 October 1996 protected typed file read Reads data from an open file in a MicroLogix 1000 or an SLC 500 processor MD FNC File C pst src C
258. y in 1997 This processor Connects to a DH link through the PLC 2 Family Interface module ee cat no 1785 KA3 through the I O Scanner Communication Adapter module PLC 3 cat nos 1775 S5 SR5 PLC 5 directly through the Resource Manager module PLC 5 250 cat nos 5130 KA RM1 RM2 SLC 5 04 directly You can configure the data rate for SLC 5 04 processors A DH link implements peer to peer communication with a token passing scheme to rotate link mastership among the nodes connected to that link Station connector 1770 SC personal computer FEN PLC 5 processor rn m PLC 5 250 processor T71 with 1784 KTx a aciet Lo notebook computer re cat no 5130 RM1 Ca m with 1784 PCMK rei JEJ TT l a daa alk i ii Ahea 7 1785 KE dudi S
259. ype Describe Problem s Internal Use Only E Technical Accuracy E text E illustration L Completeness L procedure step C illustration L definition _ info in manual What information is missing _ example C guideline C feature accessibility E explanation E other T info not in manual C Clarity What is unclear C Sequence What is not in the right order T Other Comments Use back for more comments Your Name Location Phone Return to Marketing Communications Allen Bradley Co 1 Allen Bradley Drive Mayfield Hts OH 44124 6118 Phone 216 646 3176 FAX 216 646 4320 Publication ICCG 5 21 August 1995 PN 955107 82 PLEASE FASTEN HERE DO NOT STAPLE Other Comments PLEASE FOLD HERE Snare cad neta eo POSTAGE WILL BE PAID BY THE ADDRESSEE ON Rockwell Automation Allen Bradley 1 ALLEN BRADLEY DR MAYFIELD HEIGHTS OH 44124 9705 NO POSTAGE NECESSARY IF MAILED IN THE UNITED STATES PLEASE REMOVE N Rockwell Automation Allen Bradley a Rockwell Automation Business has been helping its customers improve productivity and quality for more than 90 years We design manufacture and support a Allen Bradley broad range of automation products worldwide They include logic processors power and motion control devices operator interfaces sensors and a variety of software Rockwell is one of the world

1770-6.5.16, Front Cover

Contents

Download Pdf Manuals

Related Search

Related Contents