Home

Series 90 PLC SNP Communications User`s Manual, GFK

1. RS 232 RS 422 CONVERTER RS 422 WORKMASTER CIMSTAR MACINTOSH OR IBM AT XT COMPATIBLE SERIES 90 30 PLC SERIES 90 30 PLC SERIES 90 70 PLC v RS 422 Figure 1 6 Multidrop Serial Link Connection for Series 90 PLCs Optical isolation networks may be necessary for certain applications Refer to Figure 1 7 Chapter 1 Introduction 1 3 1 4 Where isolation is required the RS 422 Isolated Repeater RS 232 Converter GE Fanuc catalog number IC655CCM590 can be used in place of the RS 232 RS 422 Converter Figure 1 6 In addition to converting from RS 232 to RS 422 communications this unit provides ground isolation where a common ground cannot otherwise be established between components Figure 1 7 illustrates a full multidrop system using RS 422 isolated repeaters HOST COMPUTER Figure 1 7 Multidrop System Using RS 422 Isolated Repeater RS 232 Converter RS 232 CONVERTER RS 422 2000 FEET MAX ISOLATED REPEATER UNIT 1 PLC 1 PLC 2 PLC 16 K 6 4 gt a44784 xA TAS RI ISOLATED REPEATER UNIT 16 PLC 241 PLC 242 PLC 256 Nal FF Refer to Appendix A for detailed information about the serial port cable connection
2. 6 29 Write Program Block Memory nen nennen netten 6 30 Example of Write Program Block Memory sese 6 31 Explanation of Write Program Block Memory seen 6 32 PEC Short Status Request 4 eet tette Whe son eS e extet esses neh ieee 6 33 Example of PLC Short Status Request sesessseeeeeneeneneenennen 6 34 Explanation of Short Status Request 6 35 Return Control Program Name s esses 6 36 Example of Return Control Program Name eese 6 37 Explanation of Return Control Program 6 38 Return Controller Type and ID Information esee 6 39 Example of Return Controller Type and ID Information eee etree 6 40 Explanation of Return Controller Type and ID esee 6 41 Return PLC Time D te n tte eere tere lere ede teen teen eat he 6 43 Example of Return PLC Time Date esee 6 44 Explanation of Return PLC Time Date sese 6 45 Return Fault EE d ete es 6 46 Example of Return PLC Fault 6 49 Explanation of Return PLC Fault 6 50 Example of Return I O Fault Table essere 6 52 Explanation of Return I O Fault Table seen 6 53 C Tear Fault Ta
3. 6 74 Toggle Force System Memory ett i a e e ettet itae 6 75 Example of Toggle Force System Memory sese 6 77 Explanation of Toggle Force System Memory see 6 78 Datagram Service Requests essere ener nennen rennen nennen nennen 6 79 Establish Datagram Request esses nennen entere enne 6 81 Example of Establish Datagram One Point Format eene 6 82 Explanation of Establish Datagram One Point Format sees 6 83 Example of Establish Datagram Multiple Point 6 84 Explanation of Establish Datagram Multiple Point 6 85 Write Datagram Request supeo shag cett Eve ine ea dee get rene etin dh 6 86 Example of Write Datagram for the Series 90 30 PLCs One Point Format 6 88 Explanation of Write Datagram for Series 90 30 PLCs One Point Format 6 89 Example of Write Datagram for Series 90 30 PLCs Multiple Point Formats 6 90 Explanation of Write Datagram for Series 90 30 PLCs Multiple Point Formats 6 91 Example of Write Datagram for Series 90 70 PLCs One Point Format 6 93 Explanation of Write Datagram for Series 90 70 PLCs One Point Format 6 94 Example of Write Datagram for the Series 90 70 Multiple Point Formats 6 95
4. 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx f7 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 04 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the example follows 6 56 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Explanation of Clear PLC Fault Table Table 6 24 Clear PLC Fault Table Packet Byte Number Number s 1 22 28 31 32 33 34 35 36 37 38 39 40 Hex Value 10 3a 00 00 10 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 XX XX XX XX XX XX f7 d4 10 0a 00 00 10 3a 00 00 01 01 00 XX XX XX XX XX XX XX 00 04 00 00 5c 20 17 00 00 00 00 BCC Description Start of message character Message type for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number Total packets Request code Clear Fault Table Fault table to clear in this case PLC Not used Not used End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK
5. 06 00 wait T1 time 3 Completion ACK MB message with Connection Data Ib 4d XX XX XX Xx xx xx 71 94 10 0a 00 00 10 3a 00 00 Xx 01 1a 00 xx xx xx xx 01 01 00 01 00 00 5c 20 17 43 22 00 00 BCC wait T1 time 4 06 00 wait T1 time 5 Response Connection Data message 1b 43 06 xx xx xx 14 00 19 22 05 12 71 43 98 21 65 70 65 24 74 36 1c 12 90 12 39 67 17 00 00 00 00 BCC wait T1 time 6 gt ACK 06 00 GFK 0529C Chapter 6 Service Requests 6 101 6 102 Explanation of Update Datagram for the Series 90 30 PLCs Multiple Point Formats Table 6 40 Update Datagram for the Series 90 30 PLCs Multiple Point Formats Packet Byte Number Number s Hex Value Description E 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 71 Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 Oa 00 00 Mailbox destination PLC service request task 19 20 01 01 Packet number total packets 21 16 Request code Update Datagram 22 06 Datagram Connection ID 23 01 Normal Datagram 24 34 01 00 00 00 00 00 Not used 00 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 1b Start of message character 2 4d Message type
6. esee 6 106 GFK 0529C Contents Table 6 43 Cancel Data granny ee eder tee ree t ae Rte eroe tee ae 6 109 Table 6 44 Update Real Time Datagram for Series 90 30 PLCs One Point Format 6 113 Table 6 45 Program Load for Series 90 30 nre 6 117 Table 6 45 Program Load for Series 90 30 PLCs continued serene 6 118 Table 6 46 Program Store for Series 90 30 PLCS essesssseeseesseeeeeeeeeee nennen etren eren 6 122 Table 6 46 Program Store for Series 90 30 PLCs continued esee 6 123 Table A 1 Connector Cable Specifications 3 Table A 2 Series 90 PLC RS 422 Serial Port Pin Assignment sese enn enne A 5 Table A 3 Workmaster RS 232 Serial Port Pin Assignment eese A 6 Table A 4 IBM AT XT Serial Port Pin Assignment essere A 7 Table 5 RS 232 RS 422 Converter Pin Assignment A 9 GFK 0529C Contents xiii Chapter 1 0529 Introduction The Series 90 Protocol SNP is a serial protocol used in the Series 90 PLC family to communicate between a host device and the Programmable Logic Controller PLC via a serial port on the PLC A protocol is a set of rules that define an orderly transmission of data In the case of SNP it is a
7. for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 71 Sequence number 10 94 Mailbox type Completion ACK with Connection Data 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 XX XX Reserved don t care 21 22 la 00 Connection Data size in bytes 23 26 XX XX XX XX Don t care 27 28 0101 Packet number total packets 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 43 Next message type for Connection Data 37 38 22 00 Next message length in bytes 0022h 34 39 00 Status byte 40 BCC Block Check Code 5 lt 1 1b Start of message character 2 43 Message type for Connection Data 3 06 Datagram Connection ID 4 6 XX XX XX Don t care 7 8 1400 Point definition size 9 18 19 22 05 12 71 43 98 21 65 70 5 96R9 19 22 65 24 74 36 17 96T48 23 Ic M3 MS 24 12 182 96187 25 28 90 12 39 67 M33 M64 29 17 End of block character 30 00 Next message type 31 32 00 00 Next message length 33 00 Status byte 34 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Update Datagram for Series 90 70 PLCs One Point Format This example requests an update of reference data defined in Datagram ID one 1 Datagram ID on
8. Invalid program fault exists run mode request Invalid new state specified valid values 0 1 2 or 6 Two examples with full explanations follow Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Set PLC State to Run I O Enabled This example sets the PLC state to Run mode I O enabled The example assumes that the master has already attached to the slave device has set the privilege level to two 2 and has logged in as the programmer The master sends the Initial Request Mailbox message to the slave with the service request code for Set PLC State 23h and the new state field set Run I O Enabled 00h The slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 05 cO 10 00 00 10 Oa 00 00 01 01 23 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx 05 d4 10 0a 00 00 10 3a 00 00 01 01 OO xx xx xx xx xx xx xx 00 02 xx xx 4c xx 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 71 6 72 Explanation of Set PLC State to Run 1 0 Enabled Table 6 29 Set PLC State to Run 1 0 Enabled Packet Byte Num
9. 00 00 10 00 00 01 01 15 01 34 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX Xx xx xx 6d d4 10 0a 00 00 10 3a 00 00 01 01 00 xx 06 xx xx xx xx xx 00 01 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the example follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Explanation of Establish Datagram Multiple Point Formats Table 6 34 Etablish Datagram Multiple Point Formats Packet Byte Number Number s Hex Value Description 1 5 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 6d Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 21 15 Request code Establish Datagram 22 01 Datagram type 01 Update on Request 23 24 34 00 Datagram size in bytes 0034h 52 25 34 00 00 00 00 00 Not used 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 1 1b Start of message character 2 4d Message type for Mailbox 3 4
10. A and B are the same as and A and B denote outputs and A and B denote inputs Termination resistance for the Receive Data RD signal needs to be connected only on units at the end of the lines This termination is made on the Series 90 PLC products by connecting a jumper between pins 9 and 10 inside the 15 pin D shell with the following exception For Series 90 70 PLCs Cat s IC697CPU731 and IC697CPU771 the termination for RD at the PLC is implemented by a jumper between pins 9 and 11 Appendix A Serial Port and Cables A 5 A 6 Workmaster Serial Port The Workmaster II industrial computer RS 232 serial port is a 25 pin D type male connector and the early model Workmaster is a 9 pin male connector Figure A 2 shows the serial port connector layout for both computers Table A 3 shows the pin numbering and signal assignment for both connector types WORKMASTER II Jo 13 PIN o o o 0 0 o9 o9 o o o 0 0 o9 o 44522 WORKMASTER EARLY MODEL OO Figure A 2 Workmaster RS 232 Serial Port Connector Configuration Table A 3 Workmaster RS 232 Serial Port Pin Assignment Workmaster II 25 pin connector Workmaster 9 pin connector Pin No Signal Description Pin No Signal Description 1 1 2 TD Transmit Data 2 TD Transmit Data 3 RD Receive Data 3 RD Receive Data 4 RTS Request to Send 4 RTS Request to Send 5 CTS
11. Attach CPU ID Field The CPU ID field is 8 bytes long For Series 90 70 PLCs the CPU ID can be a maximum of 7 bytes followed by a NUL character 0 and can include any ASCII character For Series 90 30 PLCs the CPU ID is restricted to a maximum of 6 bytes followed by a NUL character 0 The values of the 6 bytes are further restricted to the ASCII characters 0 through 9 inclusive and A through F inclusive must be capital letters Attach Master T1 Field The T1 time is a word value defined in milliseconds and encoded in ASCII hexadecimal format using four bytes within the Attach message with the two character codes representing the least significant byte of the word value occurring first followed by the two character codes representing the most significant byte For instance if 1 equals 10 milliseconds the four bytes in ASCII hexadecimal are 30 41 30 30 0A00 000A hexadecimal value 10 ms Attach Message Example 3 4 In this example the master wishes to connect to the PLC CPU whose ID is 33101 and the master s T1 time is 10 ms The master sends the following series of bytes over the serial link Ib 41 33 33 31 30 31 41 00 00 30 41 30 30 30 20 20 20 17 00 00 00 38 35 where the bytes break down as follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Table 3 3 Attach Message Example Byte Number Value Description 1 1b Start of message character
12. be used to convert from RS 232 to RS 422 communications The converter has one 15 pin female D type port and one 25 pin female D type port This converter unit can be purchased from GE Fanuc Automation Please contact any GE Fanuc Automation sales office or field service representative RS 232 RS 485 244539 CONVERTER RS 232 RS 485 25 PIN ICG90ACC900 TE PIN 1 1 SHIELD lt K SHIELD 9 TERMINATOR RESISTOR 120 4 lt RD B 10 13 gt gt sb e D RTS SG NC Figure A 4 RS 232 to RS 422 Converter Logic Diagram Note Ground isolation is not a feature of this unit For isolation refer to Figure A 6 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C RS 232 RS 232 RS 422 RS 422 a44504 SHIELDED CONVERTER TWISTED SHIELDED PAIRS IC690ACC900 PAIRS 0 0 00 0 0 0 lt 0 0 0 0 0 0 0 0 0 SERIES HOST 00 00 90PLC COMPUTER 0 0 lt 0 RS 422 5 0 lt 0 PORT 0 0 gt 0 0 0 9 x 0 0 0 0 0 0 0 0 0 0 0 Lo 25 PIN 25 PIN 15 PIN 15 PIN MALE FEMALE FEMALE FEMALE RS 232 RS 422 PORT PORT POWER SOURCE FOR POINT TO POINT CONNECTION 10 FEET 3 METERS ONLY CONVERTER POWER SOURCE BEYOND 10 FEET 3 METERS AND FOR MULTIDROP CONNECTION MUST BE EXTERNAL SOURCE TERMINATION RESISTANCE FOR THE RECEIVE DATA RD SIGNAL NEEDS TO BE CONNECTED ONLY ON UNITS AT THE END OF THE LINES T
13. 78 words R memory in word mode 005Ch 92 word index to R93 0006h 6 words L memory in word mode 0006h word index to L7 0001h 1 word GFK 0529C 4 Read System Memory The Read System Memory Read SMEM request allows the master to access a single contiguous block of data from any PLC System Memory Type Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 04h Read System Memory Segment Selector byte 22 See Segment Selector Table Table Data Offset bytes 23 24 Zero based offset of data Data Length bytes 25 26 Length of data to read Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message 94h Completion ACK Mailbox message with Text Buffer Dih_ Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h or Completion ACK Mailbox message with Text Buffer 94h is returned to the master The type of Mailbox message returned depends on the amount of data to be passed back to the master If the number of data bytes being read is six bytes or less the slave responds with a Completion ACK Mailbox message which contains the data read If the number of data bytes being read is greater than six bytes the slave responds with a Completion ACK Mailbox message with Text Buffer and the data read
14. FANUC GE Fanuc Automation Programmable Control Products Series 90 PLC SNP Communications User s Manual GFK 0529C September 1998 GFL 002 Warnings Cautions and Notes as Used in this Publication Warning notices are used in this publication to emphasize that hazardous voltages currents temperatures or other conditions that could cause personal injury exist in this equipment or may be associated with its use In situations where inattention could cause either personal injury or damage to equipment a Warning notice is used Caution notices are used where equipment might be damaged if care is not taken Note Notes merely call attention to information that is especially significant to understanding and operating the equipment This document is based on information available at the time of its publication While efforts have been made to be accurate the information contained herein does not purport to cover all details or variations in hardware or software nor to provide for every possible contingency in connection with installation operation or maintenance Features may be described herein which are not present in all hardware and software systems GE Fanuc Automation assumes no obligation of notice to holders of this document with respect to changes subsequently made GE Fanuc Automation makes no representation or warranty expressed implied or statutory with respect to and assumes no responsibility for the accur
15. 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Chapter 6 Service Requests 6 13 Example of Read SMEM with Text Buffer R Word Mode This example reads the eleven words of register data starting at R3 up to and including R13 using the R segment selector with a data offset and data length whose units are word The example assumes that the master has already attached to the slave device and R3 through R13 have the following values R3 3489h R5 9071h R7 2627h R9 8431h R11 1234h R4 1217h R6 2853h R8 0917h R10 4172h R12 5678h R13 0987h The master sends the Initial Request Mailbox message to the slave with the service request code equal to Read System Memory 04h along with Segment Selector Data offset and Data Length The slave responds with a Completion Ack Mailbox message with Text Buffer which includes piggy back status information After the master acknowledges the Mailbox message the slave sends the Text Buffer message The Text Buffer message has 22 bytes of data which reflect the 11 words of register data R3 through R13 MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 62 cO 10 00 00 10 00 00 01 01 04 08 02 00 Ob 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 lt Completion ACK MB messag
16. 37 38 39 40 Hex Value 10 3a 00 00 10 0a 00 00 00 01 12 00 00 00 00 00 0101 53 54 41 54 5f 31 00 00 9b 4a 63 34 cb la d4 91 c3 8b 17 XX XX XX XX XX XX f2 d4 10 0a 00 00 10 3a 00 00 0101 00 XX XX XX XX XX XX XX 00 02 00 00 7 31 17 00 00 00 00 BCC Description Start of message character Message type 2 M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request with Text Buffer Mailbox source Master SNP device Mailbox destination PLC service request task Reserved first byte zero second byte one Total length of data in bytes 0012h 18 Reserved must be set to zero Packet number total packets Request code Write Task Memory Segment Selector P memory Data offset 26h 38 word offset for P39 Data length 5 words End of block character Next message type T for Text Buffer Next message length in bytes 001 26 Status byte Block Check Code Start of message character Message type for Text Buffer Control Program name STAT_1 Data to write to P39 P43 End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type M for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK Mailbox source PLC servi
17. 6 42 Table 6 17 Return Control Type and ID continued Packet Number 5 Byte Number s 15 22 23 24 25 28 29 30 31 34 35 36 37 38 39 42 43 44 45 46 47 48 Hex Value 1b 54 33 33 31 30 31 41 00 00 10 23 01 00 45 53 53 33 33 31 00 00 01 00 a3 07 00 00 9a 01 9b cd 00 00 d6 06 2201 c8 eb 00 00 17 00 00 00 00 BCC Description Start of message character Message type for Text Buffer PLC CPU controller ID 33101A PLC CPU Major Type 10 hex Series 90 30 PLC PLC CPU Minor Type 23 hex 331 CPU Number of programs 1 Reserved don t care Program name ESS331 Number of programs 0001 Total length of program blocks 07a3h Sum of Program blocks additive checksums 019ah Sum of program block additive checksums Sum of Program blocks CRC checksums Ocd9bh Sum of program block CRC checksums Length of Configuration records 6d6h Sum of Configuration records Additive checksums 0122h Sum of configuration additive checksums Sum of Configuration records CRC checksums Oebc8 Sum of configuration CRC checksums End of block character Next message type Next message length Status byte Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Return PLC Time Date The Return PLC Time request enables the master to obtain the current time and date stored in the PLC CPU Key fields within th
18. An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 107 Example of Cancel Datagram This example cancels the Datagram Connection ID five 5 The master sends the Initial Request Mailbox message to the slave with the service request code for Cancel Datagram 17h along with the Datagram ID The slave responds with a Completion ACK Mailbox message which contains the the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 6f cO 10 3a 00 00 10 0a 00 00 01 01 17 05 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message b 4d XX XX Xx xx xx xx 6f d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 01 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 06 00 A full explanation of the SNP messages used in the example follows 6 108 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Explanation of Cancel Datagram Table 6 43 Cancel Datagram Packet Byte Number Number s 1 22 28 31 32 33 34 35 36 37 38 39 40 Hex Value 10 3a 00 00 10 0a 00 00 01 00 00 00 00 00 00 00 00 00 00 00 XX XX XX XX XX XX 6f d4 10 0a 00 00 10 3a 00 00 01 01 00 XX XX XX XX XX XX XX 00 01 00 00 5c 20 17 00 00 00 00 BCC Description Start of message ch
19. Attach Response Message Change Privilege Level MB Change to Level 2 in order to write system memory _ACK _Change Privilege Level Response MB ACK Write System Memory MB _ _ACK _Write System Memory Response MB ACK_ The long break is not required for Break Free SNP operation GFK 0529C Chapter 1 Introduction 1 11 Definition of Terms A brief list of acronyms abbreviations and terms used throughout this manual are introduced here in order to facilitate the reading of this manual Acronyms and Abbreviations ASCII ACK BCC BCD CPU CRC ESC ETB T O K LM90 MB MS NAK NUL PBMEM PLC SMEM SNP SNP X TMEM UART WSIB WS9 XX American Standard Code for Information Interchange An eight bit 7 bits plus 1 parity bit code used for data The ASCII ACKnowledgment character 06h hexadecimal Block Check Code Binary Coded Decimal Central Processing Unit usage in this document refers to a Series 90 family PLC CPU Cyclic Redundancy Check The ASCII ESCape character 1bh hexadecimal The ASCII End of Block character 17h hexadecimal Input Output 1024 LogicMaster 90 GE Fanuc Programming software that can be used to create ladder logic programs and configuration for the Series 90 PLC family The LM90 programming software connects to the target PLC via the Work Station Interface WSIB WS9 hardware or a serial communication port Mailbox message Millisecond The ASCII Negative
20. Mailbox source PLC service request task Mailbox destination Master SNP device Packet number Total packets Status code 0 okay Don t care Control program number Current privilege level Last sweep time PLC status word End of block character Next message type Next message length Status byte Block Check Code GFK 0529C Chapter 6 Service Requests 6 57 Programmer Logon The PLC Programmer Logon Request allows a device to login and logout as a programmer attachment Some service requests require that the master be logged in as a programmer attachment such as Set Control ID and Set PLC State When the master attaches to a Series 90 70 PLC CPU the master is automatically logged in to the Null task Therefore in order to issue a Set Control ID or Set PLC State service request no explicit logon request is required If however the master wishes to Load and Store Program Blocks the master must issue a logon request with a valid program task name before making a Load or Store Program Block service request There is no automatic logon when the master attaches to a Series 90 30 PLC CPU Therefore the master must make an explicit logon request either to the Null task or program task before any service request requiring programmer attachment login can be made Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox mes
21. N 6 N 7 N 8 Size in Bytes e Start of message character ESC 1bh Message type character Data bytes of the message Length N and content depend on the message type End of block character 17h marks the beginning of the message trailer Next message type Least significant byte of the next message length Most significant byte of the next message length Status byte or most significant ASCII hexadecimal digit of Block Check Code in Attach Attach Response message Block Check Code or least significant ASCII hexadecimal digit of Block Check Code in Attach Attach Response message Description SNP Message Header Two bytes make up the header of the SNP message and are defined as follows ESC Character 1bh Start of message every SNP message begins with this character Message Type One byte message type whose valid values are 41h 52h 4Dh 54h 42h 43h 55h 49h A R M T B C U D for Attach message for attach Response message for Mailbox message for Text buffer message for Block transfer message for Connection data message for Update real time connect message for Inquiry message 3 1 SNP Message Trailer The SNP message trailer is made up of six bytes which is defined as follows ETB Character 17h Every SNP message s trailer begins with the end of block character Next Message Type This field is one byte and equal
22. Number 1 2 Byte Number s 11 14 15 18 19 20 21 22 23 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 Hex Value 10 3a 00 00 10 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 XX XX XX XX XX XX Ic 94 10 0a 00 00 10 3a 00 00 XX 01 8a 00 XX XX XX XX 01 01 00 01 00 00 74 30 17 54 92 00 00 BCC Description Start of message character Message type M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Mailbox destination Packet number Total Packets Request code Return Fault Table Fault Table Type in this case IO Fault table index start with first fault No of Entries to Return in this case entire table 0020h 32 Not used End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK with Text Buffer Mailbox source Mailbox destination Reserved don t care Number of destinations always one Total length of data in bytes 008ah 138 Don t care Packet number Total packets Control program number Current privilege level Last sweep time PLC status word End of block character Next message type for Text Bu
23. The slave responds with a Completion ACK Mailbox message which includes piggy back status information After the master acknowledges the Mailbox message the slave transmits the Text Buffer message containing the PLC fault table data MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 1c c0 10 00 00 10 00 00 01 01 38 01 00 00 20 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 c Completion ACK MB message with Text Buffer 1b 4d XX XX XX xx xx xx Ic 94 10 0a 00 00 10 3a 00 00 xx 01 8a 00 xx xx xx xx 01 01 00 01 00 00 74 20 17 54 92 00 00 BCC wait T1 time 4 ACK 06 00 wait T1 time 5 Response Text Buffer message 1b 54 53 20 12 07 06 90 03 00 03 00 03 00 xx ff 00 00 00 03 7f 7f ff 7f 03 02 Oe 00 OO xx xx xx XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX xx xx 21 55 12 07 06 90 xx ff 00 00 00 06 7f 7f ff 7 07 02 Of 00 00 xx xx xx XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 21 55 12 07 06 90 xx ff 00 00 01 03 7f 7f ff 7f 03 02 Oe 00 00 xx xx XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX xx xx xx 21 55 12 07 06 90 17 00 00 00 00 06 wait T1 time 6 06 00 A full explanation of the SNP messages used in the example follows 6 52 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Explanation of Return 1 0 Fault Table Table 6 23 Return 1 0 Fault Table Packet
24. This field is optional and may or may not be filled in by either side Each Series 90 PLC CPU model that has a time of day clock fills in this field in Completion ACK and Error Nack Mailbox messages returned to the master The master SNP implementation may or may not fill this in as seen fit by the implementor Sequence Number One byte field that the master fills in Valid values range from 00 through ffh inclusive This value is copied into the sequence number field of the reply mailbox message either the Completion ACK or Error Nack Mailbox message Mailbox Type One byte code that specifies the type valid values used by master SNP implementations are COh and 80h Valid values used by slave SNP implementations are D4h 94h and Dih GFK 0529C Chapter 3 SNP Protocol 3 7 3 8 Mailbox Source ID and Destination ID fields Each ID field is four bytes in length and describes the task where the Mailbox message originates source and where the Mailbox message is destined destination Quite simply there are three possible IDs Device Four byte ID Master SNP device 10 3a 00 00 Slave Service Request task 10 0a 00 00 Slave SNP task 10 3e 00 00 In the Initial Request Mailbox messages both with and without Text Buffers the Source ID field is always set to that of the master SNP device 10 3a 00 00 The Destination ID field is always set to the slave Service Request task 10 0 00 00 except in the one special case of the SNP Parameter Se
25. an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response to a Return Fault Table request are D Insufficient privilege Series 90 70 PLC must be level 1 or higher D Invalid Fault Table Type 1 I O 2 PLC all others invalid Response Text Buffer Message The first twelve 12 bytes of the response Text Buffer message is a fault header which has the following format Time Stamp of last clear Bytes 3 8 Faults since last clear Bytes 9 10 Faults in the table Bytes 11 12 Faults entries in this response Bytes 13 14 6 46 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 The remainder of the Text Buffer message s is the actual fault data for each fault requested Every fault takes 42 bytes Therefore where N is the number of fault entries returned in the response the total size of fault data returned from this request is as follows 12 fault header bytes 42 N The format of the 42 bytes differs between the two tables Picking up the byte numbering after the header we have the following two formats Table 6 19 Format for the PLC and 1 0 Faults PLC Fault 42 bytes T O Fault 42 bytes Spare byte Byte 15 Spare bytes Bytes 15 18 Reference address Bytes 16 18 Rack number Byte 19 Rack number Byte 19 Slot number Byte 20 Slot number Byte 20 Unit num
26. must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 52 Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 21 21 Request code Change Privilege level 22 ff Privilege Level requested 1 find the level 23 30 41 42 31 00 00 00 0000 Password ABI 31 34 00 00 00 00 Not used 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 10 Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 52 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 03 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Chapter 6 Service Requests 6 7 Read and Write PLC Memory 6 6 This section describes service requests that allow you t
27. 0 0 12 19 RTS B 00 0 RTS 24 0 Fg 18 CTS Bb ISOLATED SERIES 90 s 0 0 saw i 10 HE E 00 repeater i s 00 ase 22 C 00 converter HOST 00 ow 23 Lg Fg ris 5 BRICK 0 R SHLD 11 Il 47 0 1 It I 0 0 o L E E O 2o 0 0 o 0 zi gr m 90 LL 25 PIN 25 PIN 25 PIN 25 PIN FEMALE MALE MALE FEMALE TERMINATE CONNECTION ON THE CMM INSTALL JUMPER TO CONNECT INTERNAL 120 OHM RESISTOR ON THE ISOLATED REPEATER CONVERTER INSTALL 150 OHM RESISTOR SUPPLIED NOTE PIN ASSIGNMENTS CORRESPOND TO SERIES 90 CMM MODULE PIN ASIGNMENTS MAY DIFFER FOR OTHER HOST DEVICES Figure A 11 Cable B RS 422 Device to Converter Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C SUBSTITUTE APPROPRIATE UP STREAM DEVICE WITHIN DOTTED BOX PER SYSTEM DIAGRAMS SHIELDED MAKE CONNECTIONS Se SS ee E E TWISTED INSIDE D CONNECTORS SERIES 90 CMM PORT 10R2 25 PIN FEMALE ISOLATED REPEATER CONVERTER BRICK 25 PIN FEMALE WHEN WIRING RS 422 485 MULTIDROPCABLES REFLECTIONS ON THE TRANSMISSION LINE CAN BE REDUCED BY CONFIGURING THE CABLE IN A DAISY CHAIN FASHION AS SHOWN BELOW MASTER CMM SLAVE 1 CPU BUILT IN PORT CMM SLAVE 2 ALSO IT IS RECOMMENDED TO MAKE ANY NECESSARY CONNECTIONS INSIDE THE CABLE CONNECTOR T
28. 00 to ffh inclusive equal to the sequence number passed in the Initial Request Mailbox 10 1 dl Mailbox Type Error Nack 11 14 4 10 0a 00 00 Mailbox Source ID PLC service request task 15 18 4 10 3a 00 00 Mailbox Destination ID master SNP device 19 1 01 Packet Number 20 1 01 Total Packets 21 1 XX Major Error Status See Table 3 12 22 1 XX Minor Error Status See Tables 3 13 and 3 14 23 34 12 XX XX XX XX xx Xx Don t care XX XX XX XX XX XX 35 1 17 End of block character 36 1 00 Next message type 37 38 2 00 00 Next message length 39 1 00 Status byte 40 1 XX Block Check Code BCC The key fields in the Error Nack mailbox are bytes 21 Major Error Status and 22 Minor Error Status The minor error status only has meaning for certain major error status codes The following tables define the error status codes Unless otherwise stated the minor error status code is undefined The minor error status codes are broken into two tables one for general errors and the second for errors due specifically to program load and store requests Chapter 3 SNP Protocol 3 15 3 16 Table of Major Error Status Codes Table 3 12 Major Error Status Codes Error Status Description Olh Illegal Service Request either not defined or not supported 02h Insufficient Privilege the minor status field contains the privilege level required for the service request 04h Protocol Sequence Error the CPU has received a message that is o
29. 07h along with the segment selector data offset and data length The slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 04 cO 10 00 00 10 Oa 00 00 01 01 07 48 12 00 17 00 e2 34 57 ff 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 ACK 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx 04 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 02 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 gt ACK 06 00 A full explanation of the SNP messages used in the example follows Chapter 6 Service Requests 6 17 Explanation of Write SMEM no Text Buffer Q in Bit Mode Table 6 7 Write SMEM no Text Buffer Q in Bit Mode Packet Byte Number Number s Hex Value Description 12 Start of message character Message type 2 M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request 10 3a 00 00 Mailbox source Master SNP device Packet number Total packets Request code Write System Memory Segment Selector Q data in bit mode 12 00 Data offset 0012h 18 zero based Q19 17 00 Data length 0017h 23 bits e2 34 57 ff Data to write 00 00 00 00 Not used End of block character Next message type Next message length Status byte Blo
30. 1 7 Return Control Program Name sess 1 7 Return Controller TYPE and ID eese 1 7 Return PEC Time Date eee cette eee tex er eee E 1 7 Return Fault ette tr e eee tex Siete ee NER 1 7 Clear Fault TableJz iic eh Rt mee ree ERE eR 1 7 Programmer ee eror ee ERE ve EARS 1 7 Set Control CPU ID t tentent to tem 1 7 Set PEC Time Date tee tom et ie tree tete eges 1 8 SELPILG S tates E 1 8 Toggle Force System Memory essere nennen eene 1 8 Storing and Loading Logic Programs To and From the PLC 1 8 Data Brains eee UR einen Up Rete Uie 1 8 Brief Introduction to the SNP Protocol essent 1 9 Definition of Terms esee er e YR SERRE 1 12 Acronyms and Abbreviations esses nennen nennen nennen nennen 1 12 BasiC Tetms n redet he Lt e Rr I 1 13 ConVentlons 1 3 vn EI te eee A need 1 13 serial Setup Parameters 2 vu ene ERREUR UHR PLI Ret uedieee 2 1 e eii cer sicot e des ee hastens tee 2 2 SABEN C 2 3 SNP Messa ge Header eso dee e ee oret ire eene SETS 3 1 SNP Message Trailer eee petet egredi tester etes 3 2 Data Bytes NC X 3 3 Attach Message imn anre ae ee e Re ee PR Ree e ead 3 3 Attach CPU ID Field nhe ete ae PDAS 3 4 Attach Master T1 Field erret temere
31. 10 0a 00 00 Mailbox destination PLC service request task 19 20 0101 Packet number total packets 21 16 Request code Update Datagram 22 02 Datagram Connection ID 23 01 Normal Datagram 24 34 01 00 00 00 00 00 Not used 00 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 1b Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 71 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 0101 Packet number total packets 21 00 Major status code 0 okay 22 28 XX XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 7 31 PLC status word 35 17 End of block character 36 43 Next message type for Connection Data 37 38 26 00 Next message length in bytes 0026h 38 39 00 Status byte 40 BCC Block Check Code 5 lt 1 1b Start of message character 2 43 Message type for Connection Data 3 02 Datagram Connection ID 4 6 XX XX XX Don t care 7 8 18 00 Reference data size 0018h 24 bytes 9 18 19 22 05 12 71 43 98 21 65 70 TRS 96R9 19 24 97 12 1231 cd la 96RA1 WR43 25 28 65 24 74 36 96T17 T48 29 32 90 12 39 67 M3
32. 187 37 16 M byte memory 38 39 04 00 Point offset in bytes 0004h gt M33 40 04 Point length 4 bytes 41 17 End of block character 42 00 Next message type 43 44 00 00 Next message length 45 00 Status byte 46 BCC Block Check Code 5 1 16 Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 6e Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 0101 Packet number total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Write Datagram for Series 90 70 PLCs One Point Format This example defines the reference data for Datagram ID one 1 We assume the master has already issued the Establish Datagram request and the PLC returned a Datagram Connection ID of one The definition specifies one point format inputs 11 to 1112 This group of inputs spans 14 bytes The segment selector used is I byte mode the point offset
33. 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 04 Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 21 21 Request code Change Privilege level 22 04 Privilege Level requested in this case 4 23 30 00 00 00 00 00 00 00 00 Password Null 31 34 00 00 00 00 Not used 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 1 1b Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 04 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 04 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Chapter 6 Service Requests 6 5 6 6 Example of Ch
34. 39 00 Status byte 40 BCC Block Check Code 9 lt 1 1b Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 2c Sequence number 10 94 Mailbox type Completion ACK with Block 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 XX Reserved don t care 20 01 21 22 02 Block Transfer data size in bytes 23 26 XX XX XX XX Don t care 27 01 Packet number 28 01 Total packets 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 4c 20 PLC status word 35 17 End of block character 36 42 Next message type for Block Transfer 37 38 72 02 Next message length 39 00 Status byte 40 BCC Block Check Code 11 lt 1 1b Start of message character 2 42 Message type B for Block Transfer 3 620 xx 618 Declaration block bytes 618 decimal bytes 621 17 End of block character 622 00 Next message type 623 624 00 00 Next message length 625 00 Status byte 626 BCC Block Check Code 6 118 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C a Program Store Series 90 30 PLCs The Program Store Request allows the master to store a user program from the master SNP device to a Series 90 30 PLC A user program on Series 90 30 PLCs consists of two parts the Logic Block and the Declarati
35. 54 12 00 00 BCC wait T1 time 4 ACK 06 00 wait T1 time 5 Response Text Buffer message 1b 54 9b 4a 63 34 cb 1a d4 91 c3 8b 17 00 00 00 00 BCC wait T1 time 6 06 00 A full explanation of the SNP messages used in the example follows 6 22 Series 90M PLC SNP Communications User s Manual September 1998 GFK 0529C Explanation of Read Task Memory Table 6 9 Read Task Memory Packet Byte Number unser Hex Value Description 10 3a 00 00 10 0a 00 00 0101 26 00 05 00 53 54 41 54 5F 31 00 00 10 0a 00 00 10 3a 00 00 XX XX 0a 00 XX XX XX XX 0101 9b 4a 63 34 cb la d4 91 c3 8b Chapter 6 Service Requests Start of message character Message type 2 M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number total packets Request code Read Program BLock Memory Segment Selector P memory Data offset 26h 38 word offset for P39 Data length 5 words gt P39 P43 Main Program Task Name STAT 1 End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type 2 M for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK with Text Buffer M
36. 8 bits Parity odd odd Stop Bits 1 1 Max Link Idle Time 10 seconds 5 seconds Modem Turn Around Time 0 ms 0 ms GFK 0529C 2 1 Timers 2 2 If you wish to use values other than the factory defaults you must set up the new values through some means external to SNP before the SNP protocol can be invoked On Series 90 70 PLCs this may be accomplished via the LM90 WSIB link or on Series 90 30 PLCs via the Hand Held Programmer or LM90 WSIB link Adjustable timers are provided because different PLCs within the Series 90 PLC family can coexist on a given SNP serial link each with its potentially different processor and different processing capability The SNP protocol provides several timers whose values may be adjusted by the user to allow the serial communication link to run as efficiently as possible for a given situation The following is a description of the five SNP timers T4 4 is the break processing time It is the minimum time the master is required to wait between the end of transmission of the long break and the first character of the attach message The break processing time is necessary in order to give the slave time to recognize the long break and prepare to receive the Attach message This timer is used only by the master but its value is determined by the PLCs on the serial link must be at least 50 ms 600 ms with modems T1 T1 15 the amount of time that must elapse between the reception of the last character or tra
37. ACKnowledgment character 15h hexadecimal The ASCH NUL character 00h hexadecimal Program Block MEMory L Series 90 70 PLCs only Programmable Logic Controller System MEMory I WQ T WM WSA WSB WSC 96S G Series Ninety Protocol Series Ninety Protocol Enhanced Task MEMory P Series 90 70 PLCs only Universal Asynchronous Receiver Transmitter samples communications bit stream input data Work Station Interface revision B WSIB and Work Station Interface Series 90 WS9 boards high speed data interfaces between PC XT AT WSIB and Micro Channel WS9 host machines for Series 90 Configurer Programmer software and the Series 90 PLC family of CPUs A notation used in the SNP service request examples and Mailbox Message descriptions within this document This notation represents those bytes whose values are either meaningless to the master SNP user or are dependent on the request being made Micro Channel Registered trademark of International Business Machines Corporation 1 12 Series 90 M PLC SNP Communications User s Manual September 1998 GFK 0529C Basic Terms Break Free SNP An updated version of the SNP protocol providing break free operation When normal breaks are received SNP SNP X communication is identical to previous versions of the protocol requiring the long break However this version of the protocol can also recognize an Attach or X Attach message without a preceding break Error
38. Code Start of message character Message type 2 M for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK with Text Buffer Mailbox source PLC service request task Mailbox destination Master SNP device Reserved don t care Total length of data in bytes 0016h 22 Don t care Packet number total packets Control program number Current privilege level Last sweep time PLC status word End of block character Next message type for Text Buffer Next message length in bytes 001 30 Status byte Block Check Code Start of message character Message type for Text Buffer R3 through R13 where each word is returned as least significant byte 1st most significant byte2nd End of block character Next message type Next message length Status byte Block Check Code 6 15 Write System Memory The Write System Memory Write SMEM request allows the master to write a single contiguous block of data to any PLC System Memory Type Key fields within the request and response messages Request Mailbox Message without Text Buffer If the amount of data to be written is eight bytes or less then an Initial Request Mailbox message with the data contained in the Mailbox message itself is all that is needed Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 07h Write System Memor
39. Explanation of Write Datagram for Series 90 70 PLCs Multiple Point Formats 6 96 Update Dat gr in 2 re eter eee EACH FER ee ei enn 6 98 Example of Update Datagram Request for the Series 90 30 PLCs One Point OPM abs se sa jeeecsdascts cai 6 99 Explanation of Update Datagram for Series 90 30 PLCs One Point Format 6 100 Example of Update Datagram Request for Series 90 30 PLCs Multiple Point EE dense oveceses E E 6 101 Explanation of Update Datagram for the Series 90 30 PLCs Multiple Point FONDAS erreseina eoten enee EN E aa eaer a e nE E SESE 6 102 Example of Update Datagram for Series 90 70 PLCs One Point Format 6 103 Explanation of Update Datagram for Series 90 70 PLCs One Point Format 6 104 Example of Update Datagram for Series 90 70 PLCs Multiple Point Formats 6 105 Explanation of Update Datagram for Series 90 70 PLCs Multiple Point 6 106 Cancel Datagram ius cierre te entere te etie tte ed Ree 6 107 Example of Cancel Datagram oet etie tete 6 108 Explanation of Cancel Datagram sees 6 109 Update Real Time Datagram eiei e nennen nennen nnne nennen nen 6 110 Example of Update Real Time Datagram for Series 90 30 PLCs One Point 6 112 Explana
40. Mailbox message Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU is unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message is e Insufficient privilege must be level 2 or higher Examples with full explanations follow 6 16 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C 4 Example of Write SMEM no Text Buffer Q Bit Mode This example writes to the discrete outputs Q19 through Q41 inclusive using the Q bit mode segment selector and a data offset and data length whose units are bit The example assumes that the master has already attached to the slave device set the privilege level to two 2 and that the current value of the discrete outputs Q17 through Q48 is zero It should be noted that those bits not written to within a byte remain as they were regardless of what value the master sends When the write request is complete Q17 through Q48 should look as follows Q32 Q17 ENXEXEHESEZEREZEZEZENESEJ3EEEZEXES Q48 Q33 ESEXEHEFAEZEAEKSESESZENEZESENESEREN The master sends the Initial Request Mailbox message to the slave with the service request code for Write System Memory
41. Message Data Header Trailer SNP Protocol Index 3 Index Index 4 SNP Service Requests Block Check Code BCC 6 2 Login Requirements Privilege Level Source Device 4 1 Specifications Cable Connector A 3 Standards RS lt 106 gt 422 A 1 RS 4106 485 A 1 Status Byte 3 2 Status Request 6 33 Stop Bits 2 1 Store Programs Series 90 30 PLC 6 119 T Target Device 4 1 Terms Time Timers 2 2 T1 Time T2 Time 2 2 T3 Time T3 Time 2 2 T4 Time TMEM Write Toggle Bit 6 75 Toggle Memory Turn Around Time U UART Error 4 2 Update Datagram 6 98 Update Datagram Request 6 80 Word Access 6 11 Word Data 6 8 Word Mode 6 4 Write Datagram 6 8 6 16 System Memory 6 16 Write Datagram Request 6 80 GFK 0529C
42. Nack A Mailbox error message returned to the master whose mailbox type is the character D1h hexadecimal Hexadecimal A numbering system having 16 as a base represented by the digits 0 through 9 and A through F Long Break Holding the transmit signal in the Mark State for three or more character times A character time is dependent on the baud rate being used Master SNP Device Host device on which the master implementation of the SNP protocol is running Programmer Attachment A device which has identified itself as a programmer i e logged in to the PLC and therefore is granted access to certain extra commands such as changing the state of the PLC and loading and storing logic programs Slave SNP Device Any CPU in the Series 90 PLC family Series 90 30 PLC Pertains to any of the CPU models within the Series 90 30 PLC family specifically the 301 311 or 331 models Series 90 70 PLC Pertains to any of the CPU models within the Series 90 70 PLC family specifically the 731 732 771 772 781 or 782 models VMEbus Versa Module European An electrical and mechanical bus specification used by Series 90 70 PLCs Conventions 1 Byte Ordering within a Word Field each SNP message field that is defined as a word field is transmitted as the least significant byte first followed by the most significant byte This convention is very important and must be understood when studying the SNP protocol examples and when implementing
43. Next message type Next message length Status byte Block Check Code Start of message character Message type M for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK Mailbox source PLC service request task Mailbox destination Master SNP device Packet number Total packets Major status code 0 okay Minor status code 0 okay Number of control programs one Programmer flags 1 programmer attached Don t care Control program number Current privilege level Last sweep time PLC status word 2054 Stop I O disabled Programmer attached PLC fault since last clear PLC fault since last read End of block character Next message type Next message length Status byte Block Check Code Chapter 6 Service Requests 6 35 Return Control Program Name s The Return Control Program Name s request returns the number of control program tasks in the PLC CPU and the name of each program task For Series 90 30 CPUs there can be at most one program name Currently Series 90 70 PLCs also support only one program name Future enhancements to Series 90 70 PLCs may allow for more than one control program but with the existing implementation only one is allowed Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Reques
44. Not used 00 00 00 00 00 00 35 17 End of block character 36 43 Next message type C for Connection Data 37 38 2a 00 Next message length in bytes 002ah 42 39 00 Status byte 40 BCC Block Check Code 3 5 1 10 Start of message character 2 43 Message type for Connection Data 3 02 Datagram connection ID 4 6 00 00 00 Reserved must be set to zero 7 8 1c 00 Point definition size in bytes 001ch 28 9 16 00 00 00 00 00 000000 Program block name 17 18 00 00 Program block segment 19 20 04 00 Number of point formats 0004 21 08 R word memory 22 23 04 00 Point offset in words 0004 gt R5 24 05 Point length 5 words R5 9 25 08 PR word memory 26 27 28 00 point offset in words 0028h 40 gt R41 28 03 Point length 3 words R41 R43 29 14 T byte memory 30 31 02 00 Point offset in bytes 0002 gt T17 32 04 Point length 4 bytes T17 T48 33 16 M byte memory 34 35 04 00 Point offset in bytes 0004 gt M33 36 04 Point length 4 bytes 37 17 End of block character 38 00 Next message type 39 40 00 00 Next message length 41 00 Status byte 42 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Table 6 38 Write Datagram for Series 90 70 PLCs Multiple Point Formats continued Packet Byte Number Number s Hex Value Description 5 1 10 Start of message character 2 4d Message type M for Mailb
45. PLC Table 6 26 Series 90 70 PLC Programmer Logon Packet Byte Number Number s Hex Value 1 gt 10 3a 00 00 10 0a 00 00 53 54 41 54 5f 31 00 00 00 40 00 00 3 lt 3 4 XX XX 5 7 XX XX XX 8 XX 9 5b 10 d4 11 14 10 0a 00 00 15 18 10 3a 00 00 19 01 20 01 21 00 22 23 24 00 20 25 28 XX XX XX XX 29 00 30 00 31 32 00 00 33 34 7 31 35 17 36 00 37 38 00 00 39 00 40 BCC Description Start of message character Message type M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number Total packets Request code Programmer logon Logon mode in this case logon serial Task name STAT 1 Communication buffer size 4000h 16384 bytes 16K Reserved must be set to zero End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK Mailbox source PLC service request task Mailbox destination Master SNP device Packet number Total packets Major status code 0 okay Don t care Communication buffer size 2000h 8192 bytes 8K Don t care Control program number Current privileg
46. Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 21 23 Request code Set PLC State 22 06 New PLC state Stop I O enabled 23 34 00 00 00 00 00 00 Not used 00 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 16 Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 09 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 02 Current privilege level 31 32 XX XX Last sweep time 33 34 4c XX PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Toggle Force System Memory The Toggle Force System Memory request allows the master to change the bit state of status override and transition bit memory to their opposite state For example if you wanted to toggle the s
47. SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 21 44 Request code Toggle Force SMEM 22 46 Segment Selector I memory in Bit Mode 23 24 1c 00 Bit offset 001 28 1 29 25 34 00 00 00 00 00 Not used 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 1 16 Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 32 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 02 Current privilege level 31 32 00 00 Last sweep time 33 34 54 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Datagram Service Requests The Datagram service requests enable the user to obtain reference data values for one or more PLC memory types via a single service request An area of memory within the PLC CPU called a Datagram Conn
48. SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 20 01 01 Packet number total packets 21 25 Request code Return PLC Time Date 22 34 00 00 00 00 00 00 Not used 00 00 00 00 00 00 00 35 17 End of block character 36 00 Next Message type 37 38 00 00 Next Message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 16 Start of message character 2 4d Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 1f Sequence number 10 94 Mailbox type Completion ACK with Text Buffer 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 XX Reserved don t care 20 01 21 22 08 00 Total length of data in bytes 23 26 XX XX XX XX Don t care 27 28 0101 Packet number total packets 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 4c 20 PLC status word 35 17 End of block character 36 54 Next Message type 37 38 10 00 Next message length 39 00 Status byte 40 BCC Block Check Code 5 lt 1 1b Start of message character 2 54 Message type for Text Buffer 3 5 59 48 10 Time 10 48 59 6 8 04 05 90 Date May 4 1990 9 06 Day of week Friday 10 xx Spare 11 17 End of block character 12 00 Next message type 13 14 00 00 Next message length 15 00 Status byte 16 BCC Block Check Code GFK 0529C Chapter 6 Servic
49. Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 0101 Packet number total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 5 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code GFK 0529C Chapter 6 Service Requests 6 89 6 90 Example of Write Datagram for Series 90 30 PLCs Multiple Point Formats This example defines the reference data for Datagram ID six 6 We assume the master has already issued the Establish Datagram request and was passed back a Datagram Connection ID of six This example defines the following reference data to be included in Datagram area six RO5 RO9 five words MO3 MO5 one byte M33 M64 four bytes T17 T48 four bytes 182 I87 one byte The master sends the Initial Request Mailbox message with Connection Data to the slave with the service request code for Write Datagram 48h After the slave acknowledges the Mailbox message the master transmits a Connection Data message containing all the parameter data The slave responds with a Completion ACK Mailbox message which contains the piggy back status information MASTER SLAV
50. Series 90 70 PLCs and 1 through 4 for Series 90 30 PLCs Last Sweep Time This value is equal to the time taken by the last complete sweep for the main control program task The value is in 100 microsecond increments and is measured from Start of Sweep X 1 to Start of Sweep X PLC Status Word The bits in this word are defined in the following table where bit 0 is the least significant bit and bit 15 is the most significant bit Recalling the convention of byte ordering within a word byte 33 is the least significant byte containing bits O through 7 and byte 34 is the most significant byte containing bits 8 through 15 PLC Status Word Byte 33 Byte 34 7 0 15 8 GFK 0529C Chapter 3 SNP Protocol 3 11 Table 3 8 Bits of the PLC Status Word Bit Number Bit 0 Bit 1 Bit 2 Bit 3 Bit 4 Bit 5 Bit 6 Bit 7 Bit 8 Bit 9 Bit 10 Bit 11 Bits 12 15 3 12 Series 90 M PLC SNP Communications User s Manual September 1998 Description Oversweep flag meaningful only when constant sweep mode is active 1 Constant Sweep value exceeded 0 No oversweep condition exists Constant Sweep Mode 2 Constant Sweep Mode active 0 Constant Sweep Mode is not active PLC Fault Entry since last read 1 PLC fault table has changed since last read by this device 0 PLC fault table unchanged since last read I O Fault Entry since last read 1 T O fault table has changed since last read b
51. Table 6 38 Table 6 39 Table 6 40 Table 6 41 Table 6 42 Write Program Block Mermoty reete ree eere te 6 32 Two bit Login Type Codes 5 eee te iet eee e eee ei eee 6 33 Short Status Request a pe ERR e OR OL ete eos 6 35 Return Control Propram Name e De eie te Gee de ile deed be tote rien 6 38 Major Minor Code Types 2 ret ere teet ee tct beam EH leet eth 6 39 PLC Major Minor Code Types Continued esee 6 40 Return Control Type and ID uie eee tet cedet ent le nre cox boe epi ne 6 41 Return Control Type and ID continued eese 6 42 Return PLC Time Date 45 es weenie eR RE x 6 45 Format for the PLC and W O Faults eese nennen 6 47 Fault Action Codes cii eere emere Sareea ge ci A gu CER eed epe eati 6 48 Fault Group Codes RR CREE pec qb ees 6 48 Return Fault Table iir eee tete tette eres eie e eite 6 50 Return PLC Fault Table 6 51 Return Fault Table 6 53 Return I O Fault Table continued i nennen 6 54 Clear PLC Fault Table terne gi Lai Ee a te ge ch P ge roe ere ein o pe eate 6 57 Series 90 30 PLC Programmer Logon 6 61 Series 90 70 PLC Programmer Logon eese eene nennen nen renn
52. The Isolated Repeater Converter IC655CCM590 This section describes how to use the Isolated Repeater Converter The section covers the following topics e Description of the Isolated Repeater Converter e System Configurations e Cable Diagrams This unit can be purchased from GE Fanuc Automation Please contact any GE Fanuc Automation sales office or field service representative Note The catalog number for the Isolated Repeater Converter was previously IC630CCM390 Description of the Isolated Repeater Converter The Isolated Repeater Converter IC655CCM590 can be used for the following purposes e provide ground isolation where a common ground cannot be established between components e To boost RS 422 signals for greater distance and more drops e To convert signals from RS 232 to RS 422 or RS 422 to RS 232 A 10 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C The figure below shows the appearance of the unit and the location of the user elements TOP VIEW 42418 POWER CORD GE Fanuc ISOLATED RS232 ADAPTOR UNIT 0000000000000 000000000000 BACK VIEW CN SIDE VIEW Figure A 6 The Isolated Repeater Converter The user elements of the Isolated Repeater Converter are described below e Two 25 pin female D type connectors Two 25 pin male D type connectors solder pot are included for user cabling e 115 230 VAC power co
53. XX Don t care ignore 9 1 XX Sequence Number 00 to ffh inclusive equal to the sequence number passed in the Initial Request 10 1 d4 Mailbox Type Completion ACK 11 14 4 10 0a 00 00 Mailbox Source ID PLC service request task 15 18 4 10 3a 00 00 Mailbox Destination ID master SNP device 19 1 01 Packet Number 20 1 01 Total Packets 21 1 XX Status code 22 1 XX Status data 23 28 6 XX XX XX XX Xx Xx Service request response data 29 1 XX Control program number 30 1 XX Current privilege level 31 32 2 XX XX Last sweep time 33 34 2 XX XX PLC status word 35 1 17 End of block character 36 1 00 Next message type 37 38 2 00 00 Next message length 39 1 00 Status byte 40 1 XX Block Check Code BCC GFK 0529C Chapter 3 SNP Protocol 3 13 3 14 The Completion ACK Mailbox message with Text Buffer Mailbox Type 94h is shown in the following table Table 3 10 Completion AC Knowledge Mailbox Message With Text Buffer Byte Number 37 38 39 40 Size in Bytes BP PWN PB ee eee mR Be ume Value Ib 4d XX XX XX XX XX XX XX 94 10 0a 00 00 10 3a 00 00 01 XX XX XX XX 01 01 XX XX XX XX 17 XX XX XX 00 XX Description Start of message character Message type character 4dh for Mailbox Don t care ignore Time Stamp Don t care ignore Sequence Number 00 to ffh inclusive equal to the sequence number passed in the Initial Request Ma
54. ee ee eene eee ee eeessee 4 1 Acknowledgment and Negative Acknowledgment Messages eee 4 1 Block Check Code BCC sire eR eee iater iet eee 4 2 Parity Overrun or Framing 4 2 Sequence ente 4 3 SNP R tries ER ER sles nee else a aes Cece els 4 3 Chapter 5 SNP Parameter Select Message cscossssscssssssssssssssssssssscscssssssssssssssssssssssssseess S L T2 Field ius Aston acl ee etek atin aah ca OPER RENE tas 5 2 WS Field Reena ere en eee 5 2 Maximum Data Size tele tee taie Rt ea ce bed Egan 5 2 Maximum Queue Depth 2 n e pude t IER EU eeepc ete ne 5 2 Parameter Select Example enitn erit e eet eter 5 2 Chapter 6 Seryice M OFL Change Privil ege Tevel unis tenen etie oe eiii tege 6 3 Example of Change Privilege Level with No Password ess 6 4 Explanation of Change Privilege Level With No Password 6 5 Example of Change Privilege Level With Password sese 6 6 Explanation of Change Privilege Level With Password sees 6 7 Read and Write PLE Memory etg ente ect Lo e eee deen 6 8 Segment Jd D 6 9 D ta Offset oou Soto Enc ete UE UO Te s 6 10
55. gt Initial Request MB message 1b 4d 00 00 00 00 00 00 6c c0 10 00 00 10 00 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 ACK 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx 6c d4 10 0a 00 00 10 3a 00 00 01 01 00 00 01 01 xx xx xx xx 00 02 00 00 54 20 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the example follows 6 34 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Explanation of Short Status Request Table 6 14 Short Status Request Packet Byte Number Number s 1 1 22 34 35 36 37 38 25 28 31 32 33 34 35 36 37 38 39 40 Hex Value 1b 4d 00 00 00 00 00 00 6c c0 10 3a 00 00 10 Oa 00 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC lb 4d XX XX XX XX XX XX 6c d4 10 0a 00 00 10 3a 00 00 01 01 00 00 01 01 XX XX XX XX 00 02 00 00 54 20 17 00 00 00 00 BCC Description Start of message character Message type M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number Total packets Request code Short Status request Not used End of block character
56. in the same format as the request but with the Mailbox Source ID and Destination ID transposed with a response code of D4 instead of a request code of CO and with possibly different T2 T3 and maximum data size values than those sent This Mailbox message has the following format Table 5 1 SNP Parameter Select Message Format Byte Number Size in Bytes Description 1 1 Start of message character ESC 1bh 2 1 Message type character 4dh for Mailbox 3 4 2 Reserved for internal use 5 7 3 Time Stamp not used by PLC CPU slaves 8 1 Reserved for internal use 9 1 Sequence Number 10 1 Mailbox Type Code 11 14 4 Mailbox Source ID 15 18 4 Mailbox Destination ID 19 1 Packet Number 20 1 Total Packets 21 1 Request code 22 1 Reserved for internal use 23 24 2 T2 25 26 2 T3 27 28 2 Maximum Data Size 29 30 2 Queue Depth 31 34 4 Reserved for internal use 35 1 End of block character 17h marks the beginning of the packet trailer 36 1 Next message type 37 38 2 Next message length 39 1 Status byte 40 1 Block Check Code BCC 5 1 T2 Field T3 Field The master passes a T2 value in milliseconds to the slave The slave PLC CPU compares this value to its own T2 value and passes the greater of the two back to the master Whatever value is returned to the master in the T2 field must be the T2 time used throughout this connection session The master passes a T3 value in milliseconds to the slave The s
57. is returned to the master in one or more Text Buffer messages Completion ACK Mailbox message D4h Requested Data bytes 23 28 Completion ACK Mailbox message with Text Buffer 94h Total length of data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Next message type byte 36 54h T for Text Buffer Next message length bytes 37 38 Number of bytes in the next Text Buffer message If the CPU is unable to comply with the request it is rejected In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message is e Insufficient privilege Series 90 70 PLCs only level 1 or higher e Invalid input parameter in the request mailbox message Response Text Buffer Message If the slave returns a Completion ACK Mailbox message with Text Buffer 94h the data returns to the master in one or more Text Buffer messages The number of Text Buffer messages returned depends on the amount of data being read and the maximum data size allowed in a SNP Data message Examples with full explanations follow GFK 0529C Chapter 6 Service Requests 6 11 Example of Read SMEM No Text Buffer M in Bit Mode This example reads the eleven discrete internal bits M99 through M109 using the M bit mode segment selector and a data offset and data length w
58. of the PLC CPU the number of control program tasks and the main control program task name The control program task name is used in the programmer logon service request either Null string or 8 byte NUL terminated ASCII string Return PLC Time Date This service request returns the current time and date stored in the PLC CPU to the master Return Fault Table The Return Fault Table service request returns fault data from either the PLC fault table or the I O fault table to the master The PLC fault table has a maximum of 16 faults and the I O fault table has a maximum of 32 faults Clear Fault Table This service request clears all fault table information in either the PLC fault table or I O fault table Programmer Logon This service request allows the master to login and logout as a programmer attachment Some service requests require that the master be logged in as a programmer attachment such as Set Control ID Set Control ID CPU ID This service request allows the master to specify a PLC CPU controller ID for a given PLC CPU The following rules apply to valid controller IDs Series 90 70 PLC Maximum of seven ASCII characters followed by a NUL Series 90 30 PLC Maximum of six ASCII characters followed by a NUL furthermore the valid characters are restricted to the ASCII characters 0 through 9 and A through F inclusive GFK 0529C Chapter 1 Introduction 1 7 1 8 Set PLC Time Date This service request a
59. request code for Return PLC Time Date 25h and the slave responds with a Completion ACK Mailbox message which includes piggy back status information After the master acknowledges the Mailbox message the slave transmits the Text Buffer message containing the PLC CPU s current time and date MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 1f cO 10 3a 00 00 10 0a 00 00 01 01 25 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 2 ACK 06 00 wait T1 time 3 Completion ACK MB message with Text Buffer Ib 4d XX XX XX xx xx xx 1f 94 10 00 00 10 00 00 xx 01 08 00 xx xx xx xx 01 01 00 01 00 00 4c 20 17 54 10 00 00 BCC wait T1 time 4 06 00 wait T1 time 5 Response Text Buffer message 1b 54 59 48 10 04 05 90 06 xx 17 00 00 00 00 BCC wait T1 time 6 ACK 06 00 A full explanation of the SNP messages used in the example follows 6 44 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Explanation of Return PLC Time Date Table 6 18 Return PLC Time Date Packet Byte Number Number s Hex Value Description 1 gt 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 1f Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master
60. slave The slave whose CPU ID matches that specified in the request waits T1 and responds with an ACK The slave processes the Update Real Time Datagram request waits T1 and sends a Completion ACK Mailbox message with Connection Data which contains the piggy back status information The master waits T1 and responds with an ACK The slave waits T1 and transmits the Connection Data message containing the values of the reference data The master responds with the final ACK and the logical attachment between the two devices is terminated MASTER SLAVE 0 Long break wait 4 time 1 Update Real Time Datagram message 1b 55 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 17 00 00 00 BCC2 wait T1 time 2 ACK 06 00 wait T1 time 3 Completion ACK MB message with Connection Data 1b 4d XX XX XX XX Xx xx xx 94 10 0e 00 00 10 3a 00 00 Xx xx Oe 00 xx xx xx xx 01 01 00 01 00 00 52 20 17 43 1c 00 00 BCC wait T1 time 4 2 ACK 06 00 wait T1 time 5 c Response Connection Data Message 1b 43 05 xx xx xx 0e 00 87 23 23 98 21 34 86 09 19 22 05 12 71 43 17 00 00 00 00 BCC wait T1 time 6 2 ACK 06 00 The long break and T4 timer are not required for Break Free SNP implementations 6 112 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Explanation of Update Real Time Datagram for Series 90 30 PLCs One Point Format Table 6 44 Update Real Time Datagram for Series 90 30 PLC
61. the next message length must have the length of the next SNP packet to be transferred another Block Transfer message Block Transfer messages will be transmitted from the sender to the receiver until all program data bytes whose total number was specified in the introductory Mailbox message have been transferred Connection Data Message A Connection Data message is the means through which Datagram information is passed back and forth between the programming device and the PLC Datagrams enable the user to obtain reference data values for one or more PLC memory types via a single service request once a Datagram Connection Area has been established and defined Please see the section Datagram Service Requests in Chapter 6 for Datagram details Multiple Connection Data messages may be necessary to transfer all the data associated with a Datagram Connection Area The number of Connection Data messages required to transfer some number of bytes depends on the SNP Data Size allowed in a SNP Data message The Mailbox Type and format of the Mailbox message that precedes a Connection Data message s differs between the Series 90 30 PLC CPUs and the Series 90 70 PLC CPUs For Series 90 70 PLC CPUs the Mailbox type is either COh Initial Request Mailbox message or D4h Completion ACK Mailbox message depending on which direction the connection data is being passed For Series 90 30 PLC CPUs the Mailbox type is either 80h Initial Request Mailbox
62. the programming device point to point or many different PLCs within the Series 90 PLC family can coexist on a serial link to the programming device multi drop The communications link may be over varying amounts of distance or even over a telephone line Serial setup parameters and timing parameters are configurable by the user in order that optimum SNP performance may be achieved Serial Setup Parameters Serial Setup parameters within the PLC CPU configuration data include baud rate data length parity stop bits maximum link idle time and modem turn around time The valid values or range of values are Baud Rate 300 600 1200 2400 4800 9600 19 2K Data Length 8 bits Parity odd even none Stop Bits 1 2 Max Link Idle Time 1 to 60 seconds in 1 second increments Modem Turn Around Time 0 to 2550 milliseconds in 10 ms increments Baud Rate Data Length Parity and Stop Bits are self explanatory Maximum Link Idle Time the time a device currently waits to receive a message before deciding that the connection has been lost and returning to its initial state Modem Turn Around Time a time used specifically for modem applications where larger turn around times may be required due to modem characteristics If you are using modems to communicate this configuration parameter must be set to at least 1 1 10 ms The factory defaults are as follows Series 90 30 PLCs Series 90 70 PLCs Baud Rate 19 2K 19 2K Data Length 8 bits
63. transmits the Text Buffer message containing the PLC fault table data MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 cO 10 00 00 10 00 00 01 01 38 02 00 00 10 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 lt Completion ACK MB message with Text Buffer 1b 4d XX XX XX XX xx 94 10 0a 00 00 10 3a 00 00 xx 01 60 00 xx xx xx xx 01 01 00 01 00 00 58 20 17 54 68 00 00 BCC wait T1 time 4 gt ACK 06 00 wait T1 time 5 Response Text Buffer message 1b 54 37 19 11 07 06 90 02 00 02 00 02 00 xx xx xx xx 00 01 00 03 12 02 00 00 xx xx xx Xx Xx Xx Xx xx XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 53 19 11 07 06 90 xx xx xx xx 00 01 1d xx 84 02 00 00 xx XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX xx xx xx 36 20 11 07 06 90 17 00 00 00 00 BCC wait T1 time 6 ACK 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 49 Explanation of Return PLC Fault Table Table 6 22 Return PLC Fault Table Packet Byte Number Hex Value Description Start of message character Message type for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request 10 3a 00 00 Mailbox source Master SNP device 10 0a 00 00 Mailbox destination PLC servi
64. 0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 3d where the bytes break down as shown in Table 3 18 The slave s response message to the Inquiry message is the same as the master s Inquiry message The slave just echoes it back to the master lt The long break is not required for Break Free SNP operation Series 90M PLC SNP Communications User s Manual September 1998 GFK 0529C Chapter Integrity Checking and Error Recovery 4 As in other serial communication protocols the Series 90 Protocol SNP follows a communication sequence between the source device and the target device The source device master initiates the sequence and the target device slave responds Acknowledgment and Negative Acknowledgment Messages Two special messages are defined in the SNP protocol as a means of providing each side a way to tell the other side that Yes I got your message okay or No I did not get your message please re transmit the message if possible Either an Acknowledgment or a Negative Acknowledgment message must be sent after every SNP packet is received by each SNP device master or slave in order to let the transmitting device know that its message was either received successfully or received with some error Note The exceptions to this rule are the Attach message and the Attach Response message there is no acknowledgment for the Attach message or the Attach Response I
65. 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 71 Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 Oa 00 00 Mailbox destination PLC service request task 19 20 01 01 Packet number total packets 21 16 Request code Update Datagram 22 05 Datagram Connection ID 23 01 Normal Datagram 24 34 01 00 00 00 00 00 Not used 00 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 1b Start of message character 2 4 Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 71 Sequence number 10 94 Mailbox type Completion ACK with Connection Data 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 XX XX Reserved don t care 21 22 1c 00 Connection Data size in bytes 23 26 XX XX XX XX Don t care 27 28 0101 Packet number total packets 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 Sc 20 PLC status word 35 17 End of block character 36 43 Next message type for Connection Data 37 38 24 00 Next message length in bytes 0024h 36 39 00 Status byte 40 BCC Block Check Code 5 lt 1 1b Start of message character 2 43 Message type for Connection Data 3 05 Datagram
66. 1 NC 1 NC 2 NC 2 SD Send Data RS 232 3 NC 3 RD Receive Data RS 232 4 NC 4 RTS Request to Send RS 232 5 CTS Clear to Send RS 232 6 NC 6 NC 7 OV Ground Connection 7 OV Ground Connection 8 CTS B Clear to Send 8 CTS B Clear to Send Optional Termination Optional Termination 9 CTS A Clear to Send 9 CTS A Clear to Send Optional Termination Optional Termination 10 CTS B Clear to Send 10 RTS B Request to Send 11 CTS A Clear to Send 11 RTS A Request to Send 12 RTS B Request to Send 12 CTS B Clear to Send 13 RTS A Request to Send 13 CTS A Clear to Send 14 RD B Receive Data 14 SD B Send Data 15 RD A Receive Data 15 SD A Send Data 16 SD A Send Data 16 RD A Receive Data 17 SD B Send Data 17 RD B Receive Data 18 NC 18 RD A Receive Data Optional Termination 19 NC 19 RD B Receive Data Optional Termination 20 NC 20 NC 21 NC 21 NC 22 RD B Receive Data 22 SD B Send Data Optional Termination 23 RD A Receive Data 23 SD A Send Data Optional Termination 24 SD A Send Data 24 NC 25 SD B Send Data 25 SE Enable RS 232C Not Used NC No Connection SD Send Data and RD Receive Data are the same as TXD and RXD used in the Series Six PLC A and B are the same as and A and B denote outputs and A and B denote inputs Appendix A Serial Port and Cables The signal ground connections pin 7 on each connector must be made between the Isolated Repeate
67. 2 Suppose the master has attached to a Series 90 30 331 CPU and wants to set up the following T2 5 seconds 5000 ms T3 25 seconds 25000 ms Maximum Data size 1000 bytes Queue Depth 1 Must be 1 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C The master sends the following series of bytes over the serial link 01 00 00 OO 00 00 17 00 00 00 00 29 where the bytes break down as follows Table 5 2 SNP Parameter Select Message Example 11 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 39 40 Value 1b 4d 00 00 00 00 00 00 03 c0 10 3a 00 00 10 3e 00 00 01 01 00 00 88 13 a8 61 e8 03 01 00 00 00 00 00 17 00 00 00 00 Description Start of message character ESC Message type byte 4dh M for Mailbox Reserved for internal use Time Stamp Reserved for internal use Sequence number Mailbox type Mailbox Source ID Mailbox Destination ID Packet number Total packets Request code Reserved for internal use T2 time in ms 1388h 5000 ms 5 secs T3 time in ms 61a8h 25000 ms 25 secs Maximum Data Size 3e8h 1000 bytes Queue depth 1 Reserved for internal use End Of Block character ETB Next Message Type value of zero turns the link around Next Message Length Status byte Block Check Code BCC GFK 0529C Chapter 5 SNP Parameter Select Message 5 3 Chapter 6 Se
68. 2 XX Don t care 23 05 Datagram Connection ID 24 28 XX XX XX XX XX Don t care 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Chapter 6 Service Requests 6 83 6 84 Example of Establish Datagram Multiple Point Formats The master wants to set up a Datagram area that accesses the following groups of reference data RO5 RO9 five words MO3 MO5 one byte M33 M64 four bytes T17 T48 four bytes 182 187 one byte This group of reference data spans 20 bytes The point format data takes 20 bytes five point formats at four bytes each and the fixed header of the Datagram area takes 12 bytes program block name program block segment and number of point formats The Datagram Size required is 20 plus 20 plus plus 12 or 52 bytes The master sends the Initial Request Mailbox message to the slave with the service request code for Establish Datagram 15h the Datagram Type field set to Update on Request 01 and the Datagram Size set for 52 34h bytes The slave responds with a Completion ACK Mailbox message which contains a Datagram ID of six 6 along with the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 c0 10
69. 21 22 26 00 Connection Data size in bytes 0026h 38 23 26 00 00 00 00 Reserved must be set to zero 27 28 0101 Packet number total packets 29 48 Request code Write Datagram 30 06 Datagram Connection ID 31 01 Normal Datagram 32 34 00 00 00 not used set to zero 35 17 End of block character 36 43 Next message type for Connection Data 37 38 2e 00 Next message length in bytes 002eh 46 39 00 Status byte 40 BCC Block Check Code 3 gt 1 1b Start of message character 2 43 Message type for Connection Data 3 06 Datagram connection ID 4 6 00 00 00 Reserved must be set to zero 7 8 20 00 Point definition size in bytes 0020h 32 9 16 00 00 00 00 00 000000 Program block name 17 18 00 00 Program block segment 19 20 05 00 Number of point formats 0005 21 08 R word memory 22 23 04 00 Point offset in words 0004 gt R5 24 05 Point length 5 words R5 R9 25 14 T byte memory 26 27 02 00 Point offset in bytes 0002 gt T17 28 04 Point length 4 bytes T17 T48 29 4c M bit memory 30 31 02 00 Point offset in bits 0002 gt M3 32 03 Point length 3 bits M3 M5 33 46 26 bit memory 34 35 51 00 Point offset in bits 0051h 81 gt I82 GFK 0529C Chapter 6 Service Requests 6 91 6 92 Table 6 36 Write Datagram for Series 90 30 PLCs Multiple Point Formats continued Packet Byte Number Number s Hex Value Description 36 06 Point length 6 bits 182
70. 23 23 98 2134 86 14 bytes of data 09 19 22 05 12 71 43 23 17 End of block character 24 00 Next message type 25 26 00 00 Next message length 27 00 Status byte 28 BCC Block Check Code GFK 0529C Chapter 6 Service Requests 6 113 Loading and Storing User Programs to Series 90 30 PLCs This section describes loading user programs from the PLC CPU and storing user programs to the PLC CPU It is assumed that the program you are trying to store to the PLC CPU is a program that was originally created via LM90 or with the Hand Held Programmer and was previously loaded from a PLC This section makes no attempt to define or describe the bytes within the user program Program Load Series 90 30 PLCs The Program Load Request allows the master to retrieve the user program from a Series 90 30 PLC A user program on Series 90 30 PLCs consists of two parts the Logic Block and the Declaration Block The master must retrieve both blocks in order to obtain a complete user program Therefore two Program Load service requests are necessary one to load the Logic Block from the PLC to the master and one to load the Declaration Block from the PLC to the master Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 40h Program Load Block Type byte 22 0 Logic Block 5 Declaration Block Block Offset bytes 23 2
71. 3 M64 33 17 End of block char 34 00 Next message type 35 36 00 00 Next message length 37 00 Status byte 38 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 oo Cancel Datagram The Cancel Datagram request terminates a specified Datagram ID Each Datagram ID should be cancelled when it is no longer needed in order to free memory within the PLC Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 17h Cancel Datagram Datagram ID byte 22 Datagram Connection ID Datagram area to terminate FFh All Datagrams Datagram Type byte 23 Olh Normal Datagrams 81h Permanent Datagrams Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response to a Cancel Datagram request is Insufficient privilege Series 90 70 PLCs only must be level 1 or higher Unable to locate specified Datagram connection ID
72. 3 4 Attach Message Example er e be dicen ue e ette xe ain aedes 3 4 Attach Response ien ipee ecelesie 3 5 Attach Response CPU ID Field sess eene nene 3 6 Attach Response Field nennen nenne 3 6 Attach Response Example essere nennen nenne 3 6 Contents Mailbox Message ter teet e ette e per er eae pietre ees Piae 3 7 Packet Numbet Ine epe 3 8 Initial Request Mailbox Messages eene 3 8 Completion ACK Mailbox Messages esee eene eene 3 10 Piggy Back Status Information sess eren ener 3 11 Control Program Number nennen nne eren eene enne 3 11 Privilege Level eere Ete REED E ER reet REUS E 3 11 Last Sweep Time P 3 11 PLC Stats Word terere iiiter ated Hie eie 3 11 Error Nack Mailbox Message sess ennt 3 15 Table of Major Error Status Codes esee 3 16 Table of Minor Error Status Codes sessssseeeeeneeeeeeneen ne 3 16 Text Buffer Message cete ote eerte p SEED C IEEE hon ederet 3 18 Block Transfer Message ettet eU rere eee Ht eris 3 19 Connection Data Messages ii eee eid ee eni e ee prede 3 20 Inquiry Message et dete et E Eb LR ee IR e o Ege Ee 3 2 Inquiry Message enne ener nennen 3 22 Chapter 4 Integrity Checking and Error Recovery ee eeeeeeee
73. 30 PLCs and Series 90 70 PLCs the Next Message Type field in the Mailbox message s trailer is equal to 42h for B and the Next Message Length field in the Mailbox message s trailer equals the number program data bytes contained in the next message the Block Transfer message After this Mailbox message is transmitted one or more Block Transfer messages are transmitted until all program data bytes have been transferred Series 90 70 has some further differences in this respect Chapter 3 SNP Protocol 3 19 The following is the format of the Block Transfer message where N is the number of program bytes contained in the message Table 3 16 Block Transfer Message Format Byte Size in Description Number Bytes 1 1 Start of message character ESC 1bh 2 1 Message type character 42h for Block Transfer 3 N 2 XX XX Data text bytes N 3 1 End of block character 17h marks the beginning of the packet trailer N 4 1 Next message type 0 or 42h where 0 means no more Block Transfer messages link turnaround 42h means another Block Transfer message is going to be transmitted which contains more data bytes N 5 2 Next message length N 6 1 Status byte N 8 1 Block Check Code BCC If the next message type field in the trailer of the Block Transfer message is 0 then the transmission of all the program data is complete it fit into one text buffer If however this field is not 0 it must be a 42h for B and
74. 4 Should always be set to zero tells the PLC to start with the first byte of the block Block Length bytes 25 26 Should always be set to zero a length of zero tells the PLC to return the entire block being asked for Response Mailbox Message Mailbox Type byte 10 94h Completion ACK Mailbox message with Block Transfer Dih Error Nack Mailbox message Total length of data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Block Transfer messages Next message type byte 36 42h for Block Transfer Next message length bytes 37 38 Number of bytes in the next Block Transfer message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response to a program load request are Insufficient privilege Series 90 70 PLCs only must be level 1 or higher Not logged in as a programmer Response Block Transfer Message All user program data Logic or Declaration data returns to the master in one or more Block Transfer messages The number of Block Transfer messages returned depends on the amount of user program data to transfer and the maximum data size allow
75. 6 00 A full explanation of the SNP messages used in the example follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Explanation of Establish Datagram One Point Format Table 6 33 Establish Datagram One Point Format Packet Byte Number Number s Hex Value Description 1 gt 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 6d Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 21 15 Request code Establish Datagram 22 01 Datagram type 01 Update on Request 23 24 le 00 Datagram size in bytes 001eh 30 25 34 00 00 00 00 00 Not used 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 10 Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 6d Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 2
76. 8 GFK 0529C GFK 0529C 4 Example of Return Control Program Name This example issues a Return Control Program Name request to a slave device The slave device is a Series 90 30 331 CPU and has one program named ESS331 The example assumes that the master has already attached to the slave device The master sends the Initial Request Mailbox message to the slave with the service request code equal to Return Control Program Name 03h and the slave responds with a Completion ACK Mailbox message which includes piggy back status information After the master acknowledges the Mailbox message the slave transmits the Text Buffer message The Text Buffer message has 10 bytes of data 2 bytes number of control programs and 8 bytes for the program name MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 66 cO 10 00 00 10 Oa 00 00 01 01 03 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 lt Completion ACK MB message with Text Buffer 1b 4d XX XX XX xx xx xx 66 94 10 0a 00 00 10 3a 00 00 xx 01 0a 00 xx xx xx xx 01 01 00 01 00 00 4c 20 17 54 12 00 00 BCC wait T1 time 4 2 ACK 06 00 wait T1 time 5 lt Response Text Buffer message 1b 54 01 00 45 53 53 33 33 31 00 00 17 00 00 00 00 BCC wait T1 time 6 gt ACK 06 00 A full explanation of the SNP messages used in the example follows Chapter 6 Service Requ
77. 92 XX XX XX XX XX XX XX XX XX XX XX Don t care XX XX XX XX XX XX XX XX XX XX 93 98 21 55 12 07 06 90 Time error logged 12 55 21 Jun 7 1990 Start of Fault Entry Number 3 99 XX Spare bytes don t care 100 102 ff 00 00 Reference address 103 01 Rack number 104 03 Slot number 105 7f I O Bus Number 106 7f Bus address 107 108 ff 7f Point address 109 03 Fault Group Loss of or Missing I O module 110 02 Fault Action Diagnostic 111 0e Fault Category 112 00 Fault Type 113 00 Fault description 114 134 XX XX XX XX XX XX XX XX XX XX XX Don t care XX XX XX XX XX XX XX XX XX XX 135 140 21 55 12 07 06 90 Time error logged 12 55 21 Jun 7 1990 141 17 End of block character 142 00 Next message type 143 144 00 00 Next message length 145 00 Status byte 146 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 4 Clear Fault Table The request Clear Fault Table enables the master to clear the fault table information There are two fault tables PLC fault table and I O fault table The Fault Table Type to be cleared is specified in a parameter field within the Initial Request Mailbox message Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 39h Clear Fault Table Fault Table Type byte 22 1 I O Fault Table 2 PLC Fault Table Response Mailbox
78. BIT mode type see table below GFK 0529C Chapter 6 Service Requests 6 75 6 76 The following table lists those memory types that are valid with the Toggle Force System Memory request All others are invalid Table 6 31 Valid Toggle Force SMEM Memory Types 150 152 154 156 158 160 162 164 166 168 170 172 174 176 178 180 182 184 Decimal Segment Selectors Hexadecimal 096 098 09 09C 09E 0 0A2 0A4 0A6 0A8 0AA OAC OAE OBO 0B2 0B4 OB6 OB8 Memory Type I memory in bit mode Q memory in bit mode T memory in bit mode M memory in bit mode SA memory in bit mode SB memory in bit mode SC memory in bit mode S memory in bit mode G memory in bit mode I override table in bit mode Q override table in bit mode T override table in bit mode M override table in bit mode SA override table in bit mode SB override table in bit mode SC override table in bit mode S override table in bit mode G override table in bit mode I transition table in bit mode Q transition table in bit mode T transition table in bit mode M transition table in bit mode SA transition table in bit mode SB transition table in bit mode SC transition table in bit mode S transition table in bit mode G transition table in bit mode An example with full explanation follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Togg
79. Blocks Bytes 25 28 Sum of Program blocks Additive checksums Bytes 29 30 Sum of Program blocks CRC checksums Bytes 31 34 Length of Configuration records Byte 35 36 Sum of Configuration records Additive checksums Bytes 37 38 Sum of Configuration records CRC checksums Bytes 39 42 Table 6 16 PLC Major Minor Code Types Dec Hex Description Dec Hex Description 12 OCh Series 90 70 PLC CPU 31 1Fh_ Series 90 70 Model 731 CPU 32 20h Series 90 70 Model 732 CPU 71 47h Series 90 70 Model 771 CPU 72 48h Series 90 70 Model 772 CPU 80 50h Series 90 70 Model 780 CPU 81 51h Series 90 70 Model 781 CPU 82 52h Series 90 70 Model 782 CPU 88 58h Series 90 70 Model 788 CPU 89 59h Series 90 70 Model 789 CPU 92 5Ch Series 90 70 Model 914 CPU 94 SEh Series 90 70 Model 924 CPU GFK 0529C Chapter 6 Service Requests 6 39 Table 6 16 PLC Major Minor Code Types Continued Dec Hex Description Dec Hex Description 16 10h Series 90 20 PLC CPU 31 1Fh_ Series 90 20 Model 211 CPU Series 90 30 PLC CPU 30 1Eh Series 90 30 Model 311 CPU 32 20h Series 90 30 Model 321 CPU 33 21h Series 90 30 Model 313 CPU 34 22h Series 90 30 Model 323 CPU 35 23h Series 90 30 Model 331 CPU 36 24h Series 90 30 Model 341 CPU An example with full explanation follows Example of Return Controller Type and ID Information The following ass
80. C 1bh 2 1 Message type character 54h for Text Buffer 3 N 2 XX XX Data text bytes N 3 1 End of block character 17h marks the beginning of the packet trailer N 4 1 Next message type 0 or 54h where 0 means no more Text Buffer messages link turnaround 54h means another Text Buffer message is going to be transmitted which contains more data bytes N 5 2 Next message length N 6 1 Status byte N 8 1 Block Check Code BCC Block Transfer Message A Block Transfer message is used to pass PLC logic programs back and forth between the master and the PLC Multiple Block Transfer messages may be necessary to transfer all the program data associated with a PLC logic program The number of Block Transfer messages required to transfer some number of bytes depends on the SNP Data Size allowed in a SNP Data message The Mailbox Type and format of the Mailbox message that precedes a Block Transfer message s differs between the Series 90 30 PLC CPUs and the Series 90 70 PLC CPUs For Series 90 70 PLC CPUs the Mailbox type is either COh Initial Request Mailbox message or D4h Completion ACK Mailbox message depending on which direction the program data is being passed For Series 90 30 PLC CPUs the Mailbox type is either 80h Initial Request Mailbox with Text Buffer message or 94h Completion ACK Mailbox with Text Buffer message depending on which direction the program data is being passed For both Series 90
81. Clear to Send 5 CTS Clear to Send 6 NC 6 NC 7 GND Signal Ground 7 GND Signal Ground 0V 8 DCD Data Carrier Detect 8 DCD Data Carrier Detect 9 10 NC 9 DTR Data Terminal Ready 11 Tied to line 20 12 19 NC 20 DTR Data Terminal Ready 21 NC NC Not Connected 22 Ring Indicate 23 25 NC For more information about the Workmaster industrial computer serial port refer to manuals GFK 0401 Workmaster II PLC Programming Unit Guide to Operation GEK 25373 Workmaster Programmable Control Information Center Guide to Operation Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C IBM AT XT Serial Port The IBM AT IBM XT or compatible computers RS 232 serial port is a 9 pin D type male connector as shown in the figure below a44523 IBM AT XT 9 22 PIN o 1 o 6 Figure A 3 IBM AT XT Serial Port Table A 4 IBM AT XT Serial Port Pin Assignment IBM AT Signal Description IBM XT Signal Description Pin No Pin No 1 DCD Data Carrier Detect 1 NC 2 RD Receive Data 2 TD Transmit Data 3 TD Transmit Data 3 RD Receive Data 4 DTR Data Terminal Ready 4 RTS Request to Send 5 GND Signal Ground 5 CTS Clear to Send 6 NC 6 NC 7 RTS Request to Send 7 GND Signal Ground 8 CTS Clear to Send 8 DCD Data Carrier Detect 9 NC 9 DTR Data Terminal Ready GFK 0529C Appendix A Serial Port and Cables A 7 RS 232 RS 422 Converter 6 The RS 232 RS 422 Converter IC690ACC900
82. Computer to Series 90 PLCs Appendix A Serial Port and Cables A 21 844508 SERIES 90 PLC RS 422 PORT 15 PIN FEMALE A 22 RS 422 Point to Point Connection If your host device is equipped with a RS 422 card you can connect directly to Series 90 PLCs as illustrated in Figure A 11 HOST a44509 COMPUTER PLC PIN SHIELDED TWISTED PAIRS PIN ide te ee RD 11 X 12 SD A RD B 13 SD B SD A 10 RD A SD XX 11 RD B CTS A 9 RD CTS B gt 6 RTS A RTS B 7 14 RTS B RTS a a dee 8 CTS B GND SS 15 CTS A SHLD X X 3 GND 2 SHLD T 1 1 UP TO A MAXIMUM OF 50 FEET 15 2 METERS gt WITHOUT ISOLATION TERMINATION RESISTANCE FOR THE RECEIVE DATA RD SIGNAL NEEDS TO BE CONNECTED ONLY ON UNITS AT THE END OF THE LINES THIS TERMINATION IS MADE ON THE SERIES 90 PLC PRODUCTS BY CONNECTING A JUMPER BETWEEN PIN 9 AND PIN 10 INSIDE THE 15 PIN D SHELL WITH THE FOLLOWING EXCEPTION FOR SERIES 90 70 PLCs CATALOG NUMBERS 1C697CPU731 AND IC697CPU771 THE TERMINATION FOR RD AT THE PLC IS IMPLEMENTED BY A JUMPER BETWEEN PIN 9 AND PIN 11 Figure A 18 Typical RS 422 Hostto PLC Connection with Handshaking Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C 0L 1 6 1 12J6 9 uM 1 6 1 12 6 9 A Abbreviations 1 12 Access Acknowl
83. Connection ID 4 6 XX XX XX Don t care 7 8 00 Point definition size 9 22 87 23 23 98 21 34 86 09 19 11 17 End of block character 12 00 Next message type 13 14 00 00 Next message length 15 00 Status byte 16 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Update Datagram Request for Series 90 30 PLCs Multiple Point Formats This example requests an update of reference data defined in Datagram ID six 6 Datagram ID six has already been established and defined as containing five point formats see example of Write Datagram for multiple points The reference data accessed by the five point formats is currently set as follows RO5 2219h RO6 1205h RO7 4371h ROS8 2198h RO9 7065h T17 2465h T33 3674h M01 003fh 181 4613h M33 1290h 49 6739h The master sends the Initial Request Mailbox message to the slave with the service request code for Update Datagram 16h along with the Datagram Connection ID The slave responds with a Completion ACK Mailbox message which contains the piggy back status information After the master acknowledges the Mailbox message the slave transmits the Connection Data message MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 71 cO 10 00 00 10 00 00 01 01 16 06 01 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2
84. Data Length D E 6 10 Read System Memory eee en pe i eaii 6 11 Example of Read SMEM No Text Buffer M in Bit 6 12 Example of Read SMEM with Text Buffer R Word 6 14 Explanation of Read SMEM with Text Buffer R Word 6 15 Write System Metmoty 5 31 2 2 x erneute el eie aon Rede 6 16 Example of Write SMEM no Text Buffer Q in Bit 6 17 vi GFK 0529C Contents Explanation of Write SMEM no Text Buffer Q in Bit Mode 6 18 Example of Write SMEM with Text Buffer in Byte 6 19 Explanation of Write SMEM with Text Buffer T in Byte Mode 6 20 Read Task eet eet epe eo ected el best eclesie ete BL E eiecti ends 6 21 Example of Read Task Memory ssessseeseeeeeeeneeen eene 6 22 Explanation of Read Task Memory sese 6 23 Write Task 3 B REIR IE a in tese e oae 6 24 Example of Write Task Memory sese eene 6 25 Explanation of Write Task Memory essere 6 26 Read Program Block nennen 6 27 Example of Read Program Block Memory seen 6 28 Explanation of Read Program Block
85. E wait T1 time 1 Initial Request MB message with Connection Data 00 00 00 00 00 00 6e 80 10 3a 00 00 10 Oa 00 00 00 01 26 00 00 00 00 00 01 01 48 06 01 00 00 00 1743 2e 0000 BCC wait T1 time 2 06 00 wait T1 time 3 2 Request Connection Data message 06 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 05 00 08 04 00 05 14 02 00 04 4c 02 00 03 46 51 00 06 16 04 00 04 17 00 00 00 00 BCC wait T1 time 4 06 00 wait T1 time 5 Completion ACK MB message 1b 4d XX XX XX xx xx xx 6e d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 01 00 00 5c 20 17 00 00 00 00 BCC wait T1 time A full explanation of the SNP messages used in the example follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Explanation of Write Datagram for Series 90 30 PLCs Multiple Point Formats Table 6 36 Write Datagram for Series 90 30 PLCs Multiple Point Formats Packet Byte Number Number s Hex Value Description 1 gt 1 16 Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 6e Sequence number 10 80 Mailbox type Initial Request with Connection Data 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 20 00 01 Reserved first byte zero second byte one
86. ECTED ONLY ON UNITS AT THE END OF THE LINES THIS TERMINATION IS MADE ON THE SERIES 90 PLC PRODUCTS BY CONNECTING A JUMPER BETWEEN PIN 9 AND PIN 10 INSIDE THE 15 PIN D SHELL WITH THE FOLLOWING EXCEPTION FOR SERIES 90 70 PLCs CATALOG NUMBERS IC697CPU731 AND IC697CPU771 THE TERMINATION FOR RD AT THE IS IMPLEMENTED BY A JUMPER BETWEEN PIN 9 AND PIN 11 Figure A 16 IBM AT compatibles Personal Computer to Series 90 PLCs Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C IC690CBL701 OR EQUIVALENT RS 232 RS 422 RS 232 CONVERTER SHIELDED PAIRS IC690ACC900 PIN PIN A IBM XT OR hzc WORKMASTER E RS 232 Ls PORT ls 9 PIN MALE 25 PIN MALE 25 PIN 15 PIN FEMALE FEMALE RS 232 RS 422 PORT PORT RS 422 TWISTED SHIELDED PAIRS POWER SOURCE FOR POINT TO POINT CONNECTION 10 FEET 3 METERS ONLY CONVERTER POWER SOURCE BEYOND 10 FEET 3 METERS AND FOR MULTIDROP CONNECTION MUST BE EXTERNAL SOURCE TERMINATION RESISTANCE FOR THE RECEIVE DATA RD SIGNAL NEEDS TO BE CONNECTED ONLY ON UNITS AT THE END OF THE LINES THIS TERMINATION IS MADE ON THE SERIES 90 PLC PRODUCTS BY CONNECTING A JUMPER BETWEEN PIN 9 AND PIN 10 INSIDE THE 15 PIN D SHELL WITH THE FOLLOWING EXCEPTION FOR SERIES 90 70 PLCs CATALOG NUMBERS IC697CPU731 AND IC697CPU771 THE TERMINATION FOR RD AT THE PLC IS IMPLEMENTED BY A JUMPER BETWEEN PIN 9 AND PIN 11 Figure A 17 Workmaster or IBM XT compatibles Personal
87. ESC 2 41 Message type character 41h for Attach 3 10 33 33 31 30 31 41 00 00 Eight bytes of ASCII PLC CPU ID 11 14 30 41 30 30 Four bytes of ASCII hexadecimal encoded Master T1 in this example the characters 0A00 encode the value 000Ah which equals 10 ms 15 30 Reserved set to ASCII zero 30h 16 18 20 20 20 Reserved set to ASCII space 20h 19 17 End of block character 17h marks the beginning of the message trailer 20 00 Next Message Type value of zero turns the link around the master is telling the slave that it is waiting for information from the slave namely an Attach Response 21 22 00 00 Next Message Length equals zero since next Message Type byte is zero 23 24 38 35 BCC special two byte ASCII encoded BCC for the Attach message calculated over the bytes starting with the start of message character ESC through and including the Next Message Length Attach Response The Attach Response message is a slave only message that is sent to the master in response to the master s Attach message The slave must wait at least T1 time before starting to transmit the Attach Response message in order to give the master time to transition from the transmitting state to the receiving state The Attach Response message contains the responding slave s CPU ID ASCII null string if it doesn t have one and a T1 time The Attach Response message is 24 bytes long and has the following format Table 3 4 Attach R
88. HIS TERMINATION IS MADE ON THE SERIES 90 PLC PRODUCTS BY CONNECTING A JUMPER BETWEEN PIN 9 AND PIN 10 INSIDE THE 15 PIN D SHELL WITH THE FOLLOWING EXCEPTION FOR SERIES 90 70 PLCs CATALOG NUMBERS 1C697CPU731 AND IC697CPU771 THE TERMINATION FOR RD AT THE PLC IS IMPLEMENTED BY A JUMPER BETWEEN PIN 9 AND PIN 11 Figure A 5 Example RS 232 to RS 422 Converter Connection Table A 5 RS 232 RS 422 Converter Pin Assignment GFK 0529C RS 232 Port 25 pin connector RS 422 Port 15 pin connector Pin No Signal Description Pin No Signal Description 1 SHD Shield 1 SHD Shield 2 SD Send Data 2 DCD A Data Carrier Detect 3 RD Receive Data 3 DCD B Data Carrier Detect 4 RTS Request to Send 4 NC 5 CTS Clear to Send 5 5V Power Connection 6 NC 6 RTS A Request to Send 7 GND Signal Ground 7 OV Ground Connection 8 DCD NC 8 CTS B Clear to Send 9 RT Terminating Resistor 9 19 NC 10 RD A Receive Data 11 RD B Receive Data 20 DTR JMP See Figure A 4 12 SD A Send Data 13 SD B Send Data 21 25 NC 14 RTS B Request to Send 15 CTS A Clear to Send NC No Connection SD Send Data and RD Receive Data are the same as TXD and RXD used in the Series Six PLC A and B are the same as and A and B denote outputs and A and B denote inputs Refer to the cable diagrams in the following pages for specific device RS 232 RS 422 converter connections Appendix A Serial Port and Cables Section 2
89. IVE DATA RD SIGNAL NEEDS TO BE CONNECTED ONLY ON UNITS AT THE END OF THE LINES THIS TERMINATION IS MADE ON SERIES 90 PLC PRODUCTS BY CONNECTING A JUMPER BETWEEN PIN 9 AND PIN 10 INSIDE THE 15 PIN D SHELL WITH THE FOLLOWING EXCEPTION FOR SERIES 90 70 PLC CATALOG NUMBERS 1C697CPU731 AND IC697CPU771 THE TERMINATION FOR RD AT THE PLC IS IMPLEMENTED BY A JUMPER BETWEEN PIN 9 AND PIN 11 Figure A 15 Workmaster Il 25 pin Serial Connection to Series 90 PLCs IC690CBL702 OR EQUIVALENT RS 232 RS 422 RS 422 44507 RS 232 CONVERTER TWISTED SHIELDED 4450 SHIELDED PAIRS IC690ACC900 PAIRS PIN PIN re o 000 2 2 IBM AT DCD B 3 SD A COMPATIBLE RD A 10 Ch DOT SD B c RD B t 11 tt 13 RD A SD A 12 r1 L1 10 RD B RS 232 s SD B 13 11 11 RD prr PORT s RT 9 TT T1 9 RTS A 5 422 cTs A 15 1 pap 4 6 RTS B PORT CTS B 8 lt gt CTS 9 PIN lt 5 6 15 cTs 8 MALE RTS B 14 TT TT 8 5v 5 5 5 ov ovj 7 7 SHLD lt T 25 PIN x MALE 25 PIN 15 PIN 15 PIN 15 PIN 15 PIN FEMALE FEMALE MALE MALE FEMALE RS 232 RS 422 PORT PORT POWER SOURCE FOR POINT TO POINT CONNECTION 10 FEET 3 METERS ONLY CONVERTER POWER SOURCE BEYOND 10 FEET 3 METERS AND FOR MULTIDROP CONNECTION MUST BE EXTERNAL SOURCE TERMINATION RESISTANCE FOR THE RECEIVE DATA RD SIGNAL NEEDS TO BE CONN
90. K Mailbox message Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response to a program store request are Insufficient privilege must be level 3 or higher Not logged in as a programmer An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 119 Example of Program Store for Series 90 30 PLCs This example stores a Logic Block and a Declaration Block from a master SNP device to a Series 90 30 PLC The Logic Block size is 131 bytes and the Declaration BLock size is 618 bytes The example assumes that the master has already attached to a Series 90 30 PLC slave device has set the privilege level to three 3 and has logged in as a programmer attachment The master sends the Initial Request Mailbox message with Block Transfer to the slave with the service request code for Program Store 3fh and the Block Type field set for Logic After the slave acknowledges the Mailbox message the master transmits the Block Transfer message which contains the Logic Block bytes The slave responds with a Completion ACK Mailbox message which includes piggy back s
91. LATED REPEATER CONVERTER Figure A 8 Simple System Configuration Using the Isolated Repeater Converter Complex Multidrop Configuration This configuration shows how to connect multiple Isolated Repeater Converters for signal conversion greater distance and more drops RS 422 244928 CABLE C SERIES 90 PLC SERIES 90 PLC HOST P SERIES 90 PLC RS 422 RS 422 CABLED 0 BRICK BRICK SERIES 90 PLC J2 J2 J RS 232 sw ON sw ON CABLE A SERIES 90 PLC RS 422 y CABLE B RS 422 RS 422 CABLE D CABLE D BRICK Brick SERIES 90 PLC J2 J2 J sw ON SW z ON SERIES 90 PLC RS 232 CABLE E Brick H SERIES 90 PLC BRICK IS THE NICKNAME FOR THE J2 ISOLATED REPEATER CONVERTER CTS Figure A 9 Complex System Configuration Using the Isolated Repeater Converter Rules for Using Repeater Converters in Complex Networks When designing a complex multidrop network including PLCs and RS 422 repeater converters bricks the following rules apply Rule 1 When using a brick as a repeater port J2 should always be directed toward the host device and Port J1 should always be directed away from the host device The switch located on the side of the brick should always be in the center position ON The only case in which Port J1 is directed toward the h
92. M with Text Buffer T in Byte Mode Table 6 8 Write with Text Buffer T in Byte Mode Packet Byte Number Numbers s Hex Value Description Start of message character 10 3a 00 00 10 0a 00 00 00 01 10 00 00 00 00 00 0101 07 14 23 89 76 46 39 10 23 45 87 90 72 41 34 12 78 56 10 0a 00 00 10 3a 00 00 0101 00 XX XX XX XX XX XX XX Message type 2 M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request with Text Buffer Mailbox source Master SNP device Mailbox destination PLC service request task Reserved first byte zero second byte one Total length of data in bytes 0010h 16 Reserved must be set to zero Packet number total packets Request code Write System Memory Segment Selector 96 T data byte mode Data offset 000ah byte offset for T81 Data length 0010h 16 bytes End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type for Text Buffer Byte data to store in T81 T208 End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type M for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK Mailbox source PLC service request task Mailbox d
93. Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response to a Clear Fault Table are nsufficient privilege must be level 2 or higher Not logged on as a programmer Series 90 30 PLCs only An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 55 Example of Clear PLC Fault Table This example clears the PLC fault table The example assumes that the master has already attached to the slave device has set the privilege level to two 2 and has logged in as a programmer attachment The master sends the Initial Request Mailbox message to the slave with the service request code for Clear Fault Table 39h and the Fault Table type set to indicate the PLC fault table The slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 f7 cO 10 3a 00 00 10 0a 00 00 01 01 39 02 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2
94. Message Example 5 3 Jable 6 1 SNP Service Requests ID d o c c e E ee 6 1 Table 6 2 Change Privilege Level With No Password esee eene nennen 6 5 Table 6 3 Change Privilege Level With Password eese eene nennen 6 7 Table 6 4 Reference Data Segment Selectors Eneriz sieer aiee eni oiie 6 9 Table 6 5 Read SMEM no Text Buffer M in Bit 6 13 Table 6 6 Read SMEM with Text Buffer Word Mode sese 6 15 Table 6 7 Write SMEM no Text Buffer 0 in Bit Mode sess 6 18 Table 6 8 Write with Text Buffer T in Byte Mode sese nennen nennen 6 20 Table 6 9 Read Task Memory teet 6 23 Table 6 10 Write Task Memory iiec eerie este ie pee HEU e FR tete Hee Ee ce PETS doe 6 26 Table 6 11 Read Program Block Memory esee nre tnren rennen 6 29 GFK 0529C Contents xi Contents Table 6 12 Table 6 13 Table 6 14 Table 6 15 Table 6 16 Table 6 16 Table 6 17 Table 6 17 Table 6 18 Table 6 19 Table 6 20 Table 6 21 Table 6 22 Table 6 22 Table 6 23 Table 6 23 Table 6 24 Table 6 25 Table 6 26 Table 6 27 Table 6 28 Table 6 29 Table 6 30 Table 6 31 Table 6 32 Table 6 33 Table 6 34 Table 6 35 Table 6 36 Table 6 36 Table 6 37 Table 6 38
95. N 7 Mor N Data Message d Message N N Yes d Data Msgs Text Buffer or i without Errors Panos ACK I To Heceive From Block Transfer or Lo N Master E Connection Data RT p N N N 4 NV N 4 Msg N o Tm mes NACK Message More Response Received Yes Data Msgs Yes 9 Mailbox I Without Errors ACK To Receive From BO 1 I 2 Slave NACK More Data Message Message Data Msgs Received Yes K N Text Butter or gt Without Errors M ack r9 To Receve From P A Block Transfer 2 A Figure 1 9 SNP Service Request to the PLC via Mailbox Message Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C In order to give you a quick idea of the protocol a brief exchange of the messages is shown here for two cases one that reads three words of register data followed by one that writes three words of register data The details of the messages within each exchange is explained in other sections within this document Read Register Data Read three words of Register data MASTER SLAVE Long Break _ Attach Message_ _Attach Response Message Read System Memory MB_ _ACK _Read System Memory Response MB ACK _ Write Register Data Write three words of Register data MASTER SLAVE Long Break Attach Message
96. N AS SHOWN BELOW MASTER CMM SLAVE 1 ISOLATED REPEATER CONVERTER BRICK USED AS A CONVERTER CPU BUILT IN PORT CMM SLAVE 2 25 PIN FEMALE ALSO IT IS RECOMMENDED TO MAKE ANY NECESSARY CONNECTIONS INSIDE THE CABLE CONNECTOR TO BE MOUNTED ON THE CMM IT IS NOT RECOMMENDED TO USE TERMINAL STRIPS OR OTHER TYPES OF CONNECTORS ALONG THE LENGTH OF SW ON THE TRANSMISSION LINE ISOLATED REPEATER CONVERTER BRICK USED AS A REPEATER UTUTUUUUUUUU 25 PIN 25 PIN A 2 MALE FEMALE TO OTHER DEVICES MAXIMUM OF 8 DEVICES ON A MULTIDROP TERMINATE THE RD B SIGNAL ONLY AT END OF MULTIDROP CABLE TERMINATE CONNECTION ON FIRST AND LAST DROPS ONLY ON THE CMM INSTALL JUMPER TO CONNECT INTERNAL 120 OHM RESISTOR ON THE ISOLATED REPEATER CONVERTER INSTALL 150 OHM RESISTOR SUPPLIED CMM311 ONLY PORT 2 CAN SUPPORT RS 422 RS 485 Figure A 13 Cable D RS422 Twisted Pair A 18 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 45239 SW cTS SERIES 90 CMM ISOLATED PORT REPEATER CONVERTER BRICK 0001 604011 25 PIN 25 PIN 25 PIN 25 PIN FEMALE MALE MALE FEMALE Figure A 14 Cable E RS 232 Converter to CMM Serial Cable Diagrams This section describes only a few of the many and various Point to Point and Multidrop serial port connections for Series 90 PLC
97. Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message is Insufficient privilege Series 90 70 PLCs only level 1 or higher Invalid input parameter in the request mailbox message Response Text Buffer Message If the slave returns a Completion ACK Mailbox message with Text Buffer 94h the program block data returns to the master in one or more Text Buffer messages The number of Text Buffer messages required depends on the amount of data being read and the maximum data size allowed in a SNP Data message An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 27 6 28 Example of Read Program Block Memory This example reads the two words of L data at L9 and L10 belonging to the program block SUBI The main control program name is STAT 1 The current values of L9 and L10 are L9 87ACh L10 4BCDh The example assumes that the master has attached to a Series 90 70 PLC slave device and has set the privilege level to one 1 The master sends the Initial Request Mailbox message with Text Buffer to the slave with the service request code for Read Program Block Memory 06h along with the segment selector data offset and data length Once this Mailbox message is acknowledged by the slave the master sends the Text Buffer message containing the main control program name and the progr
98. O BE MOUNTED ON THE CMM IT IS NOT RECOMMENDED TO USE TERMINAL STRIPS OR OTHER TYPES OF CONNECTORS ALONG THE LENGTH OF THE TRANSMISSION LINE TERMINATE CONNECTION ON FIRST AND LAST DROPS ONLY ON THE CMM INSTALL JUMPER TO CONNECT INTERNAL 120 OHM PAIRS 0 TO OTHER DEVICES MAXIMUM OF 8 DEVICES ON A MULTIDROP TERMINATE THE RD B SIGNAL ONLY AT END OF MULTIDROP CABLE RESISTOR ON THE ISOLATED REPEATER CONVERTER INSTALL 150 OHM RESISTOR SUPPLIED THE CMM311 ONLY PORT 2 CAN SUPPORT RS 422 RS 485 Figure A 12 Cable C RS422 Twisted Pair Appendix A Serial Port and Cables 844931 SERIES 90 CMM PORT OR 2 25 PIN FEMALE ISOLATED REPEATER CONVERTER BRICK USED AS A CONVERTER 25 PIN FEMALE ISOLATED REPEATER CONVERTER BRICK USED AS A REPEATER oooooooooooopf 25 PIN FEMALE SHIELDED MAKE CONNECTIONS 244932 TWISTED INSIDE D CONNECTORS PAIRS PIN las wp dg 16 m X x 17 RD 15 11 RD B 14 br X X 11 w HUE xX 22 23 SERIES 90 CMM PORT 1 ISOLATED REPEATER CONVERTER BRICK OR 2 9 2332 SgzgSX 5 a 8 o 25 PIN 25 PIN 25 PIN FEMALE MALE FEMALE NOTE WHEN WIRING RS 422 485 MULTIDROPCABLES REFLECTIONS ON THE TRANSMISSION n SW crs LINE CAN BE REDUCED BY CONFIGURING THE CABLE IN A DAISY CHAIN FASHIO
99. Repeater Converter A 12 Pin Assignments for the Isolated Repeater Converter A 13 System ConfIBUratiOnS ettet ee eec eee e ettet echte eee ete eode A 14 Simple Multidrop Configuration essere A 15 Complex Multidrop Configuration seen A 15 Rules for Using Repeater Converters in Complex Networks A 15 Cable Diagrams 2 22 e pte tete Hee gt etes e te te o EEOAE A 16 Serial Cable Diagrams 22 eae e E Rt ge d ode ds A 19 RS 232 Point to Point Connections ccccecssecesceceeeceeeeeceeaceceeeeecsaeeeenaecseaeeceeaeens A 20 RS 422 Point to Point nnne A 22 Contents ix Contents Figure 1 1 RS 232 RS 422 Point to Point Serial Connection to Series 90 70 1 1 Figure 1 2 RS 232 RS 422 Point to Point Serial Connection to Series 90 30 PLC 1 1 Figure 1 3 RS 422 Point to Point Serial Connection to Series 90 70 PLC sse 1 2 Figure 1 4 RS 422 Point to Point Serial Connection to Series 90 30 eee 1 2 Figure 1 5 Point to Point Modem Serial Link Connection for Series 90 PLCS eee 1 2 Figure 1 6 Multidrop Serial Link Connection for Series 90 PLCS eese 1 3 Figure 1 7 Multidrop System Using R
100. S 422 Isolated Repeater RS 232 Converter sss 1 4 Figure 1 8 SNP Attach Sequence with a Series 90 PLC essere 1 9 Figure 1 9 SNP Service Request to the PLC via Mailbox Message eee 1 10 Figure A 1 Series 90 PLC RS 422 Serial Port Connector Configuration eere A 4 Figure 2 Workmaster RS 232 Serial Port Connector Configuration eee A 6 Fis re A 3 IBM AT XT Serial erre ete tere ee Pe enia ete egeta A 7 Figure 4 RS 232 to RS 422 Converter Logic Diagram eeseeeeeeeeeeeeeeee nennen A 8 Figure A 5 Example RS 232 to RS 422 Converter eene A 9 Figure A 6 The Isolated Repeater Converter eese nennen nnne 11 Figure 7 RS 422 IsolatedRepeater RS 232 Converter Logic Diagram A 12 Figure A 8 Simple System Configuration Using the Isolated A 15 Figure A 9 Complex System Configuration Using the Isolated Repeater Converter A 15 Figure A 10 Cable A RS 232 Device To nennen nennen nennen A 16 Figure A 11 Cable B RS 422 Device to Converter sees nre A 16 Figure A 12 Cable C RS422 Twisted Pair nennen nne A 17 Figure A 13 Cabl
101. SNP device Mailbox Destination ID PLC service request task Packet Number always one 1 Total Packets always one 1 Request code dependent on the service request Service request data Dependent on service request End of block character Next message type Next message length Status byte Block Check Code BCC The Initial Request Mailbox message with Text Buffer 80h is shown in the following table Chapter 3 SNP Protocol 3 9 3 10 Table 3 7 Initial Request Mailbox Message With Text Buffer 11 14 15 18 19 20 21 22 23 26 27 28 29 30 34 35 36 37 38 Value 1b 4d 00 00 XX XX XX 00 XX 80 10 3a 00 00 10 0a 00 00 00 01 XX XX 00 00 00 00 01 01 XX XX XX XX KX 17 XX XX XX 00 XX Description Start of message character Message type character 4dh for Mailbox message Reserved must be set to zero Time Stamp optional may be zeroes Reserved must be set to zero Sequence Number 00 to ffh inclusive Mailbox Type Initial Request with Text Buffer Mailbox Source ID master SNP device Mailbox Destination ID PLC service request task Reserved must be set to zero Must be set to one 1 Total length of data in bytes Reserved must be set to zero Packet Number always one 1 Total Packets always one 1 Request code dependent on the service request Service request data dependent on service request End of block chara
102. Se m LJ Slave message transmitted to Master Mo m Slave test decision m Long Break p Mat T4 Attach Wait T1 Attach Merker min Message min gt Response L SNP Attach Sequence with the Long Break and 4 Timer m q Attach Wait T1 p Attach Begin Message min Response L SNP Attach Sequence using break free SNP Figure 1 8 SNP Attach Sequence with a Series 90 PLC Once a communication session is established between the master and a PLC the master can issue service requests to the PLC via Mailbox messages Mailbox messages contain a field which specifies a service request code that identifies the desired request along with any necessary parameter fields for that service request Both the master and slave do error checking on all incoming messages Each message received by a given side must be ACKed or NAKed transmission errors detected Continuing with the flow diagram above we have the following The long break is not required for Break Free SNP operation Chapter 1 Introduction 1 9 1 10 44503 Msg N o Times nack Bes n Yes N N o ZN ZN 7 X More lessage Data Msgs Request Received 95 Yes il To Receive From Mailbox gt A Without Errors gt ACK r9 Master Message L_ N 2 7 f N by 4 NO Msg Pete Times nack L 4 1 N Yes o ES A O
103. X 9 fl 10 d4 11 14 10 0a 00 00 15 18 10 3a 00 00 19 20 0101 21 00 22 XX 23 24 ac 87 25 26 cd 4b 27 28 XX XX 29 00 30 01 31 32 00 00 33 34 7 31 35 17 36 00 37 38 00 00 39 00 40 BCC Description Start of message character Message type M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request with Text Buffer Mailbox source Master SNP device Mailbox destination PLC service request task Reserved first byte zero second byte one Total length of data in bytes 0010h 16 Reserved must be set to zero Packet number total packets Request code Read Program BLock Memory Segment Selector L memory Data offset 8 word offset for L9 Data length 2 words gt L9 L10 End of block character Next message type T for Text Buffer Next message length in bytes 0018h 24 Status byte Block Check Code Start of message character Message type for Text Buffer Control Program name STAT 1 Program Block name SUBI End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK Mailbox source PLC service request task Mailbox destination Master SNP device Packet number total packets Status co
104. XX XX 93 98 36 20 11 07 06 90 99 100 101 102 103 104 Chapter 6 Service Requests Packet Byte Number ee Hex Value Description Start of message character Message type for Text Buffer Time Stamp for last time PLC fault table was cleared 11 19 37 on Jun 7 1990 Faults since last clear 0002 Total faults in table 0002 Faults returned in this response 0002 Start of Fault Entry Number 1 Spare bytes don t care Rack number Slot number Unit number task reporting the error Don t care Fault Group Low Battery Fault Action Diagnostic Fault Error Code Don t care Time error logged 11 19 53 Jun 7 1990 Start of Fault Entry Number 2 Spare bytes don t care Rack number Slot number Unit number Don t care Fault Group Password Access Failure Fault Action Diagnostic Fault Error Code Don t care Time error logged 11 20 36 Jun 7 1990 End of block character Next message type Next message length Status byte Block Check Code 6 51 Example of Return 1 0 Fault Table This example retrieves all faults in the I O fault table The example assumes that the master has already attached to the slave device and has changed the privilege level to one 1 The master sends the Initial Request Mailbox message to the slave with the service request code equal to Return Fault Table 38h and the Fault Table Type field specified as I O fault table
105. XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 6d Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 XX Don t care 23 06 Datagram Connection ID 24 28 XX XX XX XX XX Don t care 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Chapter 6 Service Requests 6 65 Write Datagram Request The Write Datagram request allows the master to specify the reference data to be included within a given Datagram area This data includes the fixed header portion of the Datagram area program block name program block segment and the number of point formats along with N number of point formats where each format is made up of a segment selector point offset and point length There is a key difference in the mailbox type of the request mailbox between the Series 90 30 and Series 90 70 PLCs the Series 90 30 s request Mailbox Type is 80h and the Series 90 70 s request Mailbox Type is is COh In both cases the Mailbox message trailer specifies a Next Message Type C for Connection Data After the slave acknowle
106. a single service request Update Datagram request This set or group of reference data is referred to as a Datagram The Establish Datagram request specifies the Datagram area size the actual reference data to be included within this Datagram is defined in the Write Datagram request Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 15h Establish Datagram Datagram Type byte 22 Olh Normal Update on Request 81h Permanent Update on Request Datagram Size bytes 23 24 Required Datagram area size in bytes consists of 12 bytes fixed header size 4 N bytes N number of point formats number of data bytes accessed Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Dih Error Nack Mailbox message Datagram ID byte 23 Identification number for this Datagram area this ID should be used in the Write Update and Cancel Datagram requests that pertain to this Datagram area If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message response to an E
107. acy completeness sufficiency or usefulness of the information contained herein No warranties of merchantability or fitness for purpose shall apply The following are trademarks of GE Fanuc Automation North America Inc Alarm Master Field Control Modelmaster Series 90 CIMPLICITY GEnet Motion Mate Series One CIMPLICITY Control Genius PowerMotion Series Six CIMPLICITY PowerTRAC Genius PowerTRAC ProLoop Series Three CIMPLICITY 90 ADS Helpmate PROMACRO VuMaster CIMSTAR Logicmaster Series Five Workmaster Copyright 1998 GE Fanuc Automation North America Inc All Rights Reserved Preface Content of This Manual GFK 0529C This manual provides an introduction to the Series 90 Protocol SNP and provides a very detailed description of the SNP Protocol exchange This manual should be used by individuals implementing the master side of the SNP Protocol Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Appendix A Introduction Provides an overview of the SNP protocol and introduces the communication services and configuration Configuration Provides an in depth discussion of the SNP serial configuration and setup parameters SNP Protocol Describes the header trailer and data that make up the SNP packets along with the SNP message types Integrity Checking and Error Recovery Describes the ACK NAK message error checking sequences control and retries SNP Parameter Select Message Describe
108. age D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response to a logon request are e Invalid task name Nocommunications buffer size Series 90 70 PLC only Examples of programmer logons to both a Series 90 30 CPU and Series 90 70 CPU follow GFK 0529C Chapter 6 Service Requests 6 59 Example of Programmer Logon for Series 90 30 PLC The following assumes that the master has already attached to a 90 30 CPU device and wishes to logon as a programmer attachment The master sends the Initial Request Mailbox message to the slave with the service request code for Programmer Logon 20h the log mode byte set for Login Serial Mode 02h along with the task name ASCII null string in this example and the slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 22 cO 10 00 00 10 Oa 00 00 01 01 20 02 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx 22 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 01 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 gt ACK 06 00 A full explanation of the SNP message used in the example follows 6 60 Series 90 PLC SNP Com
109. age type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Chapter 6 Service Requests 6 69 6 70 Set PLC State Run versus Stop The Set PLC State request allows the master to change the execution state of the PLC The allowable choices are Run mode with I O enabled Run mode with I O disabled Series 90 70 only Stop mode with I O enabled Stop mode with I O disabled Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 Service Request code byte 21 New State bytes 22 Response Mailbox Message Mailbox Type byte 10 COh 23h ON c D4h Dih Initial Request Mailbox message Set PLC State Run mode I O enabled Run mode I O disabled Series 90 70 only Stop mode I O disabled Stop mode I O enabled Completion ACK Mailbox message Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response are icient privilege must be level 2 or higher ot logged in as a programmer Series 90 30 PLCs only Faults exist in the fault table run mode request
110. ailbox source PLC service request task Mailbox destination Master SNP device Reserved don t care Total length of data in bytes 00h 10 Don t care Packet number total packets Control program number Current privilege level Last sweep time PLC status word End of block character Next message type T for Text Buffer Next message length in bytes 0012h 18 Status byte Block Check Code Start of message character Message type for Text Buffer Requested data P39 P43 End of block character Next message type Next message length Status byte Block Check Code 6 23 Write Task Memory The Task Memory Write TMEM request allows the master to write to a single contiguous block of data from a PLC Program Task Type It is a Series 90 70 PLC only request and should be used by the SNP user to access data within a Main Control Program Task segment namely P memory Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 80h Initial Request Mailbox message with Text Buffer Total length of data bytes 21 22 The total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Service Request code byte 29 08h Write Program Block Memory Segment Selector byte 30 04h Segment Selector 4 for P data Data Offset bytes 31 32 Zero based offset of data Data Length bytes 33 34 Length of data
111. am Block Load n a 1 YES For series 90 30 PLCs with Release 1 x CPU firmware privilege level 4 is required For Series 90 30 PLCs with Release 1 x CPU firmware privilege level 3 or higher is required 6 1 6 2 The sections that follow describe each of the service requests in the table above Examples along with explanations are included for each In the service request tables that follow you will notice that all examples are in hexadecimal and that several abbreviations are used e g BCC MB xx Refer to Chapter 1 for a complete listing of terms and acronyms BCC Block Check Code MB Mailbox xx Don t Care Meaningless data and should be ignored Fields that are either reserved or not used in the Initial Request Mailbox messages must be set to zero as shown in all of the following examples Failure on the user s part to comply with this rule may cause unexpected results in current or future revisions of the PLC CPU firmware as later features are implemented Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Change Privilege Level The Change Privilege Level request enables the master to change its access privilege level to the PLC CPU so long as the proper password for the requested level is provided none needed if no password is active for that level For Series 90 70 PLCs there are five privilege levels 0 through 4 for Series 90 30 PLCs there are four privileg
112. am block name The slave responds with a Completion ACK Mailbox message containing the requested L data and the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message with Text Buffer 1b 4d 00 00 00 00 00 00 f1 80 10 3a 00 00 10 0a 00 00 00 01 10 00 00 00 00 00 01 01 06 00 08 00 02 00 17 54 18 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Request Text Buffer message 1b 54 53 54 41 54 5f 31 00 00 53 55 42 31 00 00 00 00 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 wait T1 time 5 Completion ACK MB message 1b 4d XX XX XX xx xx xx fl d4 10 0a 00 00 10 3a 00 00 01 01 00 xx ac 87 cd 4b xx xx 00 01 00 00 7c 31 17 00 00 00 00 BCC wait T1 time 6 gt ACK 06 00 A full explanation of the SNP messages used in the example follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Explanation of Read Program Block Memory Table 6 11 Read Program Block Memory Packet Byte Number Number s Hex Value 1 1 1b 2 4d 3 4 00 00 5 7 00 00 00 8 00 9 fl 10 80 11 14 10 3a 00 00 15 18 10 0a 00 00 19 20 00 01 21 22 10 00 23 26 00 00 00 00 27 28 0101 29 06 30 00 31 32 08 00 33 34 02 00 35 17 36 54 37 38 18 00 39 00 40 BCC 3 5 1 1b 2 54 3 10 53 54 41 54 5 31 00 00 11 18 53 55 42 31 00 00 00 00 19 17 20 00 21 22 00 00 23 00 24 BCC 5 1 1b 2 4d 3 4 XX XX 5 7 XX XX XX 8 X
113. am task name 8 byte NUL terminated ASCII string Program block name Name of the program block to which the L data belongs 8 byte NUL terminated ASCII string Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message 94h Completion ACK Mailbox message with Text Buffer Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h or Completion ACK Mailbox message with Text Buffer 94h is returned to the master The type of Mailbox message returned depends on the amount of data to be passed back to the master If the number of data bytes being read is six bytes or less the slave responds with a Completion ACK Mailbox message which contains the data read If the number of data bytes being read is greater than six bytes the slave responds with a Completion ACK Mailbox message with Text Buffer and the data read is returned to the master in one or more Text Buffer messages Completion ACK Mailbox message D4h Requested Data bytes 23 28 Completion ACK Mailbox message with Text Buffer 94h Total length of data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Next message type byte 36 54h for Text Buffer Next message length bytes 37 38 Number of bytes in the next Text Buffer message If the CPU is unable to comply with the request it must reject the request In this case an Error
114. ange Privilege Level With Password The following example assumes that the master has already attached to the slave device and knows the password to be AB1 The master sends the Initial Request Mailbox message to the slave with the service request code for Change Privilege Level 21h change level field set to 1 and the password field set to AB1 terminated with a NUL The slave responds with a Completion ACK Mailbox message which includes the piggy back status information It can be noted from the piggy back status that the privilege level associated with the password 1 must be level three 3 MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 52 cO 10 00 00 10 Oa 00 00 01 01 21 ff 41 42 31 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 lt ACK 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx 52 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 03 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 06 00 A full explanation of the SNP messages used in the example follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Explanation of Change Privilege Level With Password Table 6 3 Change Privilege Level With Password Packet Byte Number Number s Hex Value Description 1 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved
115. aracter Message type 2 M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number Total packets Request code Cancel Datagram Datagram ID Normal Datagram Not used End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type 2 M for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK Mailbox source PLC service request task Mailbox destination Master SNP device Packet number Total packets Status code 0 okay Don t care Control program number Current privilege level Last sweep time PLC status word End of block character Next message type Next message length Status byte Block Check Code Chapter 6 Service Requests 6 109 Update Real Time Datagram 6 110 The Update Real Time Datagram message is used to perform a combined Attach and Update Datagram request This message is a master only message and like the Attach message is sent after the long break The master must wait 4 time after the end of the long break before sending the Update Real Time Datagram message in order to give all PLC CPUs on the serial link time to recognize the
116. aracter 36 43 Next message type for Connection Data 37 38 1c 00 Next message length in bytes 001ch 28 39 00 Status byte 40 BCC Block Check Code 5 lt 1 1b Start of message character 2 43 Message type for Connection Data 3 01 Datagram Connection ID 4 6 XX XX XX Don t care 7 8 Oe 00 Reference data size 000eh 14 bytes 9 22 87 23 23 98 21 34 86 through 961112 09 19 22 05 12 71 43 11 17 End of block character 12 00 Next message type 13 14 00 00 Next message length 15 00 Status byte 16 BCC Block Check Code 6 104 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Update Datagram for Series 90 70 PLCs Multiple Point Formats This example request an update of reference data defined in Datagram ID two 2 Datagram ID two has already been established and defined as containing four point formats see example of Write Datagram for Series 90 70 PLCs with multiple points The reference data accessed by the four point formats is currently set as follows shows 16 bits worth RO5 2219h RO6 1205h RO7 4371h 808 2198h RO9 7065h R41 1297h RA2 3112h R43 lacdh T17 2465h T33 3674h M33 1290h M49 6739h The master sends the Initial Request Mailbox message to the slave with the service request code for Update Datagram 16h along with the Datagram Connection ID The slave responds with a Completion ACK Mailbox message which contains t
117. ay or may not be logged on as a programmer depending on which service requests you want to invoke The logon request is also useful for associating a control program task name with the master SNP device A table containing the privilege level and logon requirements for each service request available to the SNP user can be found in Chapter 6 The service requests available to the SNP user are listed here followed by a brief description for each Each of the service requests are described in detail in Chapter 6 Change Privilege Level Programmer Logon Read and Write PLC Memory Set Control ID PLC Short Status Set PLC Time Date Return Control Program Name Set PLC State Return Controller TYPE and ID Toggle Force System Memory Return PLC Time Date Storing and Loading Logic Programs Return Fault Table Datagrams Clear Fault Table Change Privilege Level When the master establishes a communication session with a PLC the PLC assigns a default privilege level to the master There are five privilege levels in Series 90 70 PLCs 0 through 4 and four privilege levels in Series 90 30 PLCs 1 through 4 The default privilege level assigned to the master is 0 for Series 90 70 PLCs and 1 for Series 90 30 PLCs Each service request and memory type within the PLC has an access privilege level associated with it If a service request is issued by the master and the master does not have the proper privilege level access for the request the PLC rejects t
118. ber Number s Hex Value Description 1 2 1 16 Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 05 Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 21 23 Request code Set PLC State 22 00 New PLC state Run I O enabled 23 34 00 00 00 00 00 00 Not used 00 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 05 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 02 Current privilege level 31 32 XX XX Last sweep time 33 34 4c XX PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Series 90 PLC SNP Communications User s Manual S
119. ber Byte 21 I O bus number Byte 21 Spare byte Byte 22 Bus addresses Byte 22 Fault group Byte 23 Point address Word 23 24 Fault action Byte 24 Fault group Byte 25 Fault error code Bytes 25 26 Fault action Byte 26 Spare bytes Bytes 27 50 Fault category Byte 27 Time error logged Bytes 51 56 Fault type Byte 28 Fault description Byte 29 Spare bytes Bytes 30 50 Time error logged Bytes 51 56 Groups of 42 bytes will continue in the above manner until all requested faults have been returned If more than one text buffer is required to return all fault data please take note that the fault header is only sent in the first text buffer all subsequent text buffers contain 42 byte fault data entries only The following two tables define the fault group and fault action fields GFK 0529C Chapter 6 Service Requests 6 47 Table 6 20 Fault Action Codes Fault Description Informational 2 Diagnostic 3 Fatal Table 6 21 Fault Group Codes Fault Description 1 Loss of or Missing Rack 2 Loss of or Missing IOC 3 Loss of or Missing I O Module 4 Loss of or Missing Non I O Module 5 Addition of or Extra Rack 6 Addition of or Extra IOC 7 Addition of or Extra I O Module 8 Addition of or Extra Non I O Module 9 IOC or I O Bus Fault 10 I O Module Fault 11 System Configuration Mismatch 12 VME LP System Bus Error 13 PLC CPU Hardware Failure 14 Module Non Fatal Hardware Error 15 IOC Software Failure 16 No
120. ble the thee one pete ied e peeled 6 55 Example of Clear PLC Fault Table seen 6 56 Explanation of Clear PLC Fault Table seen 6 57 Prosrammier Logon ee e hne telnet x ge i ERA EL eO ee eeu eae Oe 6 58 Example of Programmer Logon for Series 90 30 PLC see 6 60 Explanation of Programmer Logon for Series 90 30 PLC sess 6 61 Example of Programmer Logon for Series 90 70 PLC esee 6 62 Explanation of Programmer Logon for Series 90 70 6 63 Set Control ID CPU tee rette Rete gn ee eerie IEEE 6 64 Example of Set Control ID eee epi 6 65 Explanation of Set Control 10 6 66 Set PLE Time Dat iore rne Fete eee ee e ope be cete oe 6 67 Example of Set Time Date penetret 6 68 Explanation of Set Time Date essere 6 69 Set PLC State Run versus Stop ente etn 6 70 Example of Set PLC State to Run I O Enabled eee 6 71 Explanation of Set PLC State to Run I O Enabled sees 6 72 Example of Set PLC State to Stop I O Enabled see 6 73 GFK 0529C Contents vii Contents Explanation of Set PLC State to Stop I O
121. byte Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 5 Set PLC Time Date The Set PLC Time Date request allows the master to set the internal time and date of the PLC CPU Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 24h Set PLC Time Time Date mode byte 22 Set both time and date 2 Set time only Set date only Seconds byte 23 Minutes byte 24 byte 25 Day byte 26 Hour Current seconds in packed BCD format Current minutes in packed BCD format Current hour in packed BCD format Current day of month in packed BCD format Month byte 27 Current month in packed BCD format Year byte 28 Current year in packed BCD format Day of Week byte 29 Day of week Valid range 1 7 where Sunday 1 Saturday 7 ignored in Series 90 30 PLCs since the 90 30 always computes its own Packed BCD format tens digit in bits 4 through 7 ones digit in bits 0 through 3 Response Mailbox Message Mailbox Type byte 10 D4h Dih Completion ACK Mailbox message Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along w
122. ce request task Packet number Total packets Request code Return Fault Table Fault Table Type in this case PLC Fault table index start with first fault Number of Entries to Return in this case entire table 0010h 16 Not used End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK with Text Buffer 10 0a 00 00 Mailbox source PLC service request task 10 3a 00 00 Mailbox destination Master SNP device Reserved don t care Number of destinations always one Total length of data in bytes 0060h 96 Don t care Packet number Total packets Control program number Current privilege level Last sweep time PLC status word End of block character Next message type for Text Buffer Next message length in bytes 0068h 104 Status byte Block Check Code 6 50 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Table 6 22 Return PLC Fault Table Continued 54 37 19 11 07 06 90 02 00 02 00 02 00 XX XX XX XX 00 00 XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 53 19 11 07 06 90 XX XX XX XX 61 62 63 64 65 66 67 68 69 92 00 00 XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
123. ce request task Mailbox destination Master SNP device Packet number total packets Status code 0 okay Don t care Control program number Current privilege level Last sweep time PLC status word End of block character Next message type Next message length Status byte Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Read Program Block Memory The Read Program Block Memory Read PBMEM request allows the master to access a single contiguous block of data from a PLC Program Block Memory Type It is a Series 90 70 PLC only request and should be used by the SNP user to access data within a Local Subblock Data segment namely L memory Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 80h Initial Request Mailbox message with Text Buffer Total Length of Data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Service Request code byte 29 06h Read Program Block Memory Segment Selector byte 30 00h Segment Selector 0 for L data Data Offset bytes 31 32 Zero based offset of data Data Length bytes 33 34 Length of data to read in words Next message type byte 36 54h Text Buffer Next message length bytes 37 38 Number of bytes in the next Text Buffer message Request Text Buffer Message Program task name Main progr
124. ck Check Code Start of message character Message type 2 M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 04 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 04 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 10 0a 00 00 Mailbox destination PLC service request task 6 18 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C 5 Example of Write SMEM with Text Buffer T in Byte Mode This example writes 16 bytes of temporary discrete data starting at the discrete point T81 up to and including the discrete point 761208 using the T byte mode segment selector with a data offset and data length whose units are byte The example assumes that the master has already attached to the slave device and has set the privilege level to two 2 The discrete points T81 through T208 inclusive are currently set to zero When the write request is complete bytes T81 through T201 should contai
125. cter Next message type must be 54h 42h or 43h for T B or C respectively Next message length Status byte Block Check Code BCC Completion ACK Mailbox Messages The PLC CPU slave responds to Initial Request Mailbox messages with Completion ACK Mailbox messages If the response data is six bytes or less a Completion ACK Mailbox message without a Text Buffer Mailbox Type D4h is sent to the master If however the data in the response requires more than six bytes then a Completion ACK Mailbox message with Text Buffer Mailbox Type 94h is sent to the master followed by one or more Text Buffer messages Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Piggy Back Status Information The last six bytes in the data portion of all Completion ACK Mailbox messages contain piggy back status information which relays the following information to the master Byte 29 Control Program Number Byte 30 Current Privilege Level Bytes 31 32 Last Sweep Time Bytes 33 34 PLC Status Word Control Program Number This value represents the number of the control program task the SNP master is currently logged into The valid values in today s implementations are 1 and 0 as follows 1 SNP master is not logged into a control program task 0 SNP master is logged into control program task 0 Privilege Level Current privilege level of the SNP master device Valid values are 0 through 4 for
126. ction Fault Group Force Memory Framing Errors G Genius Global Data 6 9 I O Faults Idle Time Inquiry Message 3 21 Integrity Checking 3 2 Isolated Repeater Converter Cable Diagrams A 16 System Configurations A 14 Load Programs Series 90 30 PLC Login 6 58 Login Codes 6 33 Logon Control ID Series 90 30 PLC 6 60 Series 90 70 PLC 6 62 Logout Mailbox 3 7 Nack Mailbox Messages Special Case Destination ID Sequence Number Source ID 3 8 Time Stamp 3 7 Type Master Maximum Data Size Memory Types 6 76 SNP Packet Trailer Multidrop Multidrop Configuration A 15 Multiple Point Format Series 90 30 PLC 6 90 6 101 Series 90 70 PLC 6 95 6 105 N NAKed 4 3 Negative Acknowledge NAK 4 1 0 One Point Format Series 90 30 PLC 6 88 6 100 Series 90 70 PLC 6 93 6 103 Override Overrun p Parameter Select 5 2 Parity 4 2 PBMEM PBMEM Read 6 21 6 27 PBMEM Write Piggy lt 106 gt Back Information 3 11 PLC Faults 6 49 6 50 PLC Logon Series 90 30 PLC 6 60 Series 90 70 PLC 6 62 GFK 0529C GFK 0529C PLC Memory Read W rite 6 8 PLC Status Word 3 11 Point Format Multiple Point 6 84 One Point ae Point to Point Privilege Level Series 90 30 PLCs 6 3 Series 90 70 PLCSs 6 3 With No Password With Password 6 6 Program Block Memor 16 27 Program Name Programmer Lo
127. de 0 okay Don t care 919 data L10 data Don t care Control program number Current privilege level Last sweep time PLC status word End of block character Next message type Next message length Status byte Block Check Code Chapter 6 Service Requests 6 29 Write Program Block Memory 6 30 The Write Program Block Memory Write PBMEM request allows the master to write to a single contiguous block of data from a PLC Program Block Memory Type It is a Series 90 70 PLC only request and should be used by the SNP user to access data within a Local Subblock Data segment namely L memory Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 80h Total length of data bytes 21 22 Service Request code byte 29 09h Segment Selector byte 30 00h Data Offset bytes 31 32 Data Length bytes 33 34 Next message type byte 36 54h Next message length bytes 37 38 Request Text Buffer Message Program task name Program block name Write data Response Mailbox Message Message Mailbox Type byte 10 D4h Dih Initial Request Mailbox message with Text Buffer The total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Write Program Block Memory Segment Selector 0 for L data Zero based offset of data Length of data to write T for Text Buffer Number of bytes in
128. dges the Mailbox message the master transmits one or more Connection Data messages containing the definition of the Datagram area Please see the description directly below Key fields within the request and response messages Request Mailbox Message for Series 90 30 PLCs Mailbox Type byte 10 80h Total length of data bytes 21 22 Service Request code byte 29 48h Datagram ID byte 30 Datagram Type byte 31 Olh Next message type byte 36 43h Next message length bytes 37 38 Request Mailbox Message for Series 90 70 PLCs Mailbox Type byte 10 COh Service Request code byte 21 48h Datagram ID byte 22 Datagram Type byte 23 Olh Next message type byte 36 43h Next message length bytes 37 38 Series 90 PLC SNP Communications User s Manual September 1998 Initial Request Mailbox with Connection Data Total number of data bytes that are going to be transmitted in all subsequent Connection Data messages Write Datagram Datagram connection ID whose point definition we want to define The Datagram ID is the ID passed back to the master in the Establish Datagram request Normal Update on Request 81H Permanent Update on Request for Connection data Number of bytes in the next Connection Data message Initial Request Mailbox Write Datagram Datagram connection ID whose point definition we want to define The Datagram ID is the ID passed back to the master in the Establish Da
129. e D RS422 Twisted Pair neret nennen nennen A 18 Figure A 14 Cable E RS 232 Converter to CMM enne enne A 19 Figure A 15 Workmaster II 25 pin Serial Connection to Series 90 A 20 Figure A 16 IBM AT compatibles Personal Computer to Series 90 PLCS A 20 Figure A 17 Workmaster or IBM XT compatibles Personal Computer to Series 90 PLCs A 21 Figure A 18 Typical RS 422 Host to PLC Connection with Handshaking esee A 22 GFK 0529C Contents Table 2 1 Series 90 PLC Timer Defaults ii iiie iii 2 3 Table 3 1 Series 90 Protocol SNP Message 3 1 Table 3 2 Attach Message Master Only Format eese eene 3 4 Table 3 3 Attach Message Example 54 1 eee ete d tient eerie eei es etse ne 3 5 Table 3 4 Attach Response Slave Only Message Format eese eee 3 5 1 3 5 Attach Response Example tr nine Rte ton p eer LI ree tte i 3 6 Table 3 6 Initial Request Mailbox Message essere nennen nennen netten ener enne 3 9 Table 3 7 Initial Request Mailbox Message With Text Buffer sese 3 10 Table 3 8 Bits of the PLC Status Word eei eee teo tetro t
130. e Requests 6 45 Return Fault Table The Return Fault Table request returns fault data from either the PLC Fault Table or the I O Fault Table to the master The Fault Table Type is specified in the Initial Request Mailbox message The PLC fault table has a maximum of 16 faults and the I O fault table has a maximum of 32 faults Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 38h Return Fault Table Fault Table Type byte 22 1 I O Fault Table 2 PLC Fault Table Fault Table Index bytes 23 24 O through 15 Index into PLC Fault table 0 through 31 Index into I O Fault table Number of Faults to Return bytes 25 Number of fault entries the user wants to 26 be returned within this service request Response Mailbox Message Mailbox Type byte 10 94h Completion ACK Mailbox message with Text Buffer Dih Error Nack mailbox message Total length of data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Next message type byte 36 54h T for Text Buffer Next message length bytes 37 38 Number of bytes in the next Text Buffer message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case
131. e has already been established and defined as containing one point format that spans I1 to 1112 The reference data I1 through I112 is currently set as follows 101 87h 125 98h 149 86h 173 22h 197 71h 109 23h 133 21h 157 09h 181 05h 1105 43h 117 23h 141 34h 165 19h 189 12h The master sends the Initial Request Mailbox message to the slave with the service request code for Update Datagram 16h along with the Datagram Connection ID The slave responds with a Completion ACK Mailbox message which contains the piggy back status information After the master acknowledges the Mailbox message the slave transmits a Connection Data message containing the values of the reference data MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 71 cO 10 3a 00 00 10 0a 00 00 01 01 16 01 01 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx 71 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 01 00 00 7c 31 17 43 1c 00 00 BCC wait T1 time 4 gt ACK 06 00 wait T1 time 5 Response Connection Data message 1b 43 01 xx xx xx 0e 00 87 23 23 98 21 34 86 09 19 22 05 12 71 43 17 00 00 00 00 BCC wait T1 time 6 ACK 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 103 Explanation
132. e has been no activity on the serial link in T3 time the master may send the Inquiry message to the slave in order to keep the communication session active Otherwise if there is no activity on the serial link causing the slave s T3 timer to time out the slave will assume a loss of communication and return to its initial state The slave echoes the Inquiry message byte for byte back to the master The Inquiry message is 40 bytes long and has the following format Table 3 18Inquiry Message Format Byte Size in Description Number Bytes 1 1 Start of message character ESC 1bh 2 1 Message type character 49h for Inquiry 3 34 32 Always zero 35 1 End of block character 17h marks the beginning of the packet trailer 36 1 Next message type 37 38 2 Next message length 39 1 Status byte 40 1 Block Check Code BCC Chapter 3 SNP Protocol 3 22 Inquiry Message Example In this example the master s T3 timer has expired which means that there has been no activity over the serial link in that time and a message must be sent to the slave in order to keep the established communication session active Otherwise the slave s T3 timer will time out and the slave will assume loss of communication and go back to an idle state waiting for a long break or an attach message To issue an Inquiry message to the slave the master sends the following series of bytes over the serial link 1b 49 00 00 00 00 00 00 00 0
133. e level Last sweep time PLC status word End of block character Next message type Next message length Status byte Block Check Code Chapter 6 Service Requests 6 63 Set Control ID CPU ID The Set Control ID request allows the master to specify a PLC CPU controller ID for a given PLC CPU The following rules apply to valid controller IDs Series 90 70 PLC Maximum of seven ASCII characters followed by a NUL Series 90 30 PLC Maximum of six ASCII characters followed by a NUL furthermore the valid characters are restricted to the ASCII characters 0 through 9 and A through F inclusive Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 22h Set PLC CPU Controller ID Controller ID bytes 22 29 ASCII string with NUL terminator Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status Common reasons for an Error Nack Mailbox message response are Insufficient privilege must be level 3 or h
134. e levels 1 through 4 Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 21h Change PLC CPU Privilege Level Change Level byte 22 1 Change to the highest level belonging to the specified password 0 Level 0 Series 90 70 only 1 Level 1 2 Level 2 3 Level 3 4 Level 4 Password bytes 23 30 NUL terminated ASCII string Please note that if a user knows a password but not the level associated with the password the request can be issued with a Change Level of 1 followed by the 8 byte ASCII encoded password The PLC CPU will change the requestor s privilege level to the level associated with the password If the password is used for more than one level then the highest level with that password is reached Response Mailbox Message D4h Completion ACK Mailbox message Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox Message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response to a privilege request are e Invalid password e No password provided when one is required Examples with full expla
135. e master must wait T4 time after the end of the long break before sending the Attach message in order to give all PLC CPUs on the serial link time to recognize the long break and to set up to receive the Attach message The Attach message contains the CPU ID of the slave PLC CPU that the master wishes to establish a communication session with and it also contains the master s T1 time Only the slave whose ID matches that in the Attach message will respond with an Attach Response message If the master passes a CPU ID of all NULs point to point connection there must be one and only one PLCs on the serial link as all slaves will respond to a point to point Attach message The Attach message is 24 bytes long and has the following format The long break is not required for Break Free SNP operation GFK 0529C Chapter 3 SNP Protocol 3 3 Table 3 2 Attach Message Master Only Format Byte Size in Number Bytes Description 1 1 Start of message character ESC 1bh 2 1 Message type character 41h for Attach 3 10 8 PLC CPU ID in ASCII NUL terminated 11 14 4 The Master s SNP timer T1 value in milliseconds encoded as ASCII hexadecimal 15 1 Reserved set to ASCII zero 30h 16 18 3 Reserved set to ASCII space 20h 19 1 End of block character 17h marks the beginning of the message trailer 20 1 Next message type 21 22 2 Next message length 23 24 2 BCC coded as ASCII hexadecimal values most significant byte first
136. e request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 25h Return PLC Time Date Response Mailbox Message Mailbox Type byte 10 94h Completion ACK Mailbox message with Text Buffer Total length of data bytes 21 22 Number of data bytes in all subsequent Text Buffer messages Next message type byte 36 54h T for Text Buffer Next message length bytes 37 38 Number of bytes in the next Text Buffer message Response Text Buffer Message Seconds byte 3 Current seconds in packed BCD format Minutes byte 4 Current minutes in packed BCD format Hour byte 5 Current hour in packed BCD format Day byte 6 Current day of month in packed BCD format Month byte 7 Current month in packed BCD format Year byte 8 Current year in packed BCD format Day of Week byte 9 Day of week valid range 1 7 where Sunday 1 Saturday 7 Packed BCD format Tens digit in bits 4 through 7 units digit in bits 0 through 3 An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 43 Example of Return PLC Time Date The following example assumes that the master has already attached to the slave device and has set the privilege level to one 1 The current time in the PLC CPU is 10 48 59 and the date is Friday May 4 1990 The master sends the Initial Request Mailbox message to the slave with the service
137. e request requires more than thirteen bytes then an Initial Request Mailbox message with Text Buffer Mailbox Type 80h must be used and one or more Text Buffer messages must follow the Initial Request Mailbox message The following two tables describe the format for the two different types of Initial Request Mailbox message The values of the bytes are listed when they are known and fixed values are marked xx for values dependent on the service request being made Fields that are either reserved or not used in the Initial Request Mailbox messages must be set to zero Failure on the user s part to comply with this rule may cause unexpected results in current or future revisions of the PLC CPU firmware as later features are implemented Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C The Initial Request Mailbox message Mailbox Type COh is shown in the following table Table 3 6 Initial Request Mailbox Message 35 36 37 38 39 40 13 See Nee Value 1b 4d 00 00 XX XX XX 00 XX c0 10 3a 00 00 10 0a 00 00 01 01 XX XX XX XX XX XX XX XX XX XX XX XX XX XX 17 00 00 00 00 XX Description Start of message character Message type character 4dh for Mailbox message Reserved must be set to zero Time Stamp optional may be zeroes Reserved must be set to zero Sequence Number 00 to ffh inclusive Mailbox Type Initial Request Mailbox Source ID master
138. e the user program and should not be concerned with the value of the bytes within the Logic and Declaration blocks or their meaning MASTER SLAVE wait T1 time 1 Initial Request MB message 00 00 00 00 00 00 2b cO 10 00 00 10 Oa 00 00 01 01 40 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 c Completion ACK MB message with Block Transfer 1b 4d XX XX XX Xx xx xx 2b 94 10 0a 00 00 10 3a 00 00 xx 01 83 00 xx xx xx xx 01 01 00 01 00 00 4c 20 17 42 8b 00 00 BCC wait T1 time 4 ACK wait T1 time 5 Response Block Transfer message 1b 42 xx 131 17 00 00 00 00 BCC wait T1 time 6 Chapter 6 Service Requests 6 115 MASTER SLAVE wait T1 time 7 Initial Request MB message 1b 4d 00 00 00 00 00 00 2c cO 10 00 00 10 0a 00 00 01 01 40 05 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 8 ACK 06 00 wait T1 time 9 Completion ACK MB message with Block Transfer Ib 4d XX XX XX XX xx xx 2c 94 10 0a 00 00 10 3a 00 00 Xx 01 6a 02 xx xx xx xx 01 01 00 01 00 00 4c 20 17 42 72 02 00 BCC wait T1 time 10 gt ACK 06 00 wait T1 time 11 lt Response Block Transfer message 1b 42 xx 618 17 00 00 00 00 BCC wait T1 time 12 06 00 A full explanation of the SNP messages used in the example follows 6 116 Series 90 PLC SNP Communications User s Manual Septe
139. e type Next message length Status byte Block Check Code GFK 0529C Chapter 6 Service Requests 6 61 6 62 Example of Programmer Logon for Series 90 70 PLC The following assumes that the master has already attached to a 90 70 CPU device and wishes to logon as a programmer attachment The control program task within the PLC is called STAT_1 The master SNP device has the storage capability to handle a communications buffer size of up to 16K bytes The master sends the Initial Request Mailbox message to the slave with the service request code for Programmer Logon 20h the log mode byte set for Login Serial Mode 02h the task name STAT_1 and a communications buffer size of 16K The slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 5b cO 10 00 00 10 Oa 00 00 01 01 20 02 53 54 41 54 5f 31 00 00 00 40 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX Xx xx xx 5b d4 10 0a 00 00 10 3a 00 00 01 01 00 xx 00 20 xx xx xx xx 00 00 00 00 7c 31 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the example follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Explanation of Programmer Logon for Series 90 70
140. e with Text Buffer 1b 4d XX XX XX XX XX Xx 62 94 10 0a 00 00 10 3a 00 00 xx 01 16 00 xx xx xx xx 01 01 00 01 00 00 4c 20 17 54 1e 00 00 BCC wait T1 time 4 06 00 wait T1 time 5 Response Text Buffer message 1b 54 89 34 17 12 71 90 53 28 27 26 17 09 31 84 72 41 34 12 78 56 87 09 17 00 00 00 00 BCC wait T1 time 6 gt ACK 06 00 A full explanation of the SNP messages used in the example follows 6 14 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Explanation of Read SMEM with Text Buffer R Word Mode Table 6 6 Read SMEM with Text Buffer R Word Mode Byte Number s Hex Value 10 3a 00 00 10 0a 00 00 0101 02 00 Ob 00 00 00 00 00 00 00 00 00 10 0a 00 00 10 3a 00 00 XX XX 16 00 XX XX XX XX 0101 89 34 17 12 71 90 53 28 27 26 17 09 31 84 72 41 34 12 78 56 87 09 Chapter 6 Service Requests Description Start of message character Message type 2 M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number total packets Request code Read System Memory Segment Selector R data word mode Data offset 0002h word offset for R3 Data length 000bh 11 words Not used End of block character Next message type Next message length Status byte Block Check
141. ecimal bytes 134 17 End of block character 135 00 Next message type 136 137 00 00 Next message length 138 00 Status byte 139 BCC Block Check Code 5 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 98 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 0101 Packet number total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 03 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Table 6 46 Program Store for Series 90 30 PLCs continued Packet Byte Number Number s Hex Value Description 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 99 Sequence number 10 80 Mailbox type Initial Request with Block Transfer 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request tas
142. ection Area must first be established and defined The Datagram Connection Area in the PLC CPU is made up of three parts a fixed length header which is twelve 12 bytes long the list of reference data to monitor where each reference data access is defined by a four 4 byte point format record and the data area where all the current reference data accessed by each point format record is stored before being sent to the SNP master A maximum of 256 point formats can be defined for each Datagram The fixed header portion contains three fields Program Block Name Applicable to Series 90 70 PLCs only eight byte NUL terminated string which specifies the name of the program subblock in the main control program which is assumed by any Local Subblock Data segment selectors L specified within the Datagram point formats If no Local Subblock Data segment selectors are specified in the point formats then this 8 byte field should be the ASCII Null string For the Series 90 30 PLCs this field will always be the ASCII Null string If data from two or more subblocks is required separate Datagrams must be established and defined for each one Program Block Segment Word value should always be set to zero Number of point Formats Word value total number of point formats defined in this Datagram connection area The size of each point format definition is four bytes which breaks down as follows Segment selector Byte field see segment selecto
143. ed in a SNP Data message An example with full explanation follows 6 114 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C 4 Example of Program Load for Series 90 30 PLCs This example loads the Logic Block and Declaration Block from a Series 90 30 PLC to the master SNP device The example assumes that the master has already attached to a Series 90 30 PLC slave device and has logged in as a programmer attachment The master sends the Initial Request Mailbox message to the slave with the service request code for Program Load 40h and the Block Type field set for Logic The slave responds with a Completion ACK Mailbox message with Block Transfer message which includes piggy back status information After the master acknowledges the Mailbox message the slave transmits the Block Transfer message which contains the Logic Block bytes The same sequence is repeated for the Declaration Block You will note that the Logic Block size and the Declaration Block size are returned to the master in the Completion ACK Mailbox messages with Block Transfer 131 bytes and 618 bytes respectively In an actual master SNP implementation these sizes must be recorded because they will be needed in any Program Store service requests of a user program see Program Store service request Please note that the actual Logic and Declaration bytes returned are shown as Don t care bytes You only need to have the means to retriev
144. edge ACK 4 1 Acronyms 1 Application Layer 1 5 ASCIL 3 2 3 4 1333 Message Response Basic Terms 1 13 Baud Rate BCC Calculation 3 3 BCD Format 6 43 Bit Access 16 10 6 8 Bit Toggle 6 75 Block Check Code BCC 3 2 4 2 6 2 Byte Boundar 46 81 Byte Data 6 8 Index Byte Mode Cable Length MET Point to Aem Specifications Cable Diagrams for Isolated Repeater Converter Cancel Datagram Cancel Request Change Privilege Clear Fault 6 57 Common Mode A 2 Communications Architecture Application Layer 1 5 Configuration Layer 1 5 Session Layer 1 5 Completion ACK Connection Modem Multidrop Point to Point RS 232 RS 422 Converter 1 1 Connector Specifications 2 1 Parity Queue D 5 2 Size SMEM Word 6 8 Datagram Byte Boundai 1679 6 107 Cancel Request 6 82 Establish Request 6 81 6 83 Multiple Point Format Number Connections 6 79 One Point Format Service Request Index 1 Index Index 2 Update 6 98 Update Real lt 106 gt Time Request 6 110 Update Request Write Request 6 79 6 86 Datagram Request 6 80 Datagrams Date 1 7 1 8 6 43 Default Parameters Default Timers 2 3 Definition of Terms 1 12 Discrete Data 6 9 Driver RS lt 106 gt 422 A 1 Electrical Standards A 2 Error Nack 3 15 Error Status Codes 3 16 Fault Clear Fault Fault A
145. ee Chapter 3 entitled SNP Protocol for SNP message structure and SNP message types modem turnaround 5 seconds currently disabled on Series 90 70 PLCs SNP Data Size You may specify the maximum amount of data allowed in SNP messages via the SNP Parameter Select message see Chapter 5 entitled SNP Parameter Select Message The default and also the maximum allowed for the Series 90 PLC family is Series 90 70 PLC SNP data size 8K bytes Series 90 30 PLC SNP data size 1000 bytes You can also decrease this value if needed for a given application where the minimum allowed is 40 bytes A smaller SNP data message may be useful in an environment where there is noise on the serial link The smaller data messages provide more frequent error checking 8K bytes is the maximum used for Block Transfers transferring Program Logic Blocks 2K bytes is the maximum SNP data size that should be used when reading and writing System Task and Program Block memory within the PLC CPU The 4 timer is not required for Break Free SNP operation GFK 0529C Chapter 2 Configuration 2 3 Chapter 3 GFK 0529C SNP Protocol The Series 90 Protocol SNP message is made up of three parts a header a trailer and data between the header and trailer The following table shows the format of SNP messages Table 3 1 Series 90 Protocol SNP Message Format Byte Number 1 2 3toN 2 N 3 N 4 N 5
146. ee hi et eae 3 12 Table 3 9 Completion ACKnowledge Mailbox Message eese eren nennen 3 13 Table 3 10 Completion ACKnowledge Mailbox Message With Text Buffer eese 3 14 Table 3 11 Error Nack Mailbox Message D1h 3 15 Table 3 12 Major Error Status 3 16 Table 3 13 Minor Error Status Codes General esee nre rennen nennen nene 3 16 Table 3 13 Minor Error Status Codes General continued eee 3 17 Table 3 13 Minor Error Status Codes General continued eene 3 18 Table 3 14 Minor Error Status Codes Program Load and Store Requests esse 3 18 Table 3 15 Text Buffer Message ke eee haee eI Ele Ha Rene 3 19 Table 3 16 Block Transfer Message Format 3 20 Table 3 17 Connection Data Message Format eee 3 2 Table 3 IS8Inquiry Message Format edere ae hue fret Pre ERE egeta ete 3 2 Table 4 1 Acknowledge ACK Message Format 4 1 Table 4 2 Negative Acknowledge NAK Message Format essent 4 2 Table 5 1 SNP Parameter Select Message 5 1 Table 5 2 SNP Parameter Select
147. egrity check of the data received in the message The BCC is calculated over the range of bytes as follows Attach Attach Response Message First byte in the message up to and including the length of next message field in the trailer The BCC is encoded in ASCII hexadecimal and follows the length of next message field in the trailer as most significant ASCII hexadecimal digit followed by least significant ASCII hexadecimal digit All other SNP message types First byte in the message up to and including the status byte field in the trailer 3 2 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C The Block Check Code BCC is calculated as follows assume msg_length Number of bytes in message over which the BCC is calculated p msg ptr Pointer to the first byte start of message char of the message VAR i integer snp_bcc byte BODY i 0 snp bcc 0 while i lt msg_length snp_bcc snp_bcc XOR byte contents at msg_ptr i rotate snp bcc left by 1 8 bit rotate ROTATE HIGH BIT TO LOW BIT itl end while Data Bytes The content and number of data bytes is dependent on the message type specified in the header Each of the SNP message types is described here with an example Notice that all examples are coded as hexadecimal values Attach Message The Attach message is a master only message and must be the first message sent after the long break Th
148. elds within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Service Request code byte 21 16h Datagram ID byte 22 Datagram Type byte 23 Olh Response Mailbox Message for Series 90 30 PLCs Mailbox Type byte 10 94h Dih Total length of data bytes 21 22 Next message type byte 36 43h Next message length bytes 37 38 Response Mailbox Message for Series 90 70 PLCs Mailbox Type byte 10 D4h Dih Next message type byte 36 43h Next message length bytes 37 38 Both the Series 90 30 and 90 70 PLCs Initial Request Mailbox message Update Datagram Datagram connection ID Datagram area to update Normal Update on Request 81h Permanent Update on Request Completion ACK Mailbox message withConnection Data Error Nack Mailbox message Total number of data bytes that are going to be transmitted in all subsequent Connection Data messages for Connection Data Number of bytes in the next Connection Data message Completion ACK Mailbox message Error Nack Mailbox message for Connection Data Number of bytes in the next Connection Data message If the CPU is unable to comply with the request it is rejected In this case a Error Nack Mail box message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message is Insufficient privilege Serie
149. en nnne 6 63 Set Control 6 66 Set Tine Date itia Re eA LO eec 6 69 set PLC State to Run VO Enabled etaed trees e 6 72 Set PLC to Stop I O Enabled etse a dee et eo dece nee pueda 6 74 Valid Toggle Force SMEM Memory eene enne nennen nenne 6 76 Toggle Force System Memory 2 a ios aon tante Ente coe eer een ESL ueque 6 78 Establish Datagram One Point Format eese nennen nennen 6 83 Etablish Datagram Multiple Point Formats eese 6 85 Write Datagram for Series 90 30 PLCs One Point Format eee 6 89 Write Datagram for Series 90 30 PLCs Multiple Point Formats eee 6 91 Write Datagram for Series 90 30 PLCs Multiple Point Formats continued 6 92 Write Datagram for Series 90 70 PLCs One Point Format eee 6 94 Write Datagram for Series 90 70 PLCs Multiple Point Formats sees 6 96 Write Datagram for Series 90 70 PLCs Multiple Point Formats continued 6 97 Update Datagram for Series 90 30 PLCs One Point Format eene 6 100 Update Datagram for the Series 90 30 PLCs Multiple Point 6 102 Update Datagram for Series 90 70 PLCs One Point Format eere 6 104 Update Datagram for Series 90 70 PLCs Multiple Point Formats
150. eptember 1998 GFK 0529C 4 Example of Set PLC State to Stop 1 0 Enabled This example sets the PLC state to Stop mode I O enabled The example assumes that the master has already attached to the slave device has set the privilege level to two 2 and has logged in as the programmer The master sends the Initial Request Mailbox message to the slave with the service request code for Set PLC State 23h and the slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 09 cO 10 3a 00 00 10 0a 00 00 01 01 23 06 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX Xx xx xx xx 09 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 02 xx xx 4c xx 17 00 00 00 00 BCC wait T1 time 4 gt ACK 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 73 6 74 Explanation of Set PLC State to Stop 1 0 Enabled Table 6 30 Set PLC to Stop I O Enabled Packet Byte Number Number s Hex Value Description 1 2 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 09 Sequence number 10 c0 Mailbox type Initial
151. equests since a task name and program block name must be provided in order to determine the correct L memory area to reference There are three fields in the Initial Request Mailbox message common to these six service requests that require detailed explanation Segment Selector Byte field which specifies the memory type to be accessed Refer to Table Reference Data Segment Selector for valid values Chapter 6 Service Requests 6 9 Data Offset Word field least significant byte first followed by most significant byte which specifies an index into the memory type where access is to begin Data Offset is zero based and is defined in terms of bit byte or word depending on the segment selector specified Data Length Word field least significant byte first followed by most significant byte which specifies the length of data to be accessed within the specified memory type Data Length is defined in terms of bit byte or word again depending on the segment selector specified The following examples show the values of these three fields for different modes of access bit byte or word The key items to remember when looking at these examples are that the two fields Data Offset and Data Length are defined in terms of bits bytes or words depending on the segment selector and that the field Data Offset is zero based Examples of BIT access 1 96M3 5 in bit mode Segment Selector 4C Data Offset 22 00 Data Leng
152. er s calculated BCC for the SNP packet doesn t match that passed in the packet The master sends a two byte NAK message to the slave device and waits for the slave to re transmit the SNP packet If the packet still is not received successfully after two retries the master will have to give up and return to its start state 2 The master receives a NAK message from the slave in response to a SNP packet that the master sent to the slave device The slave device is now in a state where it is waiting for the master to re transmit the same SNP packet The master must do so As in the case above if the master SNP packet is NAKed by the slave after two retries the master will have to give up and return to its start state Chapter 4 Integrity Checking and Error Recovery 4 3 Chapter 5 GFK 0529C SNP Parameter Select Message The Series 90 Protocol SNP Parameter Select Message provides you the capability to fine tune your SNP communication link by adjusting the following SNP parameters Timers T2 and T3 and Maximum Data Size There is another field called Queue Depth which must always be set to one 1 in today s implementations This will always hold true for Series 90 30 PLCs but may change in the future on Series 90 70 PLCs to allow the queuing of two or more requests This is the only Mailbox message whose Destination ID is the Slave SNP driver as opposed to the Slave Service Request task The reply to this message is a Mailbox message
153. es that the master has attached to a Series 90 70 PLC slave device and has set the privilege level to two 2 The master sends the Initial Request Mailbox message to the slave with the service request code for Write Task Memory 08h along with the segment selector data offset and data length Once this Mailbox message is acknowledged by the slave the master sends the Text Buffer message containing the main control program name and the data to be written The slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message with Text Buffer Ib 4d 00 00 00 00 00 00 f2 80 10 3a 00 00 10 0a 00 00 00 01 12 00 00 00 00 00 01 01 08 04 26 00 05 00 17 54 1a 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Request Text Buffer message 1b 54 53 54 41 54 5f 31 00 00 9b 4a 63 34 cb la d4 91 c3 8b 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 wait T1 time 5 Completion ACK MB message 1b 4d Xx xx xx xx xx xx f2 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 02 00 00 7c 31 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the example follows Chapter 6 Service Requests 6 25 6 26 Explanation of Write Task Memory Table 6 10 Write Task Memory Packet Byte Number Number s 11 14 15 18 19 20 21 22 28 29 30 31 32 33 34 35 36
154. esponse Slave Only Message Format Byte Size in Number Bytes Description 1 1 Start of message character ESC 1bh 2 1 Message type character 52h for Attach Response 3 10 8 PLC CPU ID in ASCII NUL terminated 11 14 4 SNP timer T1 value in milliseconds encoded as ASCII hexadecimal larger of the master s T1 from the Attach message and the slave s T1 15 18 4 Don t care ignore 19 1 End of block character 17h marks beginning of message trailer 20 1 Next message type 21 22 2 Next message length 23 24 2 BCC coded as ASCII hexadecimal values most significant byte first GFK 0529C Chapter 3 SNP Protocol 3 5 3 6 Attach Response CPU ID Field The responding PLC CPU returns it s CPU ID to the master via this field In the case of a multi drop connection this field is identical to that sent in the Attach message In the direct point to point connection where the master sent all NULs as the CPU ID the return CPU ID in the Attach Response message is the CPU ID of the only PLC CPU on the serial link ASCII null string if the CPU has no ID The same rules concerning valid characters apply for the CPU ID field in the Attach Response message as in the Attach message Attach Response 1 Field The responding slave compares the master T1 time sent in the Attach message to its own T1 time and passes the larger of the two back to the master in the Attach Response message The format of T1 in the Attach Response is
155. est cancels a given Datagram connection area When a Datagram is no longer needed it should be cancelled in order to free memory within the PLC CPU for other uses When the master wishes to use a Datagram connection the Datagram must first be Established and then Written defined Updated to retrieve the current reference data values and finally Cancelled when no longer required Please see the specific sections for each Datagram service request for details Two examples are given for the three requests to Establish Write and Update a Datagram a Datagram connection with one point format and another Datagram connection with multiple point formats Having two examples for the Establish Datagram request may seem redundant at first but it was done to give the reader a better understanding of the computation of the Datagram size field a field within the Establish Datagram Initial Request Mailbox message The Cancel Datagram request has only one example since two examples would indeed be redundant in this case Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Establish Datagram Request The Establish Datagram request together with the Write Datagram request enables the master to specify a fixed set of reference data to be accessed as a group via subsequent Update Datagram requests This allows the user to pick out key reference data not all necessarily of the same memory type and to access the data in
156. estination Master SNP device Packet number total packets Status code 0 okay Don t care Control program number Current privilege level Last sweep time PLC status word End of block character Next message type Next message length Status byte Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Read Task Memory The Read Task Memory Read TMEM request allows the master to access a single contiguous block of data from a PLC Program Task Memory Type It is a Series 90 70 PLC only request and should be used by the SNP user to access data within a Main Control Program Task Data selector namely P memory Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 05h Read Task Memory Segment Selector byte 22 04h Segment Selector 4 for P data Data Offset bytes 23 24 Zero based offset of data Data Length bytes 25 26 Length of data to read in words Program task name bytes 27 34 Main program task name 8 byte NUL terminated ASCII string Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message 94h Completion ACK Mailbox message with Text Buffer Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h or Completion ACK Mailbox message wi
157. ests 6 37 6 38 Explanation of Return Control Program Name Table 6 15 Return Control Program Name Packet Byte Number Number s 1 5 12 13 14 15 16 17 18 Hex Value 10 3a 00 00 10 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 0a 00 00 10 00 00 01 00 45 53 53 33 33 31 00 00 17 00 00 00 00 BCC Description Start of message character Message type for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number Total packets Request code Return Control Program Name Not used End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type M for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK with Text Buffer Mailbox source PLC service request task Mailbox destination Master SNP device Reserved don t care Total length of data in bytes Don t care Packet number Total packets Control program number Current privilege level Last sweep time PLC status word End of block character Next message type for Text Buffer Next message length Status byte Block Check Code Start of message character Me
158. evice has insufficient memory to handle request 51 OCD Attempt was made to read a device but no data has been stored on it 52 OCC Data stored on device has been corrupted and is no longer reliable 53 OCB A comm or write verify error occurred during save or restore 54 OCA Device is write protected 55 0C9 Login using non zero buffer size required for block commands 56 Password s already enabled and cannot be forced inactive 57 Passwords are set to inactive and cannot be enabled or disabled 58 Control Program CP tasks exist but requestor not logged into main CP 59 No task level Rack Slot configuration to read or delete 60 Verify with FA Card or EEPROM failed 61 0C3 Text length does not match traffic type 62 0C2 The OEM key is NULL inactive 63 Invalid block state transition 64 0CO Bad OMF record checksum in store 65 OBF Illegal OMF record type data contents Chapter 3 SNP Protocol 3 18 Table 3 13 Minor Error Status Codes General continued Decimal Hex Description 66 OBE Bad Block Type given in Load Store 67 0BD Block Set subblock name not found 68 OBC Block Type e g data not found 69 OBB Maximum length of a partial store exceeded 70 OBA Block Set already exists cannot create 71 OB9 Executable flag in TYPDEF record not set 72 OB8 Size of the Segment Selector Table in TYPDEF record is not correct 73 0B7 Segment length in Verify not equal to
159. example follows GFK 0529C Chapter 6 Service Requests 6 65 Explanation of Set Control ID Table 6 27 Set Control ID Packet Byte Number Number s Hex Value 1 10 3a 00 00 10 0a 00 00 33 33 31 30 31 41 00 00 00 00 00 00 00 3 3 4 XX XX 5 7 XX XX XX 8 XX 9 bc 10 d4 11 14 10 0a 00 00 15 18 10 3a 00 00 19 01 20 01 21 00 22 28 XX XX XX XX XX XX XX 29 00 30 04 31 32 00 00 33 34 4c 20 35 17 36 00 37 38 00 00 39 00 40 BCC Description Start of message character Message type for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number Total packets Request code Set CPU Controller ID Controller ID 33101A Not used End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK Mailbox source PLC service request task Mailbox destination Master SNP device Packet number Total packets Status code 0 okay Don t care Control program number Current privilege level Last sweep time PLC status word End of block character Next message type Next message length Status
160. f the Attach message did not make it over the link successfully the slave will never answer with an Attach Response and the master should retry the attach sequence transmit a long break followed by an Attach message If the master receives an Attach Response message with errors it should also retry the attach sequence Both the acknowledgement ACK and negative acknowledgment NAK are two byte messages with the following formats Table 4 1 Acknowledge ACK Message Format Byte Number Sizein Bytes Code Description 1 1 06 Acknowledge 2 1 00 Reserved for future use The long break is not required for Break Free SNP operation GFK 0529C 4 1 Table 4 2 Negative Acknowledge Message Format Byte Number Size Bytes Code Description 00 BCC error or Parity error 01 Overrun or Framing error 02 Sequence error 03 Bad Next Message Length Next Message Length exceeds size allowed with the currently defined SNP Maximum Data Size Block Check Code BCC As already described in previous sections a BCC is included in every SNP packet to provide an integrity check on the data in the packet Each side as it receives a SNP packet should calculate the BCC for the packet and compare the calculated BCC to that passed in the packet The two values must match If they do not match a NAK message with the error code set to zero must be sent by the device that received the packet to
161. fer M in Bit Mode Packet Byte Number Number s Hex Value Description 1 3 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 02 Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 21 04 Request code Read System Memory 22 4c Segment Selector M data in bit mode 23 24 62 00 Data offset 0062h 98 zero based M99 25 26 Ob 00 Data length 000bh 11 bits 27 34 00 00 00 00 00 00 00 00 Not used 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 02 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 XX Don t care 23 24 90 13 Data returned M99 through M109 25 28 XX XX XX XX Don t care 29 00 Control program number 30 04 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word
162. ffer Next message length in bytes 0092h 146 Status byte Block Check Code GFK 0529C Chapter 6 Service Requests 6 53 Table 6 23 Return 1 0 Fault Table continued 6 54 Packet Byte Number Number s Hex Value Description 5 1 1b Start of message character 2 54 Message type for Text Buffer 3 8 53 20 12 07 06 90 Time Stamp for last time I O fault table was cleared 12 20 53 on Jun 7 1990 9 10 03 00 Faults since last clear 0003 11 12 03 00 Total faults in table 0003 13 14 03 00 Faults returned in this response 0003 Start of Fault Entry Number 1 15 XX Spare bytes don t care 16 18 ff 00 00 Reference address 19 00 Rack number 20 03 Slot number 21 7f I O Bus Number 22 7f Bus address 23 24 ff 7f Point address 25 03 Fault Group Loss of or Missing I O Module 26 02 Fault Action Diagnostic 27 Fault Category 28 00 Fault Type 29 00 Fault description 30 50 XX XX XX XX XX XX XX XX XX XX XX Don t care XX XX XX XX XX XX XX XX XX XX 51 56 21 55 12 07 06 90 Time error logged 12 55 21 Jun 7 1990 Start of Fault Entry Number 2 57 XX Spare bytes don t care 58 60 ff 00 00 Reference address 61 00 Rack number 62 06 Slot number 63 7f I O Bus Number 64 7f Bus address 65 66 ff 7f Point address 67 07 Fault Group Addition of or Extra I O module 68 02 Fault Action Diagnostic 69 of Fault Category 70 00 Fault Type 71 00 Fault description 72
163. g with the segment selector data offset and data length Once this Mailbox message is acknowledged by the slave the master sends the Text Buffer message containing the main control program name the program block name and the data to be written The slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message with Text Buffer Ib 4d 00 00 00 00 00 00 f2 80 10 3a 00 00 10 0a 00 00 00 01 12 00 00 00 00 00 01 01 09 00 06 00 01 00 17 54 1a 00 00 wait T1 time 2 06 00 wait T1 time 3 Request Text Buffer message 1b 54 53 54 41 54 5f 31 00 00 53 55 42 31 00 00 00 00 a2 84 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 wait T1 time 5 Completion ACK MB message 1b 4d XX XX XX Xx xx xx f2 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 02 00 00 7c 31 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 31 Explanation of Write Program Block Memory Table 6 12 Write Program Block Memory Packet Byte Number Number s Hex Value 1 1 1b 2 4d 3 4 00 00 5 7 00 00 00 8 00 9 f2 10 80 11 14 10 3a 00 00 15 18 10 Oa 00 00 19 20 00 01 21 22 12 00 23 26 00 00 00 00 27 28 01 01 29 09 30 00 31 32 06 00 33 34 01 00 35 17 36 54 37 38 la 00 39 00 40 BCC g
164. ge from the other device and T3 time is exceeded before any part of the message is received i e no character was received within T3 time a loss of communication is assumed and the device goes back to its start state Once any part of a message is received T3 time must elapse after the last character was received before the receiving device may assume loss of communication This timer is used by both the master and the slave The T4 timer is not required for Break Free SNP operation Series 90M PLC SNP Communications User s Manual September 1998 GFK 0529C The following table shows the defaults for all five timers for Series 90 30 PLCs Series 90 70 PLCs and Logicmaster 90 LM90 master device used to communicate with the Series 90 PLCs via SNP Table 2 1 Series 90 PLC Timer Defaults Logicmaster 90 Series 90 30 PLC Series 90 70 PLC T1 10 ms 5 ms 5 ms modem turnaround modem turnaround T3 80 character times 10 seconds based on baud rate 50 ms N A 500 ms when modem turnaround time is not equal to zero The SNP data size refers to the number of data bytes allowed in one SNP Data message A SNP Data message is one of the three SNP message types Text Buffer message Block Transfer message or Connection Data message All other SNP message types have a fixed size and therefore are not affected by the SNP data size The SNP data size does not include the message header and trailer s
165. gon Programs Storing Protocol Half Duplex 2 1 Protocol Point to Point 2 1 Queue Depth 5 2 R Read PBMEM 6 2116 27 PLC 6 8 Program Block Memory Register 1 11 6 11 6 11 System Memory 6 11 Read Write Reference Data Repeater Converter Request Mailbox 3 8 Request Piggy Back Information 3 11 Return Control Date 6 43 Fault Table 6 46 PLC ID 6 39 PLC Type Program Name 6 43 Return Control pe 1 7 Return Time RS lt 106 gt 232 A 1 RS lt 106 gt 422 RS 485 Interface A 2 Index Index Segment Selector 6 8 6 9 Sequence Errors Serial Link 2 1 Serial Parameters 2 1 Serial Port Cable Diagrams A 19 Converter A 8 IBM AT XT Series 90 PLC A 4 Workmaster Service Requests Cancel Datagram Change Privilege Clear Fault Table Control Type and ID Datagram Date 1 7 6 93 Establish Datagram 6 81 Loading and Storing Logon Read and Write Return Fault Table Short Status 1 7 Store Programs Update Datagram 6 98 Update Real lt 106 gt Time Datagram 6 110 Write Datagram Session Layer Set Control ID Date 6 67 Override PLC State 1 8 State Run Stop 6 70 Time 6 67 Short Status Slave SMEM SMEM Read SMEM Types 6 76 SMEM Write SNP Protocol Retries 4 3 SNP Data Size 2 3 SNP
166. hat specifies the length of data to access The last four bytes are repeated as necessary until all point formats are defined Response Mailbox Message Mailbox Type byte 10 Completion ACK Mailbox message Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response to an Write Datagram request is Insufficient privilege Series 90 70 PLCs only must be level 1 or higher Unable to locate specified Datagram ID Examples with full explanations follow GFK 0529C Chapter 6 Service Requests 6 67 Example of Write Datagram for the Series 90 30 PLCs One Point Format This example defines the reference data for Datagram ID five 5 The example assumes that the master has already issued the Establish Datagram request and that the PLC returned a Datagram Connection ID of five 5 The definition specifies one point format inputs 11 to 6I112 This group of inputs spans 14 bytes The segment selector used is the I byte mode the point offset is Zero and the point length is 14 bytes The master sends the Initial Request Mailbox message with Connection Data to the slave with
167. he Datagram connection area is always one byte regardless of the point length GFK 0529C Chapter 6 Service Requests 6 79 6 80 Once a Datagram Connection Area is established and defined the values of reference data from different memory types defined in the Datagram Connection Area may be accessed via one service request Multiple Datagram connections may be created the maximum number is limited by the amount of memory available within the PLC CPU to store the Datagram information There are four PLC CPU Datagram service requests Establish Datagram Request This request informs the PLC CPU the size in bytes required for a Datagram Connection Area for this Datagram including the size of all the data which will be returned by future Update Datagram requests The PLC CPU reserves the needed space assigns the Datagram connection area a unique ID and passes this ID back to the master This ID is used in all subsequent Datagram service requests that deal with this particular Datagram connection area Write Datagram Request This request defines the Datagram header and point formats that go into the Datagram connection area Update Datagram Request Once a Datagram has been established and defined via Establish Datagram and Write Datagram requests respectively the user may issue the Update Datagram request as needed to retrieve the values of the reference data defined in the Datagram connection area Cancel Datagram Request This requ
168. he piggy back status information After the master acknowledges the Mailbox message the slave transmits a Connection Data message containing the values of the reference data MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 71 cO 10 00 00 10 Oa 00 00 01 01 16 02 01 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 ACK 06 00 wait T1 time 3 lt Completion ACK MB message 1b 4d XX XX Xx xx xx xx 71 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 01 00 00 7c 31 17 43 26 00 00 BCC wait T1 time 4 ACK 06 00 wait 1 time 5 lt Response Connection Data message 1b 43 02 xx xx xx 18 00 19 22 05 12 71 43 98 21 65 70 97 12 12 31 cd 1a 65 24 74 36 90 12 39 67 17 00 00 00 00 BCC wait T1 time 6 2 ACK 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 105 6 106 Explanation of Update Datagram for Series 90 70 PLCs Multiple Point Formats Table 6 42 Update Datagram for Series 90 70 PLCs Multiple Point Formats Packet Byte Number Number s Hex Value Description 1 35 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 71 Sequence number 10 cO Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18
169. he request The Change Privilege Level service request enables the master to change its access privilege level to the PLC CPU provided that you know the password s of the level s you are changing Read and Write PLC Memory The master can read and write all reference data I WQ T M 96S G MR WAI WAQ P and L via the Read Write System Memory service requests and the Read Write Program Block Series 90 70 PLCs only service requests A single contiguous block of data can be accessed from one memory type via these Read Write service requests 1 6 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C PLC Short Status The Short Status request allows the master to retrieve information on control program tasks which control program tasks have programmers currently logged into them and the state of the programmer window i e open or closed This last piece of information is applicable to Series 90 70 PLCs only since the programmer window on Series 90 30 PLCs cannot be closed Return Control Program Name This request returns the number of control program tasks in the PLC CPU and the name of each program task There is always one control program in Series 90 30 PLCs it may be just the default empty program Series 90 70 PLCs may have none or just one in today s current implementation Return Controller TYPE and ID This service request returns the PLC CPU controller ID the Major type and Minor type
170. here the maximum number is limited by the amount of memory available within the PLC CPU to store the Datagram information Series 90 M PLC SNP Communications User s Manual September 1998 GFK 0529C Brief Introduction to the SNP Protocol GFK 0529C Note The SNP Protocol has been revised to support Break Free SNP Break independent operation improves serial communications using modems as certain modems alter the timing of the break or interpret it as a modem command Firmware for Series 90 CPUs is being updated to incorporate Break Free SNP If your SNP master implementation is based on break free operation verify that all SNP slaves have been updated to support Break Free SNP The master transmits a long break as the first step in establishing a communication session with a given PLC A communication session can only be established with one PLC at a time The long break generates a hardware interrupt on all the CPUs on the serial link In response to the long break all CPUs initialize and set up their communication hardware to wait for an Attach message from the master The Attach message specifies which CPU the master wishes to establish the communication session with Only that CPU will respond to the master with the Attach Response message and all other CPUs on the serial link go back to an idle state KEY TO FLOW DIAGRAMS timing 244502 Master message transmitted to Slave VY Master test decision
171. hose units are bit The example assumes that the master has already attached to the slave device and the discrete points at M97 through M112 have the following values Reading M99 through M109 inclusive returns the two bytes 90 13 where M97 M104 90h and 105 M112 13h M109 M99 EPRI ESR EES ER EERE EERE The master sends the Initial Request Mailbox message to the slave with the service request code for Read System Memory 04h along with the segment selector data offset and data length The slave responds with a Completion ACK Mailbox message which contains the data requested and includes the piggy back status information It should be noted that all bits not requested within a byte are returned as zero regardless of their true state MASTER SLAVE wait T1 time 1 gt Initial Request MB message 1b 4d 00 00 00 00 00 00 02 cO 10 3a 00 00 10 0a 00 00 01 01 04 4c 62 00 0b 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 c Completion ACK MB message 1b 4d XX xx xx xx xx xx 02 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx 90 13 xx xx xx xx 00 04 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 06 00 A full explanation of the SNP messages used in the example follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Explanation of Read SMEM no Text Buffer M in Bit Mode Table 6 5 Read SMEM no Text Buf
172. igher Not logged in as a programmer Series 90 30 PLCs only Invalid length six characters for Series 90 30 PLCs seven for Series 90 70 PLCs NUL terminated Invalid characters Series 90 30 PLCs are restricted to 0 through 9 and A through F inclusive An example with full explanation follows Note For Series 90 30 PLCs with Release 1 x CPU firmware privilege level 4 is required 6 64 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Set Control ID This example sets the CPU Controller ID to 33101A The example assumes that the master has already attached to the slave device has set the privilege level to three 3 and has logged in as the programmer The master sends the Initial Request Mailbox message to the slave with the service request code for Set CPU Control ID 22h and the slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 bc cO 10 00 00 10 00 00 01 01 22 33 33 31 3031 41 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx bc d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 04 00 00 4c 20 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the
173. ilbox Type Completion ACK with Text Buffer Mailbox Source ID PLC service request task Mailbox Destination ID master SNP device Don t care ignore Always one 1 Text buffer data length in bytes Don t care ignore Packet Number Total Packets Control program number Current privilege level Last sweep time PLC status word End of block character Next message type must be 54h 42h or 43h for T B or C respectively Next message length Status byte Block Check Code BCC Series 90 M PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Error Nack Mailbox Message If the PLC CPU is unable to comply with the service request made in the Initial Request Mailbox message perhaps due to bad parameters insufficient privilege etc an Error Nack Mailbox message is sent back to the master An error code is included in the Error Nack Mailbox message to inform the master why the Initial Request Mailbox message has been rejected The following table shows the format of the Error Nack Mailbox message The Error Nack Mailbox message Mailbox Type D1h is shown in the following table Table 3 11 Error Nack Mailbox Message D1h Format Byte Size in Number Bytes Value Description 1 1b Start of message character 2 1 4d Message type character 4dh for Mailbox 3 4 2 XX XX Don t care ignore 5 7 3 XX XX XX Time Stamp 8 1 XX Don t care ignore 9 1 XX Sequence Number
174. int Connection If you have a host device equipped with a RS 422 interface the RS 232 RS 422 converter is not required you can connect directly to the PLC WORKMASTER II SERIES 90 70 PLC a44498 Figure 1 3 RS 422 Point to Point Serial Connection to Series 90 70 PLC WORKMASTER II a44499 SERIES 90 30 PLC Figure 1 4 RS 422 Point to Point Serial Connection to Series 90 30 PLC Series 90 PLC Modem Serial Link The serial communications link between devices may be through a modem for longer distances WORKMASTER I SERIES 90 70 PLC 244501 P MODEM MODEM RS 232 RS 422 CONVERTER LI 1 31 T T 4 RS 422 Figure 1 5 Point to Point Modem Serial Link Connection for Series 90 PLCs Series 90 M PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Multidrop Series 90 PLC Serial Connection In the multidrop configuration the host device is configured as the master and one or more PLCs are configured as slaves Figure 1 6 illustrates a multidrop connection with conversion capability only Figure 1 7 illustrates a multidrop connection having isolation repeater and converter capabilities For detailed information and example multidrop connections refer to Appendix A Serial Port and Cables WORKMASTER II SERIES 90 70 PLC a44500
175. ions there will be no contention when transmitting upstream as long as devices tri state their drivers when idle and turn them on only when they have something to transmit This is the case for the Series 90 70 and Series 90 30 CMMs In complex multidrop configurations however special steps must be taken to switch the upstream transmitters of the Isolated Repeater Converter Switching Upstream Transmitters For the RS 422 drivers to be active at the J2 port of the Isolated Repeater Converter the RTS input at J1 must be true The state of the RS 422 drivers at the J1 port depends on the position of the switch on the unit When the switch is in the center position the J1 transmitters will always be turned on When the switch is in the CTS position toward the power cable then either the RS 232 or RS 422 CTS signal must be true to turn on the drivers Note Note the position of the switch on the Isolated Repeater Converter in the system configurations below A 14 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Simple Multidrop Configuration This configuration shows how to connect a single Isolated Repeater Converter for signal conversion or greater distance a44927 RS 232 RS 422 RS 422 CABLE A CABLE B CABLE D 1 4 SERIES 90 PLC HOST sw ON SERIES 90 PLC OR 1 SERIES 90 PLC x BRICK IS THE NICKNAME FOR THE ISO
176. is zero and the point length is 14 bytes The master sends the Initial Request Mailbox message to the slave with the service request code for Write Datagram 48h and the Datagram Connection ID After the slave acknowledges the Mailbox message the master sends the Connection Data message containing all the parameter data The slave responds with a Completion ACK Mailbox message which contains the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message 1b 4d 00 00 00 00 00 00 6e cO 10 3a 00 00 10 0a 00 00 01 01 48 01 01 00 00 00 00 00 00 00 00 00 00 00 17 43 1e 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Request Connection Data message 1b 43 01 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 01 00 10 00 00 0e 17 00 00 00 00 BCC wait T1 time 4 lt ACK 06 00 wait T1 time 5 lt Completion ACK MB message 1b 4d XX XX XX XX xx xx 6e d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 01 00 00 7c 31 17 00 00 00 00 BCC wait T1 time 6 gt ACK 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 93 6 94 Explanation of Write Datagram for Series 90 70 PLCs One Point Format Table 6 37 Write Datagram for Series 90 70 PLCs One Point Format Packet Byte Number Number s Hex Value Description 1 1 1b Start of message character 2 4d Message type M for Mailbo
177. ith a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message response is Insufficient privilege must be level 2 or higher An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 67 Example of Set Time Date The following example assumes that the master has already attached to the slave device has set the privilege level to two 2 and wishes to set the time to 15 27 37 3 27 37 pm and set the date to Thursday May 10 1990 The master sends the Initial Request Mailbox message to the slave with the service request code for Set PLC Time Date 24h and the slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 04 cO 10 00 00 10 Oa 00 00 01 01 24 01 37 27 15 10 05 90 05 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx 04 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 04 00 00 4c 20 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 A full explanation of the SNP messages used in the example follows 6 68 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Explanation of Set Time Date Table 6 28 Set Time Date Packet Byte Number Numbe
178. k 19 20 0001 Reserved first byte zero second byte one 21 22 6a 02 Total length of data in bytes 026ah 618 23 26 00 00 00 00 Reserved must be set to zero 27 28 0101 Packet number total packets 29 3f Request code Program Store 30 05 Block Type 5 Declaration Block 31 32 00 00 Block Offset MUST be set to ZERO 33 34 6a 02 Block Length 026ah 618 bytes 35 17 End of block character 36 42 Next message type B for Block Transfer 37 38 72 02 Next message length 626 bytes 39 00 Status byte 40 BCC Block Check Code 9 1 1b Start of message character 2 42 Message type B for Block Transfer 3 620 xx 618 Declaration block bytes 618 decimal bytes 621 17 End of block character 622 00 Next message type 623 624 00 00 Next message length 625 00 Status byte 626 BCC Block Check Code 1l lt 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 99 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 0101 Packet number total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 03 Current privilege level 31 32 00 00 Last sweep time 33 34 5c 20 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next
179. lave PLC CPU compares this value to its own T3 value and passes the greater of the two back to the master Whatever value is returned to the master in the T3 field must be the T3 time used throughout this connection session Maximum Data Size The master passes a packet data size defined in bytes to the slave This value reflects the maximum bytes allowed in the data portion of a SNP packet 1 does not include the header and trailer bytes The slave PLC CPU compares this value to its own Maximum Data Size allowed and passes the lesser of the two back to the master Whatever value is returned to the master in the Maximum Data Size field must be the Maximum Data Size value used throughout this connection session Maximum Queue Depth The value of the Maximum Queue Depth for Series 90 30 PLCs is always one 1 For Series 90 70 PLCs the current implementation is only one 1 Future enhancements may allow Queue Depth to be increased but in today s implementation it must be set to one The SNP protocol provides you the capability to disable the T2 wait for ACK timeout and T3 link idle timeout timers If the master wants to disable these timeouts the master sends a SNP Parameter Select Message to the slave with either or both the T2 and T3 fields set to zero One timer cannot be disabled independently of the other both are disabled if either time field in the SNP Parameter Select Message is zero Parameter Select Example 5
180. lbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 0101 Packet number total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 Tc 31 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Write Datagram for the Series 90 70 Multiple Point Formats This example defines the reference data for Datagram ID two 2 We assume the master has already issued the Establish Datagram request and the PLC returned a Datagram Connection ID of two This example defines the following reference data to be included in Datagram area two RO5 RO9 five words R41 R43 three words T17 T48 four bytes M33 M64 four bytes The master sends the Initial Request Mailbox message to the slave with the service request code for Write Datagram 48h and a Datagram Connection ID of two After the slave acknowledges the Mailbox message the master sends the Connection Data message containing all the parameter data The slave responds with a Completion ACK Mailbox message which contains the piggy back status information Master Slave wait T1 time 1 Initial Request MB
181. le Force System Memory This example toggles the state of discrete input bit 29 9129 which is currently overridden It assumes that the master has already attached to the slave device and has set the privilege level to two 2 The master sends the Initial Request Mailbox message to the slave with the service request code for Toggle Force System Memory 44h and the slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 32 cO 10 00 00 10 Oa 00 00 01 01 44 46 1c 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX XX xx xx xx 32 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 02 00 00 54 20 17 00 00 00 00 BCC wait T1 time 4 gt gt ACK 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 77 6 78 Explanation of Toggle Force System Memory Table 6 32 Toggle Force System Memory Packet Byte Hex Value Description Number Number s 1 5 1 16 Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 32 Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master
182. lect Message The SNP Parameter Select message contains information for the slave SNP task only and therefore has a Destination ID of slave SNP task 10 3e 00 00 Refer to Chapter 5 SNP Parameter Select Message for details In the Completion ACK mailbox messages both with and without Text Buffers the Destination ID field always becomes the Master SNP device 10 3a 00 00 The Source ID field becomes the Service Request task 10 0a 00 00 except in the previously mentioned case of the SNP Parameter Select message where the Source ID field would become that of the slave SNP task 10 3e 00 00 In other words what was the Source ID in the Initial Request Mailbox message becomes the Destination ID in the Completion ACK Mailbox message and what was the Destination ID in the Initial Request Mailbox message becomes the Source ID in the Completion ACK Mailbox message Packet Number Total Packets Both these fields have no real meaning within SNP messages and should always be set to one 1 The following sections describe the format of the five Mailbox message types Initial Request Mailbox Messages The master uses Initial Request Mailbox messages containing PLC service requests to send commands or data to the PLC and to request data from the PLC If the service request parameter data is thirteen bytes or less an Initial Request Mailbox message without a Text Buffer Mailbox Type COh is sufficient If however the data in the master s servic
183. llows the master to set the internal time and date of the PLC CPU Set PLC State The Set PLC State service request allows the master to change the execution state of the PLC The allowable choices are Run mode with I O enabled Run mode with I O disabled Series 90 70 only Stop mode with I O enabled Stop mode with I O disabled Toggle Force System Memory This service request allows the master to change the bit state of status override and transition bit memory to their opposite state Storing and Loading Logic Programs To and From the PLC Logic programs on Series 90 30 PLCs consist of logic blocks and declaration blocks on Series 90 70 PLCs logic programs consist of logic blocks declaration blocks and data blocks There are Program Load and Program Store service requests on Series 90 30 PLCs and Program Block Load and Program Block Store requests on Series 90 70 PLCs Datagrams The Datagram service requests enable the master to obtain reference data values for one or more PLC memory types via a single service request An area of memory which will reside within the PLC CPU called a Datagram Connection Area must first be established Establish Datagram request and defined Write Datagram request Once this is done the values of the reference data from different memory types defined in the Datagram connection area may be accessed via one service request Update Datagram request Multiple Datagram connections may be created w
184. long break and to set up to receive the Update Real Time Datagram message The Update Real Time Datagram request is used to access the data specified within a given Datagram Connection area The current values for all point formats defined within the given Datagram area are returned to the master There is a key difference in the mailbox type of the response Mailbox message between Series 90 30 PLCs and Series 90 70 PLCs The Series 90 30 PLC s response Mailbox Type is 94h and the Series 90 70 PLC s response Mailbox Type is D4h In both cases the Mailbox message trailer specifies a Next Message Type of 43h for Connection Data After the master acknowledges the Mailbox message the slave transmits one or more Connection Data messages containing the current values for all point formats The Update Real Time Datagram message contains the CPU ID of the slave PLC CPU where the specified Datagram Connection area resides Refer to the description of the CPU ID field used in the Attach message explained earlier in this manual The Update Real Time Datagram message also contains the Datagram ID of the datagram connection area The Datagram ID specifies a particular permanent datagram connection area in the PLC CPU The permanent datagram must have been established in the PLC CPU prior to the sending of the Update Real Time Datagram message The long break and T4 timer are not required for Break Free SNP implementations Series 90 PLC SNP C
185. ltiple Text Buffer messages may be necessary to transfer all the data The number of Text Buffer messages required to transfer some number of bytes depends on the SNP Data Size allowed in a SNP Data message For example suppose the SNP Data Size has been set to 200 bytes via a SNP Parameter Select message and the master reads 800 bytes of discrete data The slave responds to the master s request with a Completion ACK Mailbox message with Text Buffer 94h followed by four Text Buffer messages Suppose 850 bytes of discrete data are read then five Text Buffer messages are required to transfer all the data bytes Series 90 M PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C The Mailbox message that precedes a Text Buffer message s has a word field that contains the total number of data bytes to be transferred The Next Message Type field in the Mailbox message s trailer is equal to 54h for T and the Next Message Length field in the Mailbox message s trailer equals the number of data bytes contained in the next message the Text Buffer message After this Mailbox message is transmitted one or more Text Buffer messages are transmitted until all data bytes have been transferred The following table shows the format of the Text Buffer message where N is the number of data bytes contained in the message Table 3 15 Text Buffer Message Format Byte Number Bytes Description 1 1 Start of message character ES
186. m with overall shield Catalog Numbers Belden 9505 Belden 9306 Belden 9832 These cables provide acceptable operation for data rates up to 19 2 Kbps as follows RS 232 50 feet 15 meters maximum cable length RS 422 4000 feet 1200 meters maximum length Isolation at the remote end may be used to eliminate Common Mode voltages At shorter distances under 50 feet 15 meters almost any twisted pair or shielded twisted pair cable will work as long as the wire pairs are connected correctly When using RS 422 the twisted pairs should be matched so that both transmit signals make up one twisted pair and both receive signals make up the other twisted pair If this is ignored cross task resulting from the mismatching will affect the performance of the communications system When routing communication cables outdoors transient suppression devices can be used to reduce the possibility of damage due to lightning or static discharge Care should be exercised that all connected devices are grounded to a common point Failure to do so could result in damage to the equipment GFK 0529C Appendix A Serial Port and Cables A 3 Series 90 PLC Serial Port A 4 The Series 90 PLC serial port is compatible with RS 422 A RS 232 to RS 422 converter is required to interface to systems that provide RS 232 compatible interfaces The Series 90 PLC RS 422 serial port provides the physical connection for SNP communication This port is a 15 pin D
187. mber 1998 GFK 0529C Explanation of Program Load for Series 90 30 PLCs Table 6 45 Program Load for Series 90 30 PLCs Packet Byte Number Number s Hex Value Description 1 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 2b Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 20 0101 Packet number total packets 21 40 Request code Program Load 22 00 Block Type 0 Logic Block 23 24 00 00 Block Offset 0 start with first byte 25 26 00 00 Block Length 0 return entire block to host 27 34 00 00 00 00 00 00 00 00 Not used 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 2b Sequence number 10 94 Mailbox type Completion ACK with Block 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 XX Reserved don t care 20 01 21 22 83 00 Block Transfer data size in bytes 23 26 XX XX XX XX Don t care 27 01 Packet number 28 01 Total packets 29 00 Control
188. message Ib 4d 00 00 00 00 00 00 c0 10 00 00 10 00 00 01 01 48 02 01 00 00 00 00 00 00 00 00 00 00 00 17 43 2a 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Request Connection Data message 1b 43 02 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 04 00 08 04 00 05 08 28 00 03 14 02 00 04 16 04 00 04 17 00 00 00 00 BCC wait T1 time 4 ACK 06 00 wait T1 time 5 lt Completion ACK MB message 1b 4d XX XX XX XX Xx d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 01 00 00 7c 31 17 00 00 00 00 BCC wait T1 time 6 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 95 6 96 Explanation of Write Datagram for Series 90 70 PLCs Multiple Point Formats Table 6 38 Write Datagram for Series 90 70 PLCs Multiple Point Formats Packet Byte Number Number s Hex Value Description 1 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 6e Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 20 0101 Packet number total packets 21 48 Request code Write Datagram 22 02 Datagram connection ID 23 01 Normal Datagram 24 34 01 00 00 00 00 00
189. message length 39 00 Status byte 40 BCC Block Check Code GFK 0529C Chapter 6 Service Requests 6 123 Appendix A Serial Port and Cables This appendix describes the serial port converters and cables used to connect Series 90 PLCs for Series 90 Protocol SNP This information is included for reference and for those users who have applications that require cable lengths different than the factory supplied cables What this Appendix Contains GFK 0529C Information in this section includes Communication Interfaces Cable and Connector Specifications Serial Port Configuration RS 232 RS 422 Converter Catalog No IC690ACC900 or IC690ACC901 RS 422 Isolated Repeater RS 232 Converter Catalog No IC655CCM590 Serial Cable Diagrams Point to Point Connection Multidrop Connection Cable Termination 1 Section 1 RS 422 RS 485 Interface and Cabling Information The RS 485 Interface The Series 90 PLC family of products are compatible with EIA RS 422 or RS 485 specifications RS 485 drivers and receivers are utilized to accomplish communications between several system components using multiple driver receiver combinations on a single cable with four twisted pairs The total cable length cannot exceed 4000 feet A multidrop system of a driver and 8 receivers can be configured The maximum common mode voltage between each additional drop is the RS 485 standard of 12 Volts to 7 Volts The driver output must be ca
190. munications User s Manual September 1998 GFK 0529C Explanation of Programmer Logon for Series 90 30 PLC Table 6 25 Series 90 30 PLC Programmer Logon 1 22 28 31 32 33 34 35 36 37 38 39 40 Packet Byte Number Number s Hex Value 10 3a 00 00 10 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 XX XX XX XX XX XX 22 d4 10 0a 00 00 103a 00 00 01 01 00 XX XX XX XX XX XX XX 00 01 00 00 5c 20 17 00 00 00 00 BCC Description Start of message character Message type 2 M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request Mailbox source Master SNP device Mailbox destination PLC service request task Packet number Total packets Request code Programmer logon Logon mode in this case logon serial Task name NULL Not used in 90 30 End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type 2 M for Mailbox Reserved don t care Time Stamp Reserved don t care Sequence number Mailbox type Completion ACK Mailbox source PLC service request task Mailbox destination Master SNP device Packet number Total packets Status code 0 okay Don t care Control program number Current privilege level Last sweep time PLC status word End of block character Next messag
191. n I O Module Software Failure 17 Program Block Checksum Mismatch 18 Low Battery in the PLC CPU 19 Constant Sweep Exceeded 20 PLC Fault Table Full 21 I O Fault Table Full 22 User Application Fault 128 System Bus Failure 129 No User s Program on Power up 130 Corrupted User s Ram Detected on Power up 131 Window Completion Failure in Constant Sweep Mode i e all windows failed to receive their allotted time 132 Password Access Failure 133 Genius Block Address Mismatch with User Configuration Reference Address 134 NULL System Configuration for RUN Mode 135 PLC CPU Software Failure 136 More than the allowable number of I O Bus Controllers were found in the system 137 Communication failure during a store operation by the programmer Examples with full explanations follows 6 48 Series 90M PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Return PLC Fault Table This example retrieves all faults in the PLC fault table The example assumes that the master has already attached to the slave device and has changed the privilege level to one 1 The master sends the Initial Request Mailbox message to the slave with the service request code equal to Return Fault Table 38h and the Fault Table Type field specified as PLC fault table The slave responds with a Completion ACK Mailbox message which includes piggy back status information After the master acknowledges the Mailbox message the slave
192. n the follows values 81 23h T113 39h T89 89h T121 10h T97 76h T129 23h T105 46h T137 45h 145 87h T177 34h T153 90h T185 12h 161 72h T193 78h 169 41h T201 56h The master sends the Initial Request Mailbox message to the slave with the service request code equal to Read System Memory 04h along with Segment Selector Data offset and Data Length After the slave successfully receives the mailbox message the master sends the Text Buffer message containing the data to write The Text Buffer message contains 16 bytes of data to be stored in T81 through T208 The slave responds with a Completion Ack Mailbox message which contains piggy back status information MASTER wait T1 time 1 Initial Request MB message with Text Buffer 1b 4d 00 00 00 00 00 00 98 80 10 3a 00 00 10 0a 00 00 00 01 10 00 00 00 00 00 01 01 07 14 0a 00 10 00 17 54 18 00 00 BCC wait T1 time 3 Request Text Buffer message 1b 54 23 89 76 46 39 10 23 45 87 90 72 41 34 12 78 56 17 00 00 00 00 BCC wait T1 time 6 06 00 SLAVE wait T1 time 2 06 00 wait T1 time 4 ACK 06 00 wait T1 time 5 Completion ACK MB message 1b 4d XX XX XX xx xx xx 98 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 02 00 00 5c 20 17 00 00 00 00 BCC A full explanation of the SNP messages used in the example follows Chapter 6 Service Requests Explanation of Write SME
193. nations follow GFK 0529C Chapter 6 Service Requests 6 3 Example of Change Privilege Level with No Password This example changes the master s privilege level to four 4 The example assumes that the master has already attached to the slave device and that there are no active passwords See the next example for a case where there are passwords active and the correct password must be provided in order to change the level The master sends the Initial Request Mailbox message with the service request code for Change Privilege Level 21h along with the desired level to the slave and the slave responds with a Completion ACK Mailbox message which includes the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 04 cO 10 00 00 10 00 00 01 01 21 04 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message 1b 4d XX XX Xx xx xx xx 04 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 04 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 gt ACK 06 00 A full explanation of the SNP messages used in the example follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Explanation of Change Privilege Level With No Password Table 6 2 Change Privilege Level With No Password Packet Byte Number Number s Hex Value Description 1 1
194. ne control program is currently allowed this byte is either zero or one Login Types bytes 25 26 Set of 2 bit codes indicating the type of login associated with each control program The two bit field beginning at bit 0 corresponds to control program 0 Since there can be at most one control program in the current implementation only bit 0 and bit 1 have meaning See table below for definition Series 90 70 PLC only Auxiliary Status byte 27 Only the highest bit is defined and only for the Series 90 70 Bit 7 gt Programmer window status 0 Programmer window closed Programmer window open Table 6 13 Two bit Login Type Codes Value Description 03h Parallel Work Station Interface WSI attached 02h Serial device attached at PLC CPU Olh Non dedicated programmer attached 00h No programmer attached An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 33 Example of PLC Short Status Request The following example issues a Short Status Request to the PLC CPU The example assumes that the master has already attached to a Series 90 30 PLC slave device The master sends the Initial Request Mailbox message to the slave with the service request code for Short Status request 00h and the slave responds with a Completion ACK Mailbox message which includes the piggy back status information and other status information mentioned above MASTER SLAVE wait T1 time 1
195. nnection internal 4 position terminal block e Fused 1 Amp power protection e Power ON green indicator LED e Three position toggle switch recessed in the back of the unit is set according to System Configurations later in this section GFK 0529C Appendix A Serial Port and Cables 11 Logic Diagram of the Isolated Repeater C onverter The figure below provides a functional look at the unit Note the 3 position switch for controlling the J1 port transmitters This switch will be discussed in System Configurations later in this section a44782 OPTICAL RS 422 RS 232C ae ISOLATION J2 SD RS 232C LY qn o o pcdes Vac as RESISTOR 3 2 E re aS rT IN AN ene gt ANEAN YN YN 2 2 gt 2 SE ISOLATED SE 95 2320 115 3 SUPPLIES VAC Figure A 7 RS 422 IsolatedRepeater RS 232 Converter Logic Diagram Note All inputs on the unit are biased to the inactive state Inputs left Figure A 7 RS 422 Isolated RS 422unconnected will produce a binary 1 OFF state on the corresponding output A 12 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Pin Assignments for the Isolated Repeater C onverter J1 RS 422 Port J2 RS 422 RS 232 Port 25 pin female connector 25 pin female connector
196. ns to the master in one or more Text Buffer messages The number of Text Buffer messages required depends on the amount of data being read and the maximum data size allowed in a SNP Data message An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 21 Example of Read Task Memory This example reads the five words of P data at P39 through P43 belonging to the main control program task STAT_1 The current values of P39 through P43 are P39 4A9Bh P40 3463h P41 1ACBh P42 91D4h P43 8BC3h The example assumes that the master has attached to a Series 90 70 PLC slave device and has set the privilege level to one 1 The master sends the Initial Request Mailbox message to the slave with the service request code for Read Task Memory 05h along with the segment selector data offset data length and the main control program task name The slave responds with a Completion ACK Mailbox message containing the piggy back status information followed by a Text Buffer message containing the requested P data MASTER SLAVE wait T1 time 1 Initial Request MB message with Text Buffer 1b 4d 00 00 00 00 00 00 f1 cO 10 00 00 10 0a 00 00 01 01 05 04 26 00 05 00 53 54 41 54 5 31 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 lt Completion ACK MB message 1b 4d XX XX Xx xx xx xx f1 94 10 0a 00 00 10 3a 00 00 xx 01 0a 00 xx xx xx xx 01 01 XX XX XX XX XX XX 17
197. nsmission of one message and the transmission of the first character of the next message It is the minimum amount of time the sending device master or slave must wait before transmitting either a message or an acknowledgement This timer is used by both the master and the slave T1 time must account for the worst case time for the sending device to turn the link around and set up to be a receiving device including any modem turn around time T2 T2 is the maximum amount of time that the sending device master or slave will wait for an acknowledgement to the message that it just transmitted The first character of the acknowledgement must be received within T2 time after the last character of the message is sent or else it is assumed that there has been a loss of connection and the device goes back to its start state The start state for the master is a state in which required conditions for establishing a communication session based on the user s given application are fulfilled This timer is used by both the master and the slave T3 T3 is the maximum link idle time It is used only by the master to determine when to force a message over the link in order to prevent the slave from timing out due to lack of activity on the serial link T3 T3 is the link idle timeout time After the last character of an acknowledge is sent the first character of the next message must be transmitted within T3 time If one device is waiting for a messa
198. o access memory areas within the PLC e Read System Memory request e Write System Memory request e Read Task Memory e Write Task Memory e Read Program Block Memory request e Write Program Block Memory request Simply stated these requests allow the user to read and write reference data i e 1 Q T R WL etc Discrete data may be accessed as bit data or byte data Registers Analog I O Local Subblock Data and Program Block Data may be accessed as word data only Each possible access mode bit byte or word for all reference memory types is assigned a distinct segment selector You may think of segment selector as a type of addressing scheme Table lists the reference data segment selectors accessible to the SNP user along with the size of the corresponding memory type on a per model basis Read requests to the memory types within this table require a privilege level of 1 or higher and write requests require a privilege level of 2 or higher It should be noted that the S Discrete are READ ONLY Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C 4 Table 6 4 Reference Data Segment Selectors Selector Access Mode Memory Type Decimal Hex Discrete Inputs 1 70 46 bit 16 10 byte Discrete Outputs Q 72 48 bit 18 12 byte Discrete Temporaries T 74 4A bit 20 14 byte Discrete Internals M 76 4 bit 22 16 byte SA Discrete 78 4E bit 24 18 byte SB Di
199. of Update Datagram for Series 90 70 PLCs One Point Format Table 6 41 Update Datagram for Series 90 70 PLCs One Point Format Packet Byte Number Number s Hex Value Description 1 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 71 Sequence number 10 cO Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 20 0101 Packet number total packets 21 16 Request code Update Datagram 22 01 Datagram Connection ID 23 01 Normal Datagram 24 34 01 00 00 00 00 00 Not used 00 00 00 00 00 00 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 1 1b Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 71 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 0101 Packet number total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 7 31 PLC status word 35 17 End of block ch
200. of the most common causes of communication failure For best performance construct the cable assemblies according to the recommended connector parts and specifications Table A 1 Connector Cable Specifications Item Description Series 90 PLC Serial RS 422 port with metric hardware Connector 15 pin male D Subminiature Type Cannon 158 solder pot Hood AMP 207470 1 connector shell Hardware Kit AMP 207871 1 Kit includes 2 metric screws and 2 screw clips Workmaster II Serial RS 232 port with standard RS 232 connector Mating Connectors Connector 25 pin female D Subminiature Type Cannon DB25S solder pot with DB110963 3 hood or equivalent standard RS 232 connector Workmaster Serial RS 232 port with standard RS 232 connector Connector 9 pin female D Subminiature Type Cannon DEOS solder pot with DE110963 1 hood or equivalent standard RS 232 connector IBM AT XT Serial RS 232 port with standard RS 232 connector Connector 9 pin female D Subminiature Type Cannon DEOS solder pot with DE110963 31 hood or equivalent standard RS 232 connector RS 232 RS 422 Converter one 15 pin male and one 25 pin male connector 15 pin male connector requires metric hardware same connector hood and hardware as for Series 90 PLC listed above 25 pin male D Subminiature Type Cannon DA25S solder pot with DB110963 3 hood or equivalent standard RS 232 connector Cable Computer grade 24 AWG minimu
201. oller Type and ID Table 6 17 Return Control Type and ID Packet Byte Number Number s Hex Value Description 1 gt Start of message character Message type M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request 10 3a 00 00 Mailbox source Master SNP device 10 0a 00 00 Mailbox destination PLC service request task Packet number Total packets Request code Return control Type and ID 00 00 00 00 00 00 Not used 00 00 00 00 00 00 00 End of block character Next message type Next message length Status byte Block Check Code 3 lt Start of message character Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 65 Sequence number 10 94 Mailbox type Completion ACK with Text Buffer 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 XX Reserved don t care 20 01 21 22 28 00 Total length of data in bytes 23 26 XX XX XX XX Don t care 27 01 Packet number 28 01 Total packets 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 4c 20 PLC status word 35 17 End of block character 36 54 Next message type for Text Buffer 37 38 30 00 Next message length 39 00 Status byte 40 BCC Block Check Code GFK 0529C Chapter 6 Service Requests 6 41
202. ommunications User s Manual September 1998 GFK 0529C Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 2 55h Update Real Time Datagram message CPU ID bytes 3 10 CPU ID 8 bytes maximum Datagram ID byte 11 Datagram ID Must be established as a permanent datagram Block Check Code bytes 23 24 Block Check Code coded in 2 byte ASCII hex as in Attach message Response Mailbox Message for Series 90 30 PLCs Mailbox Type byte 2 94h Completion ACK Mailbox message with Connection Data Dih Error NACK Mailbox message Total length of data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Connection Data messages Next message type byte 36 43h C for Connection Data Next message length bytes 37 38 Number of bytes in the next Connection Data message Response Mailbox Message for Series 90 70 PLCs Mailbox Type byte 2 D4h Completion ACK Mailbox message Dih Error NACK Mailbox message Next message type byte 36 43h C for Connection Data Next message length bytes 37 38 Number of bytes in the next Connection Data message Both the Series 90 30 and 90 70 PLCs If the CPU is unable to comply with the request it is rejected In this case a Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message is e Ins
203. on Block The master must store both blocks in order to have a complete user program stored in the PLC memory Therefore two Program Store service requests are required one to store the Logic Block from the master to the slave and one to store the Declaration Block from the master to the slave Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 80h Initial Request Mailbox message with Block Transfer Total Length of data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Block Transfer messages Service Request code byte 29 3fh Program Store Block Type byte 30 0 Logic Block Declaration Block Block Offset bytes 31 32 Should always be set to zero Block Length bytes 33 34 Length in bytes of the block being stored The master knows what this value is by having done a Program Load for the block type Next message type byte 36 42h _ B for Block Transfer Next message Length bytes 37 38 Number of bytes in the next Block Transfer message Request Block Transfer Message All user program data Logic or Declaration data is transmitted to the slave in one or more Block Transfer messages The number of Block Transfer messages required depends on the amount of user program data to store in the PLC and the maximum data size allowed in a SNP Data message Response Mailbox Message Mailbox Type byte 10 D4h Completion AC
204. ost is when the brick is used as a converter RS 232 at the slave The switch is in the right position CTS Appendix A Serial Port and Cables A 15 Rule 2 If a Series 90 CMM slave device is located downstream of a brick set the configuration of the CMM serial port to NONE flow control with a 10 ms Modem Turnaround Delay Applies to CCM SNP and SNP X protocols only Rule 3 Do not place more than 3 bricks in a single communication path between the host and the slave devices Cable Diagrams A 16 The cable diagrams below are referred to as Cables A E from the system configurations in the previous figures These diagrams show the principles for constructing your own cables and can be modified to fit your specific application a44929 J Jt PIN HN 2 SW ON TD 2 0 0 0 RD 3 0 0 e RIS 4 1 00 0 CIS 5 0 DO ies E 00 ISOLATED 0 SERIES 90 lt Pih E O 0 0 REPEATER 0 SHLD 1 0 0 CONVERTER 0 0 BRICK 0 0 0 0 0 0 0 0 0 0 0 ie 0 0 j M 25 PIN 25 PIN 25 PIN 25 PIN FEMALE MALE MALE FEMALE NOTE PIN ASSIGNMENTS CORRESPOND TO SERIES 90 CMM MODULE PIN ASSIGNMENTS MAY DIFFER FOR OTHER HOST DEVICES Figure A 10 Cable A RS 232 Device To Converter 844930 J2 RI e ES SW ON 7 7 Aaa TA 0 SD A 9 16 RD Go 0 0 SD B 21 1 x X 11 17 RD 0 0 RD A 13 od bg 15 SD A 0 0 RD B 25 r1 11 14 SD B 0
205. ox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 6e Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 0101 Packet number total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 Tc 31 PLC status word 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code Chapter 6 Service Requests 6 97 Update Datagram The Update Datagram request is used to access the data specified within a given Datagram Connection area The current values for all point formats defined within the given Datagram area are returned to the master There is a key difference in the mailbox type of the response Mailbox message between Series 90 30 PLCs and Series 90 70 PLCs The Series 90 30 PLC s response Mailbox Type is 94h and the Series 90 70 PLC s response Mailbox Type is D4h In both cases the Mailbox message trailer specifies a Next Message Type of 43h for Connection Data After the master acknowledges the Mailbox message the slave transmits one or more Connection Data messages containing the current values for all points formats Refer to the description directly below Key fi
206. pable of 1 5 V minimum into 60 ohms The driver output impedance must be at least 120 K ohms in the high impedance state The receiver input resistance is 12K ohms or greater Receiver sensitivity is 200 millivolt Care must be taken that common mode voltage specifications are met Common mode conditions that exceed those specified will result in errors in transmission and or damage to Series 90 PLC components Constructing RS 422 RS 485 Cables When connecting the Series 90 CMM modules to a non Series 90 device using the RS 422 RS 485 standard the non Series 90 device s line receiver must contain fail safe capability This means that in an idle open or shorted line condition the output of the line receiver chip must assume the marking state When using RS 422 RS 485 the twisted pairs should both be matched so that both transmit signals make up one twisted pair and both receive signals make up the other twisted pair The CMM is supplied with a 120 Ohm terminating resistor in each RS 422 receiver circuit If the module is at either end of an RS 422 multidrop or point to point link pin 25 the RD signal must be connected directly to pin 24 the internal 120 ohm terminating resistor If the module is an intermediate drop in the multidrop link this connection should not be made A 2 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Cable and Connector Specifications The cable assembly presents one
207. program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 4c 20 PLC status word 35 17 End of block character 36 42 Next message type for Block Transfer 37 38 8b 00 Next message length 39 00 Status byte 40 BCC Block Check Code 5 1 1b Start of message character 2 42 Message type B for Block Transfer 3 133 xx 131 Logic block bytes 131 decimal bytes 134 17 End of block character 135 00 Next message type 136 137 00 00 Next message length 138 00 Status byte 139 BCC Block Check Code GFK 0529C Chapter 6 Service Requests 6 117 Table 6 45 Program Load for Series 90 30 PLCs continued Packet Byte Number Number s Hex Value Description 7 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 2c Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 20 0101 Packet number total packets 21 40 Request code Program Load 22 05 Block Type 5 Declaration Block 23 24 00 00 Block Offset 0 start with first byte 25 26 00 00 Block Length 0 return entire block to host 27 34 00 00 00 00 00 00 00 00 Not used 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length
208. r Converter and the PLC for J1 and the Isolated Repeater Converter and the host computer for J2 Pin 7 of the J1 port is connected to the metal shell of the J1 connector Pin 7 of the J2 port is connected to the metal shell of the J2 connector These two signal ground connections are isolated from each other and are isolated from the power system ground green wire on the terminal block To maintain proper isolation these signal grounds cannot be tied together System Configurations The figures below show various ways you can connect the Isolated Repeater Converter to convert signals expand the number of drops and obtain greater distance Any system configuration can be reduced to a minimum number of cables each covering a part of the overall system configuration The example system configurations below refer to these cables as Cables A D shown in Cable Diagrams later in this section Downstream and Upstream Contention In this section simple multidrop configurations are those where a single Isolated Repeater Converter is used Complex multidrop configurations contain one or more multidrop sections where an Isolated Repeater Converter is included as one of the drops In both simple and complex multidrop configurations the transmitters directed downstream from the master can be on at all times There will be no contention for the communication line because only one device the master transmits downstream In simple multidrop configurat
209. r s Hex Value Description 1 1 1b Start of message character 2 4d Message type for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 04 Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 01 Packet number 20 01 Total packets 2 24 Request code Set PLC Time Date 22 01 Time Data mode 1 set both 23 37 Seconds in packed BCD 24 27 Minutes in packed BCD 25 15 Hour in packed BCD 26 10 Day in packed BCD 27 05 Month in packed BCD 28 90 Year in packed BCD 29 05 Day of week 30 34 00 00 00 00 00 Not used 35 17 End of block character 36 00 Next message type 37 38 00 00 Next message length 39 00 Status byte 40 BCC Block Check Code 3 lt 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 04 Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 01 Packet number 20 01 Total packets 21 00 Status code 0 okay 22 28 XX XX XX XX XX XX XX Don t care 29 00 Control program number 30 04 Current privilege level 31 32 00 00 Last sweep time 33 34 4c 20 PLC status word 35 17 End of block character 36 00 Next mess
210. r table in Read and Write System Memory section for values Point offset Zero based offset into memory area defined by the segment selector word field least significant byte followed by most significant byte the unit of offset is determined by the segment selector specified each segment selector has an implicit access type either bit byte or word Point length Length of data to be accessed byte field the units of length is deter mined by the segment selector specified each segment selector has an implicit access type either bit byte or word Each word access takes up two bytes within the connection area and each byte and bit access takes up one byte within the connection area One special note needs to be made concerning bit data bit mode Datagrams are supported only by Series 90 30 PLCs The maximum point length for bit mode point formats is eight 8 Furthermore all bits within the point format from point offset to point offset plus point length inclusive must lie within a single byte For example bits I1 through 18 are in the same byte Byte boundaries start at I1 19 96117 1 8 1 where n is any positive integer The corresponding bit mode point offsets are 0 8 16 8n A bit mode point format with a point offset of eight 8 could have a point length of 1 to 8 but a point offset of nineteen 19 could only have a point length in the range of 1 to 5 The size of bit mode data within t
211. rvice Requests Service requests made via Initial Request Mailbox messages are the means through which the master transfers data to the PLC CPU and reads data from the PLC CPU and issues commands to the PLC CPU Some of the service requests require a minimum privilege level before the request can be honored and some require that the master device be logged in to the Programmer Communication Window The following table lists the service requests available to a user who is writing a master SNP implementation and the minimum privilege level and login requirements for each Table 6 1 SNP Service Requests GFK 0529C Privilege Level min Service Request Series 90 30 PLC Series 90 70 PLC Logged In Change Privilege Level 1 0 NO Read System Memory 1 1 NO Read Task Memory n a 1 NO Read Program Block Memory n a 1 NO Write System Memory 2 2 NO Write Task Memory n a 2 NO Write Program Block Memory n a 2 NO Toggle Force System Memory 2 2 NO Programmer Logon Logoff 1 0 NO Return Fault Table 1 1 NO Clear Fault Table 2 2 YES Return Control Program Name 1 0 NO Return Controller Type and ID 1 1 NO Return PLC Time Date 1 1 NO PLC Short Status 1 0 NO Set Controller ID 35 3 YES Set PLC Time Date 2 2 NO Set PLC State 2 2 YES Establish Datagram 1 1 NO Write Datagram 1 1 NO Update Datagram 1 1 NO Cancel Datagram 1 1 NO Program Load 1 n a YES Program Store 3 n a YES Program Block Store n a 3 YES Progr
212. s In the point to point configuration only two devices can be connected to the same communication line The communication line can be directly connected using RS 232 50 feet 15 meters maximum or RS 422 4000 feet 1200 meters maximum Modems can be used for longer distances Note The cable connector for the Series 90 70 and Series 90 30 PLCS serial port must be a right angle connector in order for the hinged door on the module to close properly Refer to Table A 1 Connector Cable Specification In configurations where ground potentials may exist between components ground isolation must be provided Ground potential differences between non isolated components will result in errors in transmission and or damage to components GFK 0529C Appendix A Serial Port and Cables A 19 A 20 RS 232 Point to Point Connections The next three figures illustrate typical RS 232 point to point connection to Series 90 PLCs IC690CBL705 OR EQUIVALENT RS 232 RS 485 RS 422 a44506 RS 232 CONVERTER TWISTED SHIELDED SHIELDED PAIRS IC690ACC900 PAIRS PIN PIN IWORKMASTER IL RS 232 PORT 2 3 0 1 2 3 9 5 8 6 4 5 7 1 25 PIN 25 PIN 25 PIN 25 PIN 15 PIN 15 PIN MALE FEMALE MALE FEMALE FEMALE MALE RS 232 RS 485 PORT PORT POWER SOURCE FOR POINT TO POINT CONNECTION 10 FEET 3 METERS ONLY CONVERTER POWER SOURCE BEYOND 10 FEET 3 METERS AND FOR MULTIDROP CONNECTION MUST BE EXTERNAL SOURCE TERMINATION RESISTANCE FOR THE RECE
213. s 90 PLC This layer is described in detail in Chapters 3 4 and 5 Application Layer The Application Layer consists of the requests called Service Requests which the master issues to the PLC to read or write data within the PLC load program logic from the PLC and store program logic to the PLC or issue commands to the PLC such as starting or stopping the PLC The application layer is described in detail in Chapter 6 The remaining sections in this chapter briefly describe the Service Requests available to the SNP user and the SNP protocol Chapter 1 Introduction 1 5 Service Requests Available to the SNP User Once a SNP serial communication session is established between the master and a slave via a defined attach sequence a variety of requests called service requests can be initiated by the master to read or write data within the PLC load program logic from the PLC and store program logic to the PLC or issue commands to the PLC such as starting or stopping the PLC All the service requests have a minimum privilege level which the master must be at in order to make the request In addition to the privilege level requirement some service requests such as those involved with loading and storing logic programs require the master to be logged on as a programmer The word logon or programmer logon should not be confused with attach the master must always be attached to a PLC before you can issue any service request you m
214. s One Point Format PacketN Byte umber Number s Hex Value Description D 1 1b Start of message character 2 55 Message type U for Update Real Time Datagram 3 10 00 00 00 00 00 00 00 00 CPU ID of destination PLC CPU 11 05 Datagram ID 12 18 00 00 00 00 00 00 00 Not used 19 17 End of block character 20 22 00 00 00 Not used 23 24 BCC2 Block Check Code special two byte ASCII encoded BCC for this message calculated over bytes 1 22 Same BCC used in Attach message 3 1 1b Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 00 Sequence number 10 94 Mailbox type Completion ACK with Connection Data 11 14 10 0a 00 00 Mailbox source PLC service request task 15 18 10 3a 00 00 Mailbox destination Master SNP device 19 20 XX XX Reserved don t care 21 22 Oe 00 Connection Data size in bytes 23 26 XX XX XX XX Don t care 27 28 0101 Packet number total packets 29 00 Control program number 30 01 Current privilege level 31 32 00 00 Last sweep time 33 34 52 20 PLC status word 35 17 End of block character 36 43 Next message type for Connection Data 37 38 1c 00 Next message length in bytes 001ch 28 39 00 Status byte 40 BCC Block Check Code 5 lt 1 16 Start of message character 2 43 Message type for Connection Data 3 05 Datagram Connection ID 4 6 XX XX XX Don t care 7 8 Oe 00 Point definition size 9 22 87
215. s and electrical signals Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Using this Manual This chapter provides an introduction to the SNP serial protocol touching briefly on the main topics that are discussed in later chapters The main topics of general discussion in this chapter include e Communications Architecture e SNP Service Requests e GE Fanuc Master SNP Driver e Introduction to SNP Protocol e Definition of Terms e Documentation Conventions Before you use this manual you should become familiar with the special terms acronyms and abbreviations that are used throughout Also you should become familiar with the common documentation notations For an explanation of these terms and conventions refer to the last portion of this chapter page 1 12 for a Definition of Terms and page 1 13 for the Documentation Conventions Communications Architecture GFK 0529C It is useful to think of the SNP environment as divided into three parts a Configuration Layer a communication Session Layer and an Application Layer Configuration Layer The Configuration Layer consists of serial setup data baud rate parity etc and protocol timers This layer is described in detail in Chapter 2 Session Layer The communication Session Layer deals with the format of SNP messages the SNP message types and establishing and maintaining a communication session between the master device and a Serie
216. s 90 70 PLCs only must be level 1 or higher Unable to locate specified Datagram ID Response Connection Data Message The point data is returned to the master via a Connection Data message The number of Connection Data messages returned to the master depends on the amount of point data being accessed and the maximum data size allowed in a SNP Data message Datagram Connection ID byte 3 Number of reference data bytes bytes 7 8 Reference Data 9 N Examples with full explanations follow Series 90M PLC SNP Communications User s Manual September 1998 ID of Datagram area being returned Number of reference data bytes that follow The remaining data bytes contain the values of the reference data for all point formats within the Datagram area The number of bytes that go with a given point format depends on the layout specified in the Write Datagram request GFK 0529C 4 Example of Update Datagram Request for the Series 90 30 PLCs One Point Format This example requests an update of reference data defined in Datagram ID five 5 Datagram ID five has already been established and defined as containing one point format that spans 11 to 1112 The reference data through I112 is currently set as follows 101 87h 125 98h 149 86h 173 22h 197 71h 109 23h 133 21h 157 09h 181 05h 1105 43h 117 23h 141 34h 165 19h 189 12h The master sends the Initial Request Mailbox message
217. s not match the Next Message Type from the trailer of the previous message or after a SNP device has turned the link around next message type in the trailer of the last packet equals zero the next message type received from the other device was not a Mailbox message For example suppose the slave receives a Mailbox message from the master whose next message type field in the trailer is set to 54h The slave expects the next SNP packet from the master to have a message type of T But the next SNP packet from the master has a message type of M 4Dh This constitutes a sequence error and instead of receiving an ACK message the master will receive a NAK message with the error code set to two 2 Sequence Errors are fatal to the current connection session When either SNP device detects a sequence error it transmits the NAK message and then returns to its start state As previously stated sequence errors are fatal and no retries are attempted If however the NAK message is due to a BCC error or data transmission errors error code in NAK message equals 0 or 1 then the transmission of the message should be attempted again If either side receives a NAK to a SNP packet it has just transmitted with an error code of 0 or 1 then that side must re transmit the SNP packet There are two scenarios from the master point of view 1 Master has received a SNP packet from a slave and has detected some error for example the mast
218. s the capability of adjusting parameters in the communications link Service Requests Explains the SNP service requests and includes programming examples and explanations Serial Port and Cables Describes the serial port converter and cables used to connect to the Series 90 PLCs At GE Fanuc Automation we strive to produce quality technical documentation After you have used this manual please take a few moments to complete and return the Reader s Comment Card located on the next page iii Chapter 1 Chapter 2 Chapter 3 GFK 0529C Contents Introduction eee ea L7 1 RS 422 Point to Point Connection esses 1 2 Series 90 PLC Modem Serial Link 1 2 Multidrop Series 90 PLC Serial 1 3 sing this Manual 1 aee e e ae te itla a nte gets 1 5 Communications Architecture enne 1 5 Contigiration ettari ertt Ere EVEN PERRO SEE Ee ERR 1 5 Session et e eris 1 5 Application Layer ese 1 5 Service Requests Available to the SNP User esee 1 6 Change Privilege Level entere te 1 6 Read and Write PLC Memory eese eene nennen een eene 1 6 Short Status tetti tete e ER HER GEI Ee ERR HEC ede IER EXE REESE ERR
219. s the type of message that the transmitting device will send next When a given side either the master or the slave has completed a given sequence of messages this byte must be set to zero to signal the receiver that this is the last message of the sequence and the link should be turned around In other words it is now the other side s turn to transmit data Next Message Length This field is a word where the least significant byte is transmitted first followed by the most significant byte If the Next Message Type byte is non zero then this word must contain the number of bytes contained in the message that will follow this one This value includes ALL bytes in the next message header trailer and data bytes If you are turning the link around i e Next Message Type is zero then you must set this word to zero Status Byte This byte is currently used only in the Attach and Attach Response messages Except for the Attach Attach Response messages this field is ignored and is typically set to zero by all Series 90 SNP implementations If the message is an Attach or Attach Response this byte will be the most significant ASCII hexadecimal digit of the BCC The Block Check Code see next item in trailer for these two messages are encoded in ASCII hexadecimal and therefore take two bytes whereas all other messages Block Check Codes are binary values and use only one byte Block Check Code BCC The BCC is used as an int
220. sage Service Request code byte 21 20h Logon Logoff request code Log mode byte 22 2 Login Serial Mode 3 Logout mode used to logout from a program task 4 Logout bye mode used when connection is going to be broken Program Task Name bytes 23 30 8 byte NUL terminated ASCII string or 8 NULs if logon to Null task Block Transfer Buffer Size bytes 31 32 Series 90 70 PLC only Used to specify the maximum communication buffer size in bytes during program load and store that the master SNP device can support Must contain a non zero positive number On Series 90 30 PLCs there is no difference between logout mode and logout bye mode so you can use either value when logging out of the programmer window On Series 90 70 PLCs you should use logout mode to log out of a given control program task Logout bye mode is used if it is known that the communication session is going to be broken i e a long break is going to be issued in order to do housekeeping within Series 90 70 PLCs The Block Transfer Buffer Size is a Series 90 70 PLC field only The GE Fanuc LM90 WSIB programmer implementation uses a communications buffer size of 16K in its logon request Since the current implementation of the Series 90 70 PLC CPU family allows a maximum 8K program Block Transfer buffer the Series 90 70 PLC returns 8K back to LM90 in the response Mailbox message and 8K is the agreed upon Block Transfer Buffer Size between the two de
221. screte 80 50 bit 26 1A byte SC Discrete 82 52 bit 28 1 byte S Discrete 84 54 bit 30 1E byte Genius Global Data G 86 56 bit 56 38 byte Analog Inputs AI 10 0 word Analog Outputs AQ 12 0 word Registers R 08 08 word Local Subblock Data L 90 70 only 00 00 word Program Block Data P 90 70 only 04 04 word The maximum addressable ranges for each memory type depends on the model of CPU and memory configuration Except for Program Block Data P and Local Subblock Data L all memory types within this table are accessed via the service requests Read System Memory and Write System Memory The P and L memory types exist only in Series 90 70 PLCs The P memory is global data accessible to all program blocks within a control program task One task s P memory is not accessible to any other task The L memory type is data local to a particular program block within a control program task You can read and write P data with either the Read Task Memory and Write Task Memory service requests or the Read Program Block Memory and Read Program Block Memory service requests Only a task name is required to determine the correct P memory to reference Therefore the Read Write Task Memory service requests are preferred since they reduce the number of messages needed to access the data To read and write L data you must use the Read Program Block Memory and Write Program Block Memory service r
222. set of rules that establishes and maintains a serial communications link between a Master host device running the master implementation of the SNP protocol and a Slave PLC SNP is a Master Slave protocol where the master initiates all communications and the slave responds to the master s requests There is no peer to peer capability with the SNP protocol The purpose of this manual is to describe the master side of the SNP protocol so that you can write a master implementation to run on a host device e g a Workmaster an IBM PC a Macintosh etc enabling you to communicate with the PLC SNP is a half duplex protocol that uses the RS 485 enhanced version of RS 422 electrical interface Several system configurations are possible There may be just one PLC on the serial link direct point to point port connection or there may be many Series 90 PLCs on a serial link multi drop port connection Only one SNP master may be on a multi drop link SNP also supports communication over modems The following figures illustrate some of the possible master slave device connections WORKMASTER II SERIES 90 70 PLC a44496 eee RS 232 RS 422 CONVERTER Figure 1 1 RS 232 RS 422 Point to Point Serial Connection to Series 90 70 PLC WORKMASTER II a44497 SERIES 90 30 PLC RS 232 RS 422 CONVERTER Figure 1 2 RS 232 RS 422 Point to Point Serial Connection to Series 90 30 PLC 1 1 1 2 RS 422 Point to Po
223. set to zero 9 6e Sequence number 10 80 Mailbox type Initial Request with Connection Data 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 20 00 01 Reserved first byte zero second byte one 21 22 16 00 Connection Data size in bytes 0016h 22 23 26 00 00 00 00 Reserved must be set to zero 27 28 0101 Packet number total packets 29 48 Request code Write Datagram 30 05 Datagram connection ID 31 01 Normal Datagram 32 34 00 00 00 Not used set to zero 35 17 End of block character 36 43 Next message type for Connection Data 37 38 le 00 Next message length in bytes 001 30 39 00 Status byte 40 BCC Block Check Code 3 5 1 1b Start of message character 2 43 Message type C for Connection Data 3 05 Datagram Connection ID 4 6 00 00 00 Reserved must be set to zero 7 8 10 00 Point definition size in bytes 0010h 16 9 16 00 00 00 00 00 00 00 00 Program block name 17 18 00 00 Program block segment 19 20 01 00 Number of point formats 0001 21 10 I memory in byte mode 22 23 00 00 Point offset 0 gt I1 24 Point length 14 bytes 25 17 End of block character 26 00 Next message type 27 28 00 00 Next message length 29 00 Status byte 30 BCC Block Check Code 5 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 Xx Reserved don t care 9 6e
224. ssage type for Text Buffer Number of programs 0001 Program name ESS331 End of block character Next message type Next message length Status byte Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Return Controller Type and ID Information The PLC Return Controller Type and ID Information Request allows the master to obtain information that may be necessary to the logon sequence such as the PLC CPU controller ID and the Major and Minor type of the PLC CPU Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 43h Return Controller Type and ID information Response Mailbox Message Mailbox Type byte 10 94h Completion ACK Mailbox message with Text Buffer Total length of data byte 21 22 Total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Next message type byte 36 54h for Text Buffer Next message length bytes 37 38 Number of bytes in the next Text Buffer message Response Text Buffer Message CPU controller ID Bytes 3 10 PLC Series 90 Major Type Byte 11 see table below PLC Series 90 Minor Type Byte 12 see table below Number of Control programs Byte 13 Reserved spare byte Byte 14 Main Control Program Name Bytes 15 22 Number of Program Blocks Bytes 23 24 Total Length of Program
225. stablish Datagram request is Insufficient privilege Series 90 70 PLCs only must be level 1 or higher An example with full explanation follows GFK 0529C Chapter 6 Service Requests 6 81 6 82 Example of Establish Datagram One Point Format The master wants to set up a Datagram area that accesses the discrete inputs I1 to 1112 This group of inputs spans 14 bytes The point format data takes four bytes segment selector point offset and point length and the fixed portion of the Datagram area takes 12 bytes program block name program block segment and number of point formats The Datagram Size required is 12 plus 4 plus 14 or 30 bytes The master sends the Initial Request Mailbox message to the slave with the service request code for Establish Datagram 15h the Datagram Type field set to Update on Request 01 and the Datagram Size set for 30 1eh bytes The slave responds with a Completion ACK Mailbox message which contains a Datagram ID of five 5 along with the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 cO 10 00 00 10 Oa 00 00 01 01 15 01 1e 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message b 4d XX XX XX xx xx xx 6d d4 10 0a 00 00 10 3a 00 00 01 01 00 xx 05 xx xx xx xx xx 00 01 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 4 gt ACK 0
226. t 1 1b 2 54 3 10 53 54 41 54 5f 31 00 00 11 18 53 55 42 31 00 00 00 00 19 20 a2 84 21 17 22 00 23 24 00 00 25 00 26 BCC 5 1 1b 2 4d 3 4 XX XX 5 7 XX XX XX 8 XX 9 f2 10 d4 11 14 10 0a 00 00 15 18 10 3a 00 00 19 20 0101 21 00 22 28 XX XX XX XX XX XX XX 29 00 30 02 31 32 00 00 33 34 7 31 35 17 36 00 37 38 00 00 39 00 40 BCC Description Start of message character Message type M for Mailbox Reserved must be set to zero Time Stamp Reserved must be set to zero Sequence number Mailbox type Initial Request with Text Buffer Mailbox source Master SNP device Mailbox destination PLC service request task Reserved first byte zero second byte one Total length of data in bytes 0012h 18 Reserved must be set to zero Packet number total packets Request code Write Program BLock Memory Segment Selector L memory Data offset 6 word offset for L7 Data length 1 word End of block character Next message type T for Text Buffer Next message length in bytes 001 26 Status byte Block Check Code Start of message character Message type for Text Buffer Control Program name STAT_1 Program Block name SUBI Data to write to L7 gt 84a2h End of block character Next message type Next message length Status byte Block Check Code Start of message character Message type 2 M for Mailbox Reserved don t care Time Stamp Reserved don t care Seq
227. t code byte 21 03h Return Control Program Name s Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Series 90 70 PLCs only 94h Completion ACK Mailbox message with Text Buffer Total length of data bytes 21 22 Number of data bytes in all subsequent Text Buffer messages only applicable with MB type 94h Next message type byte 36 54h for Text Buffer only applicable with MB type 94h Next message length bytes 37 38 Number of bytes in the next Text Buffer message only applicable with MB type 94h A Series 90 30 PLC CPU always has one and only one control program Therefore a Completion ACK Mailbox message with Text Buffer is always the response Within the Text Buffer message the Number of Control Programs field is always one 1 followed by the Program Name ASCII Null string if no program has been entered Such is not the case on Series 90 70 PLCs there may be no control program task in which case a Completion ACK Mailbox message with no Text Buffer is the response otherwise if there are one or more maximum of 8 control program tasks a Completion ACK Mailbox message with Text Buffer is returned with the necessary information Response Text Buffer Message Number of Control Programs bytes 3 4 Program Name bytes 5 12 gt max 8 byte name An example with full explanation follows 6 36 Series 90 PLC SNP Communications User s Manual September 199
228. t of character ESC through and including Next Message Length Series 90M PLC SNP Communications User s Manual September 1998 GFK 0529C Mailbox Message The Mailbox message is the main means through which the master issues requests to the slave and receives the slave s responses Once the communication session is established a Mailbox message must precede all other message types Text Buffer messages Block Transfer messages and Connection Data messages which collectively are referred to as SNP Data Messages All Mailbox messages have 40 bytes 8 bytes of header and trailer 32 bytes of data and take one of two forms depending on whether or not the amount of data being passed requires the use of a Text Buffer SNP utilizes five principal Mailbox message types Initial Request Mailbox message COh Initial Request Mailbox message with Text Buffer 80h Completion ACK Mailbox message D4h Completion ACK Mailbox message with Text Buffer 94h Error Nack Mailbox message Dih The Program Block Load and Program Block Store service requests for Series 90 70 PLCs utilize additional mailbox types For details refer to the section in Chapter 6 Service Requests A quick description of key fields common to all five types is included here so that you will be familiar with the common fields that apply to both the Series 90 70 and Series 90 30 PLCs Time Stamp Three byte field containing the current reading of the time of day in SS MM HH BCD format
229. tagram request Normal Update on Request 81H Permanent Update on Request for Connection data Number of bytes in the next Connection Data message GFK 0529C Request Connection Data Message Datagram ID byte 3 Point definition size bytes 7 8 Program block name bytes 9 16 Program block segment bytes 17 18 Number of point formats bytes 19 20 First point s Segment selector byte 21 First point s offset bytes 22 23 First point s length byte 24 e e 4 ID that was passed back in Establish Datagram request it identifies the Datagram area for which we are defining the reference data Note that this is the same Datagram ID that is specified in the Request Mailbox message Number of bytes in point definition consists of 12 bytes fixed header size 4 N bytes N number of point formats Should be set to Null unless your Datagram accesses the Local Subblock Data segment or Main Program Block Data segment L or P respectively for Series 90 70 PLCs only Should be set to zero Word field which specifies the number of point formats contained in the Datagram connection area least significant byte followed by most significant byte Byte field that specifies the segment selector of the memory type to access Word field that specifies the zero based offset into the memory type to access least significant byte followed by the most significant byte Byte field t
230. tate of a given input status bit and that input happened to have an override active then you would use this request to override the override if you will in order to change the state of the input while leaving the override active the state of the input is toggled set opposite to what it currently is and the override is still active You can also use this request to toggle the state of transition and override bit memories Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 44h Toggle Force System Memory Segment Selector byte 22 Memory Type Segment Selector See table below Offset bytes 23 24 Zero based offset of bit within the memory type specified by the Segment Selector Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reasons for an Error Nack Mailbox message response are Insufficient privilege must be level 2 or higher must be level 3 or greater for override table Invalid segment selector must be
231. tatus information The same sequence is repeated for the Declaration Block Please note that the actual Logic and Declaration bytes transmitted are shown as Don t care bytes You only need to have the means to store the user program and should not be concerned with the value of the bytes within the Logic and Declaration blocks or their meaning MASTER SLAVE wait T1 time 1 Initial Request MB message with Block Transfer 1b 4d 00 00 00 00 00 00 98 80 10 3a 00 00 10 0a 00 00 00 01 83 00 00 00 00 00 01 01 3f 00 00 00 83 00 17 42 8b 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Request Block Transfer message 1b 42 xx 131 17 00 00 00 00 BCC wait T1 time 4 06 00 wait T1 time 5 lt Completion ACK MB message 1b 4d XX XX XX xx xx xx 98 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 03 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 6 gt ACK 06 00 6 120 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C MASTER SLAVE wait T1 time 7 Initial Request MB message with Block Transfer 1b 4d 00 00 00 00 00 00 99 80 10 3a 00 00 10 0a 00 00 00 01 6a 02 00 00 00 00 01 01 3f 05 00 00 6a 02 1742 720200 BCC wait T1 time 8 06 00 wait T1 time 9 Request Block Transfer message 1b 42 xx 618 17 00 00 00 00 BCC wait T1 time 10 06 00 wait T1 time 11 lt Completion ACK MB message 1b 4d XX XX Xx
232. text 24 0 8 No user memory is available to allocate 25 0 7 Configuration is not valid Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Table 3 13 Minor Error Status Codes General continued Decimal Hex Description 26 CPU model number does not match 27 DOS file area not formatted 28 Segment for this selector does not exist 29 CPU revision number does not match 30 IOS could not delete configuration or bad type 31 1 No I O configuration to read or delete 32 OEO Service in process cannot login 33 ODF Invalid Datagram connection address 34 ODE Size of Datagram connection invalid 35 ODD Unable to locate given connection ID 36 ODC Unable to find connection address 37 ODB Invalid segment selector in Datagram 38 ODA Null pointer to data in segment selector 39 0 9 Transfer type invalid for this selector 40 008 Point length not allowed 41 Invalid Datagram type specified 42 Datagram connection boundary exceeded 43 Invalid block name specified in Datagram 44 Mismatch of configuration checksum 45 User Program Module UPM read or write exceeded block end 46 0 2 Invalid write mode parameter 47 0 1 Packet size total program size does not match input 48 ODO One or more PLC modules configured have unsupported revision 49 OCF Specified device is not available in the system not present 50 OCE Specified d
233. th 01 00 2 M97 to M112 in bit mode Segment Selector 4C Data Offset 60 00 Data Length 10 00 3 Q497 to Q499 in bit mode Segment Selector 48 Data Offset F0 01 Data Length 03 00 4 Q497 to Q512 in bit mode Segment Selector 48 Data Offset F001 Data Length 1000 Examples of BYTE access 1 0497 to Q512 in byte mode Segment Selector 12 Data Offset 3E 00 Data Length 02 00 2 T17 to T208 in byte mode Segment Selector 14 Data Offset 02 00 Data Length 18 00 Examples of WORD access 1 R1 to R78 word mode Segment Selector 08 Data Offset 00 00 Data Length 4E 00 2 R93 to R98 in word mode Segment Selector 08 Data Offset 5C 00 Data Length 06 00 3 L7 in word mode Segment Selector 00 Data Offset 06 00 Data Length 01 00 Series 90 PLC SNP Communications User s Manual September 1998 M memory in bit mode 0022h 34 bit index to M35 0001 one bit M memory in bit mode 0060h 96 bit index to M97 0010h 16 bits Q memory in bit mode 01F0h 496 bit index to Q497 0003h 3 bits Q memory in bit mode 01F0h 496 bit index to Q497 0010h 16 bits Q memory in byte mode 003eh 62 byte index to Q497 0002h 2 bytes T memory in byte mode 0002h byte index to T17 0018h 24 bytes R memory in word mode 0 word index to R1 004Eh
234. th Text Buffer 94h is returned to the master The type of Mailbox message returned depends on the amount of data to be passed back to the master If the number of data bytes being read is six bytes or less the slave responds with a Completion ACK Mailbox message which contains the data read If the number of data bytes being read is greater than six bytes the slave responds with a Completion ACK Mailbox message with Text Buffer and the data read is returned to the master in one or more Text Buffer messages Completion ACK Mailbox message D4h Requested Data bytes 23 28 Completion ACK Mailbox message with Text Buffer 94h Total length of data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Next message type byte 36 54h T for Text Buffer Next message length bytes 37 38 Number of bytes in the next Text Buffer message If the CPU is unable to comply with the request it must reject the request In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message is Insufficient privilege Series 90 70 PLCs only level 1 or higher e _ Invalid input parameter in the request mailbox message Response Text Buffer Message If the slave returns a Completion ACK Mailbox message with Text Buffer 94h the main program task data retur
235. the service request code for Write Datagram 48h After the slave acknowledges the Mailbox message the master transmits a Connection Data message containing all the parameter data The slave responds with a Completion ACK Mailbox message which contains the piggy back status information MASTER SLAVE wait T1 time 1 Initial Request MB message with Connection Data Ib 4d 00 00 00 00 00 00 6e 80 10 3a 00 00 10 0a 00 00 00 01 16 00 00 00 00 00 01 01 48 05 01 00 00 00 1743 1e 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Request Connection Data message 1b 43 05 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 01 00 10 00 00 0e 17 00 00 00 00 BCC wait T1 time 4 06 00 wait T1 time 5 Completion ACK MB message Ib 4d XX XX XX xx xx xx 6e d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 01 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 6 gt ACK 06 00 A full explanation of the SNP messages used in the example follows 6 68 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Explanation of Write Datagram for Series 90 30 PLCs One Point Format Table 6 35 Write Datagram for Series 90 30 PLCs One Point Format Packet Byte Number Number s Hex Value Description 1 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be
236. the Text Buffer message Main program task name 8 byte NUL terminated ASCII string Name of the program block to which the L data belongs 8 byte NUL terminated ASCII string Data bytes to be written number of bytes depends on how much L data the user wishes to write Completion ACK Mailbox message Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU is unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message is Insufficient privilege must be level 2 or higher e Invalid input parameter in the request An example with full explanation follows Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C 4 Example of Write Program Block Memory This example writes one word of data to L7 The L data in this example belongs to the program block SUB1 The main control program name is STAT 1 The word of data written to L7 is 84A2h The example assumes that the master has attached to a Series 90 70 PLC slave device and has set the privilege level to two 2 The master sends the Initial Request Mailbox message to the slave with the service request code for Write Program Block Memory 09h alon
237. the same as that in the Attach message The master must use the T1 value passed back in the Attach Response as the T1 time for this connection session Attach Response Example In this example the PLC CPU whose ID is equal to the CPU ID sent in the Attach message example responds CPU ID 33101A The PLC CPUs TI value is less than the master s 10 millisecond T1 so it returns 10 ms The slave sends the following series of bytes over the serial link 1b 52 33 33 31 30 31 41 00 00 30 41 30 30 30 20 20 20 17 00 00 00 45 37 where the bytes break down as follows Table 3 5 Attach Response Example Byte Size in Number Bytes Description 1 1b Start of message character ESC 2 52 Message type byte 52h R for Attach Response 3 10 33 33 31 Eight bytes of CPU ID 30 31 41 00 00 11 14 30 41 30 Four bytes of ASCII hexadecimal encoded T1 slave PLC CPU compared the 30 master s T1 passed in the Attach message to its own 1 and passed the greater of the two back to the master in the Attach Response message 15 30 Don t care 16 18 20 20 20 Don t care 19 17 End of block character 17h marks the beginning of the message trailer 20 00 Next Message Type value of zero turns the link around the slave is now waiting for a Mailbox message from the master 21 22 0000 Next Message Length 23 24 4537 special two byte ASCII encoded BCC for the Attach Response message calculated over the bytes starting with the star
238. the segment length of block in the PLC 74 OB6 Cyclic Redundancy Check CRC checksum comparison in Verify failed 75 0B5 Additive checksum comparison in Verify failed 76 0B4 Attempt to alter interrupt list in MAIN DECL BLOCK during RUN MODE TI 0B3 Length limit exceeded includes read past end of transferred data writes past end of program block 78 0B2 Program block already exists and cannot be replaced Table 3 14 Minor Error Status Codes Program Load and Store Requests Decimal Hex Description 80 Problem with sending mail to the slave Service Request task Series 90 70 PLC CPUs only 81 Problem with getting mail from the slave Service Request task Series 90 70 PLC CPUs only 85 Slave SNP task timed out before receiving SRP response Series 90 70 PLC CPUs only 86 Slave SNP task could not find the requested Datagram connection Series 90 70 PLC CPUs only 87 57 Slave SNP task encountered an error in trying to write the Datagram Series 90 70 PLC CPUs only 88 58 Slave SNP task encountered an error in trying to update the Datagram Series 90 70 PLC CPUs only Text Buffer Message A Text Buffer Message is the main means through which data is passed back and forth between the master and the PLC Register memory and I O data are passed back and forth via Text Buffer Messages assuming that the amount of data to be passed is greater than what will fit into the accompanying Mailbox message Mu
239. the transmitting device Otherwise if the block check codes do match and no other errors are encountered i e Sequence Parity Overrun or Framing errors then an ACK message must be sent to the device that transmitted the packet The Attach Attach Response packets are the exception to the ACK NAK rule as previously noted Parity Overrun or Framing Errors The PLC CPU slave checks the status of the UART each time it receives an SNP packet If the status indicates a UART error parity overrun or framing error a NAK message is sent to the master with the error code set to zero 0 for parity error or set to one 1 for overrun or framing error Likewise if the programming device master has the capability to interrogate the status of its UART it should do so upon receipt of each SNP packet If the programming device detects a UART error then a NAK message is sent to the slave with the error code set appropriately If the UART status is okay and no other errors with the packet are detected i e sequence error or BCC error then an ACK message is sent to the transmitting device The Attach Attach Response packets are the exception to the ACK NAK rule as previously noted Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Sequence Errors SNP Retries GFK 0529C A sequence error occurs whenever a message type is received that was not expected either the message type in the current packet doe
240. tion of Update Real Time Datagram for Series 90 30 PLCs One Point FORM ab ola tel en E I RUE p re Res 6 113 Loading and Storing User Programs to Series 90 30 6 114 Program Load Series 90 30 6 114 Example of Program Load for Series 90 30 PLCS see 6 115 Explanation of Program Load for Series 90 30 PLCS sess 6 117 Program Store 90 30 8 eriei eene 6 119 Example of Program Store for Series 90 30 PLCSs sss 6 120 Explanation of Program Store for Series 90 30 PLCS sess 6 122 viii GFK 0529C Appendix A GFK 0529C Contents Serial Port and MOL What this Appendix Contains eese nennen nennen nennen nennen enne 1 The RS 485 Interface eet E 2 Constructing RS 422 RS 485 Cables sse A 2 Cable and Connector Specifications eese A 3 series 90 PLC Serial Poft e eret eO ete e ledio eg A 4 Workmaster Serial tette ee ee edu A 6 E Serial Ports tot feet NERIS Eee A 7 R5 232 R5 422 ConvVefter REX Eee A 8 Description of the Isolated Repeater Converter eese A 10 Logic Diagram of the Isolated
241. to the slave with the service request code for Update Datagram 16h along with the Datagram Connection ID The slave responds with a Completion ACK Mailbox message with Connection Data which contains the piggy back status information After the master acknowledges the Mailbox message the slave transmits the Connection Data message containing the values of the reference data MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 71 cO 10 00 00 10 Oa 00 00 01 01 16 05 01 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 c Completion ACK MB message with Connection Data 1b 4d XX XX XX Xx xx xx 71 94 10 0a 00 00 10 3a 00 00 xx 01 14 00 xx xx xx xx 01 01 00 01 00 00 5c 20 17 43 1c 00 00 BCC wait T1 time 4 06 00 wait T1 time 5 Response Connection Data message 1b 43 05 xx xx xx 0e 00 87 23 23 98 21 34 86 09 19 22 05 12 71 43 17 00 00 00 00 BCC wait T1 time 6 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 99 6 100 Explanation of Update Datagram for Series 90 30 PLCs One Point Format Table 6 39 Update Datagram for Series 90 30 PLCs One Point Format Packet Byte Number Number s Hex Value Description Do 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7
242. to write Next message type byte 36 54h T for Text Buffer Next message length bytes 37 38 Number of bytes in the Text Buffer message Request Text Buffer Message Program task name bytes 1 8 Main program task name 8 byte NUL terminated ASCII string Write data Data bytes to be written number of bytes depends on how much P data the user wishes to write Response Mailbox Message Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Dih Error Nack Mailbox message If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU is unable to comply with the request and had to reject it In this case an Error Nack Mailbox message D1h is returned along with a major error status and if applicable a minor error status The most common reason for an Error Nack Mailbox message is Insufficient privilege must be level 2 or higher e Invalid input parameter in the request An example with full explanation follows 6 24 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C 4 Example of Write Task Memory This example writes five words of data to P39 through P43 The P data in this example belongs to the Main Control program task STAT 1 After the write service request P39 through P43 are equal to P39 4A9Bh P40 3463h P41 1ACBh 42 91D4h P43 8BC3h This example assum
243. type female connector located as follows e Series 90 70 PLC CPU Module e Series 90 70 PLC Remote I O Scanner e Series 90 30 PLC Power Supply Figure A 1 shows the serial port orientation and connector layout for both PLC types Table A 2 shows the pin numbering and signal assignment applicable to both PLCs a44521 SERIES 90 70 SERIES 90 30 PLC PLC PIN O 8 1 15 o9 9 9 PIN O 15 1 8 peed NOTE SERIES 90 PLC CONNECTORS USE METRIC HARDWARE SEE CONNECTOR SPECIFICATIONS Figure A 1 Series 90 PLC RS 422 Serial Port Connector Configuration Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C GFK 0529C Table A 2 Series 90 PLC RS 422 Serial Port Pin Assignment Pin No Signal Name Description Shield ATCH 5V RTS A Signal Ground CTS RD RD RD B SD A SD B RTS B CTS NC NC Hand Held Programmer attach signal 5V Power for Hand Held Programmer RS 232 422 Converter Request To Send Signal Ground OV Clear To Send Terminating Resistor for RD 120 Receive Data Receive Data Send Data Send Data Request To Send Clear To Send Signals available at the Connector but not included in the RS 422 specification SD Send Data and RD Receive Data are the same as TXD and RXD used in the Series Six PLC
244. uence number Mailbox type Completion ACK Mailbox source PLC service request task Mailbox destination Master SNP device Packet number total packets Status code 0 okay Don t care Control program number Current privilege level Last sweep time PLC status word End of block character Next message type Next message length Status byte Block Check Code Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C PLC Short Status Request 4 The PLC Short Status request from the master to the PLC CPU requests the status information that is piggy backed onto all mailbox responses plus some additional status information on control programs logins and the programmer window Key fields within the request and response messages Request Mailbox Message Mailbox Type byte 10 COh Initial Request Mailbox message Service Request code byte 21 O0h Short Status request Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Number of Control Programs byte 23 0 No program tasks currently defined 1 One program task defined for the PLC CPU Programmer Flags byte 24 Set of boolean flags indicating which control program tasks have programmers currently attached to them Each bit position corresponds to a control program task 0 no programmer attached 1 programmer attached where bit 0 corresponds to control program 0 Since at most o
245. ufficient privilege Series 90 70 PLCs only must be level 1 or higher e Unable to locate specified Datagram ID Response Connection Data Message The point data is returned to the master via a Connection Data message The number of Connection Data messages returned to the master depends on the amount of point data accessed and the maximum data size allowed in a SNP Data message Datagram Connection ID byte 3 ID of datagram being returned Number of reference data bytes bytes 7 8 Number of reference data bytes that follow Reference Data bytes 9 N The remaining data bytes contain the values of the reference data for all point formats within the Datagram area The number of bytes that go with a given point format depends on the layout specified in the Write Datagram request GFK 0529C Chapter 6 Service Requests 6 111 Example of Update Real Time Datagram for Series 90 30 PLCs One Point Format This example requests an update of reference data defined in Datagram ID five 5 Datagram ID five has already been established as a permanent datagram and defined as containing one point format that spans to 1112 The reference data I1 through I112 is currently set as follows 101 87h 125 98h 149 86h 173 22h 197 71h 109 23h 133 21h 157 09h 181 05h 1105 43h 117 23h 141 34h 165 19h 189 12h The master sends the long break waits T4 and sends the Update Real Time Datagram request to the
246. umes that the master has already attached to the slave device The slave device is a Series 90 30 331 CPU with a controller ID of 33101A and contains a program named ESS331 The master sends the Initial Request Mailbox message to the slave with the service request code for Return Controller TYPE and ID information 43h and the slave responds with a Completion ACK Mailbox message which includes piggy back status information After the master acknowledges the Mailbox message the slave transmits the Text Buffer message which contains the controller Type and ID information MASTER SLAVE wait T1 time 1 Initial Request MB message Ib 4d 00 00 00 00 00 00 65 c0 10 00 00 10 00 00 01 01 43 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 BCC wait T1 time 2 06 00 wait T1 time 3 Completion ACK MB message with Text Buffer Ib 4d XX XX XX XX xx xx 65 94 10 0a 00 00 10 3a 00 00 xx 01 28 00 xx xx xx xx 01 01 00 01 00 00 4c 20 17 54 30 00 00 BCC wait T1 time 4 06 00 wait T1 time 5 Response Text Buffer message 1b 54 33 33 31 30 31 41 00 00 10 23 01 00 45 53 53 33 33 31 00 00 01 00 a3 07 00 00 9a 01 9b cd 00 00 d6 06 22 01 c8 eb 00 00 17 00 00 00 00 BCC wait T1 time 6 gt ACK 06 00 A full explanation of the SNP messages used in the example follows 6 40 Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Explanation of Return Contr
247. ut of order 05h Service Request Error Minor status field contains the request specific error code See table of Minor Error Status Codes below 06h Illegal Mailbox Type Service request mailbox type is either undefined or unexpected 07h The PLC CPU s Service Request Queue is full The master should retry later It is recommended that the master wait a minimum of 10 ms before sending another service request Table of Minor Error Status Codes Table 3 13 Minor Error Status Codes General Decimal Hex Description 1 Service request has been aborted 2 OFE No privilege for attempted operation 3 Unable to perform auto configuration 4 OFC I O configuration is invalid 5 OFB Cannot clear I O configuration 6 OFA Cannot replace I O module 7 OF9 Task address out of range 8 OF8 Invalid task name referenced 9 OF7 Required to log in to a task for service 10 OF6 Invalid sweep state to set 11 5 Invalid password 12 OF4 Invalid input parameter in request 13 OF3 T O configuration mismatch 14 OF2 Invalid program cannot log in 15 Request only valid from programmer 16 OFO Request only valid in stop mode 17 OEF Programmer is already attached 18 OEE Could not return block sizes 19 OED VMEbus error encountered 20 OEC Task unable to be created 21 OEB Task unable to be deleted 22 Not logged in to process service request 23 OE9 Segment selector not valid in con
248. vices when loading and storing programs It doesn t hurt anything to logon with a buffer size larger than what the CPU can currently handle since the CPU will pass back its size in this case This allows for future enhancement where the CPU s buffer size may increase with no need to change the logon request The long break is not required for Break Free SNP Operation 6 58 Series 90M PLC SNP Communications User s Manual September 1998 GFK 0529C If you are not going to be loading and storing program data this value has no meaning A value must be entered however to fulfill the logon service request requirements and might just as well be set to 16K If you need to do program loads and stores then refer to the section on Program LOAD and Program STORE for the Series 90 70 PLC for a complete definition of this field and determination of a value applicable to the User s SNP environment Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK Mailbox message Dih Error Nack mailbox message Block Transfer buffer Size bytes 23 24 Series 90 70 PLC only Master should use this value in determining the maximum Block Transfer buffer size during program loads and stores on the Series 90 70 PLCs If the request is completed successfully a Completion ACK Mailbox message D4h is returned to the master Otherwise the CPU was unable to comply with the request and had to reject it In this case an Error Nack Mailbox mess
249. with Text Buffer message or 94h Completion ACK Mailbox with Text Buffer message depending on which direction the connection data is being passed 3 20 Series 90 M PLC SNP Communications User s Manual September 1998 GFK 0529C For both Series 90 30 PLCs and Series 90 70 PLCs the Next Message Type field in the Mailbox message s trailer is equal to 43h for C and the Next Message Length field in the Mailbox message s trailer equals the number of connection data bytes contained in the next message the Connection Data message After this Mailbox message is transmitted one or more Connection Data messages are transmitted until all connection data bytes have been transferred The following is the format of the Connection Data message where N is the number of connection data bytes contained in the message Table 3 17 Connection Data Message Format Byte Size in Description Number Bytes 1 1 Start of message character ESC 1bh 2 1 Message type character 43h for Connection Data 3 N 2 XX XX Data text bytes N 3 1 End of block character 17h marks the beginning of the packet trailer N 4 1 Next message type 0 or 43h where 0 means no more Connection Data messages link turnaround 43h means another Connection Data message is going to be transmitted which contains more data bytes N 5 2 Next message length N 6 1 Status byte N 8 1 Block Check Code BCC Inquiry Message GFK 0529C Whenever ther
250. x 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 6e Sequence number 10 c0 Mailbox type Initial Request 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 Oa 00 00 Mailbox destination PLC service request task 19 20 01 01 Packet number total packets 21 48 Request code Write Datagram 22 01 Datagram Connection ID 23 01 Normal Datagram 24 34 01 00 00 00 00 00 Not used 00 00 00 00 00 00 35 17 End of block character 36 43 Next message type for Connection Data 37 38 le 00 Next message length in bytes 001 30 39 00 Status byte 40 BCC Block Check Code 3 5 1 1b Start of message character 2 43 Message type for Connection Data 3 01 Datagram connection ID 4 6 00 00 00 Reserved must be set to zero 7 8 10 00 Point definition size in bytes 0010h 16 9 16 00 00 00 00 00 00 00 00 Program block name 17 18 00 00 Program block segment 19 20 01 00 Number of point formats 0001 21 10 1 memory in byte mode 22 23 00 00 Point offset 0 gt I1 24 0e Point length Oeh 14 bytes 25 17 End of block character 26 00 Next message type 27 28 00 00 Next message length 29 00 Status byte 30 BCC Block Check Code Sie 1 1b Start of message character 2 4d Message type for Mailbox 3 4 XX XX Reserved don t care 5 7 XX XX XX Time Stamp 8 XX Reserved don t care 9 6e Sequence number 10 d4 Mailbox type Completion ACK 11 14 10 0a 00 00 Mai
251. xx xx xx 99 d4 10 0a 00 00 10 3a 00 00 01 01 00 xx xx xx xx xx xx xx 00 03 00 00 5c 20 17 00 00 00 00 BCC wait T1 time 12 06 00 A full explanation of the SNP messages used in the example follows GFK 0529C Chapter 6 Service Requests 6 121 6 122 Explanation of Program Store for Series 90 30 PLCs Table 6 46 Program Store for Series 90 30 PLCs Packet Byte Number Number s Hex Value Description 1 1 1b Start of message character 2 4d Message type M for Mailbox 3 4 00 00 Reserved must be set to zero 5 7 00 00 00 Time Stamp 8 00 Reserved must be set to zero 9 98 Sequence number 10 80 Mailbox type Initial Request with Block Transfer 11 14 10 3a 00 00 Mailbox source Master SNP device 15 18 10 0a 00 00 Mailbox destination PLC service request task 19 20 0001 Reserved first byte zero second byte one 21 22 83 00 Total length of data in bytes 0083h 131 23 26 00 00 00 00 Reserved must be set to zero 27 28 0101 Packet number total packets 29 3f Request code Program Store 30 00 Block Type 0 Logic Block 31 32 00 00 Block Offset MUST be set to ZERO 33 34 83 00 Block Length 0083h 131 bytes 35 17 End of block character 36 42 Next message type for Block Transfer 37 38 8b 00 Next message length 139 bytes 39 00 Status byte 40 BCC Block Check Code 1 1b Start of message character 2 42 Message type B for Block Transfer 3 133 xx 131 Logic block bytes 131 d
252. y Segment Selector byte 22 See Segment Selector Table Table Data Offset bytes 23 24 Zero based offset of data Data Length bytes 25 26 Length of data to write Write Data bytes 27 34 Maximum of 8 bytes to write Request Mailbox Message with Text Buffer If the amount of data to be written is greater than eight bytes then an Initial Request Mailbox message with Text Buffer is required Mailbox Type byte 10 80h Initial Request Mailbox message with Text Buffer Total Length of Data bytes 21 22 Total number of data bytes that are going to be transmitted in all subsequent Text Buffer messages Service Request code byte 29 07h Write System Memory Segment Selector byte 30 See Segment Selector Table Table Data Offset bytes 31 32 Zero based offset of data Data Length bytes 33 34 Length of data to write Next Message Type byte 36 54h for Text Buffer Next Message Length bytes 37 38 Number of bytes in the next Text Buffer message Request Text Buffer Message If the master sends an Initial Request Mailbox with Text Buffer 80h the data to be written to the PLC system memory is transmitted to the slave in one or more Text Buffer messages The number of Text Buffer messages required depends on the amount of data the master is writing to the PLC system memory and the maximum data size allowed in a SNP Data message Response Mailbox Message Mailbox Type byte 10 D4h Completion ACK
253. y this device 0 I O fault table unchanged since last read PLC Fault Entry Present z One or more fault entries in PLC fault table 0 PLC fault table is empty I O Fault Entry Present z One or more fault entries in I O fault table 0 I O fault table is empty Programmer attachment flag 1 Programmer attachment found 0 No programmer attachment found Front panel ENABLE DISABLE switch setting 1 Outputs disabled 0 Outputs enabled Front panel RUN STOP switch setting 1 RUN 0 STOP OEM protected bit 1 OEM protection in effect 0 No OEM protection Not used Not used PLC State 0 Run I O enabled 1 Run I O disabled 2 Stop I O disabled 3 CPU stop faulted 4 CPU halted 5 CPU suspended 6 Stop I O enabled GFK 0529C The following two tables describe the format for the two different types of Completion ACK Mailbox messages The values of the bytes are listed when they are known and fixed values are marked xx where we don t care or the values are dependent on the response to the original service request made by the master The Completion ACK Mailbox message Mailbox Type D4h is shown in the following table Table 3 9 Completion AC Knowledge Mailbox Message Byte Size in Number Bytes Value Description 1 1 1b Start of message character 2 1 4d Message type character 4dh for Mailbox 3 4 2 XX XX Don t care ignore 5 7 3 XX XX XX Time Stamp 8 1
254. your master SNP Driver As an example the word field Next Message Length within the trailer of a SNP message is transmitted as least significant byte first followed by most significant byte Therefore the two hexadecimal bytes 3A 01 013Ah 314 which in this case equals a Next Message Length of 314 bytes 2 Hexadecimal numbers in the main text of this document have a lower case h appended to them 53h or E45Fh However all data within the SNP protocol examples in the tables are coded as hexadecimal values but do not have the lower case h appended It will be obvious that the examples are hexadecimal GFK 0529C Chapter 1 Introduction 1 13 3 Indicators used to avoid confusion between ASCII characters and the numeric codes used to represent them are Individual printable ASCII characters are identified by single quotes for example A Strings of printable ASCII characters are set off by double quotes for example 33101A Non printable ASCII characters are referred to by their two or three letter ASCII names for example NUL ACK and Series 90 PLC SNP Communications User s Manual September 1998 GFK 0529C Chapter Configuration 2 Series 90 Protocol SNP is a half duplex protocol that uses the RS 485 enhanced version of RS 422 interface It supports a number of different baud rates parity and stop bits in order to support a broad number of applications One PLC may be on the serial link to

Series 90 PLC SNP Communications User`s Manual, GFK

Contents

Download Pdf Manuals

Related Search

Related Contents