ESCORT MEMORY SYSTEMS HS500E Industrial Ethernet Antenna Operator’s Manual P/N: 17-1305 REV 02 (12/05) Copyright © 2005 Escort Memory Systems, All rights reserved. Escort Memory Systems reserves the right to make modifications or improvements to its products and/or documentation without prior notification. Escort Memory Systems shall not be liable for technical or editorial errors or omissions contained herein, nor for incidental or consequential damages resulting from the use of this material.
HS500E Read/Write Industrial Ethernet Antenna O PERATOR’S M ANUAL How to Install, Configure and Operate Escort Memory Systems’ HS500E Industrial Ethernet Antenna
FCC C OMPLIANCE N OTICE FCC Part 15 This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment uses, generates, and can radiate radio frequency energy and, if not installed and used in accordance with these instructions, may cause harmful interference to radio communications.
TABLE OF CONT EN TS TABLE OF C ONTENTS FCC COMPLIANCE NOTICE 4 TABLE OF CONTENTS 5 CHAPTER 1: 8 1.1 Introduction 1.1.1 1.1.2 1.2 Who Should Read this Manual? HEX Notation Dimensions & Diagrams 1.3.1 1.3.2 1.3.3 1.3.4 1.3.5 1.3.6 1.4 Company Background RFID Overview About this Manual 1.2.1 1.2.2 1.
TABLE OF CONT EN TS Command F2: Start/Stop Repetitive Command Command F3: Write IP Address Command F4: Reset Battery Counter CHAPTER 4: 4.1 38 38 38 ETHERNET/IP PROTOCOL 39 Steps to Configure the HS500E 5.1.1 40 HTML Server and OnDemand Overview 40 HS500E Node Configuration 5.2.1 5.2.2 5.2.3 5.3 38 Syntax Errors RF Response Errors CHAPTER 5: 5.2 ERROR CODES Error Types 4.1.1 4.1.2 5.
TABLE OF CONT EN TS APPENDIX B: ASCII CHART 61 APPENDIX C: ETHERNET/IP - OBJECT MODEL 63 C.1 Ethernet/IP - Required Objects C.1.1 C.1.2 C.1.3 C.1.4 C.1.5 C.1.6 C.2 64 Identity Object (0x01- 1 Instance) Message Router Object (0x02) Assembly Object (0x04 – 3 Instances) Connection Manager Object (0x06) TCP Object (0xF5 - 1 Instance) Ethernet Link Object (0xF6 - 1 Instance) 64 66 66 70 70 72 Vendor Specific Objects C.21 C.22 C.
CHAPTER 1: GETTING STARTED CHAPTER 1: G ETTING S TARTED 1.1 INTRODUCTION Welcome to the HS500E Industrial Ethernet Antenna - Operator’s Manual. This manual will assist you in the installation, configuration and operation of Escort Memory Systems’ HS500E Industrial Ethernet Antenna. The HS500E Ethernet Antenna is a complete read/write Radio-Frequency Identification solution. It is designed to be reliable and rugged, in order to meet and exceed the requirements of the industrial automation industry.
CHAPTER 1: GETTING STARTED 1.2 ABOUT THIS MANUAL This document provides guidelines and instructions on how to install, configure and operate the HS500E Industrial Ethernet Antenna. Descriptions of the RFID command set are also included, as are instructions detailing how to issue commands from a Host computer to the HS500E. 1.2.1 Who Should Read this Manual? Those who will be installing, configuring and operating the HS500E should read this manual. This may include the following people: 1.2.
CHAPTER 1: GETTING STARTED 1.3 DIMENSIONS & DIAGRAMS 1.3.
CHAPTER 1: GETTING STARTED 1.3.
CHAPTER 1: GETTING STARTED 1.3.
CHAPTER 1: GETTING STARTED 1.3.
CHAPTER 1: GETTING STARTED 1.3.5 Antenna Read Range - Front View NOTE: The range listed above was defined in free air. However, proximity to metal, water and RF interference can affect range performance and results. All RFID applications should be tested to ensure adequate RF performance can be achieved.
CHAPTER 1: GETTING STARTED 1.3.6 Antenna Read Range - Side View NOTE: The range listed above was defined in free air. However, proximity to metal, water and RF interference can affect range performance and results. All RFID applications should be tested to ensure adequate RF performance can be achieved.
CHAPTER 1: GETTING STARTED 1.4 I N S TA L L AT I O N & S E T U P 1.4.1 Installation Precautions Mounting Guidelines Avoid mounting the HS500E or its RFID controllers near sources of EMI (electro-magnetic interference) or near devices that generate high ESD (electro-static discharge) levels. Do not route cables near unshielded cables or near wiring carrying high voltage or high current. Avoid routing cables near motors and solenoids.
CHAPTER 1: GETTING STARTED 1.4.2 Installing the HS500E 1 Unpack and inspect the HS500E hardware and accessories. If an item appears to be damaged, notify your EMS distributor immediately. 2 Securely mount the HS500E to your chosen location using four (4) #10 [M5] screws and matching locking washers and nuts. The HS500E may be mounted in any orientation, but should be aligned in such a manner that the four LED indicators can be seen during operation.
CHAPTER 2: IP CONFIGURATION CHAPTER 2: IP C ONFIGURATION 2.1 T H E HTML S E RV E R Built into the HS500E is an embedded HTML Server which provides a Website-like user interface with all of the tools necessary to configure the unit. The first step in configuring the HS500E is to set its IP address. This particular chapter describes the IP configuration procedure via the HTML Server. The HTML Server has many other uses and features which are covered later in this manual. 2.
CHAPTER 2: IP CONFIGURATION Click the link: IP Configuration The HTML Server- Main Page 4 At the HTML Server - Main Page, click the link labeled IP Configuration. The IP Configuration Page will be displayed. You will arrive at a page similar to the one displayed below. The HTML Server - IP Configuration Page 5 Enter new IP address values in the fields provided.
CHAPTER 2: IP CONFIGURATION 2.3 6 Click the “Save Settings” button to store the configuration changes to the HS500E’s non-volatile flash memory. 7 Manually cycle power to the HS500E. It takes 15 – 30 seconds for the HS500E to reboot, at which time your IP configuration changes will be implemented. 8 After the HS500E has completely restarted, verify the new IP configuration by opening a Web browser and entering the newly assigned IP address in the URL field.
CHAPTER 3: RFID COMMANDS CHAPTER 3: RFID C OMMANDS 3.1 COMMAND STRUCTURE RFID commands are Host-generated packets of data that contain instructions intended for the HS500E. In general, RFID commands adhere to a 6-word minimum packet structure, where each word within a packet is comprised of 2-bytes; a Most Significant Byte (MSB) and a Least Significant Byte (LSB). The MSB and LSB are also sometimes referred to as the High Byte and the Low Byte, respectively.
CHAPTER 3: RFID COMMANDS 3.1.1 C o m m a n d P a c k e t S t r u c t u r e Ta b l e Word # MSB LSB Description 01 00 06 (+ number of additional data words, if any) OVERALL LENGTH: 03 COMMAND ID: 02 AB The first word in a command packet is the Overall Length. This 2-byte value indicates the total number of words in the command (including this - the Overall Length field). This value will always be at least six words (0x0006). The second word contains the Command ID.
CHAPTER 3: RFID COMMANDS 3.1.2 R e s p o n s e P a c k e t S t r u c t u r e Ta b l e Word # MSB LSB Description 01 00 06 (+ number of returned data words, if any) OVERALL LENGTH: (Command Echo / Error Code) RF ERROR COUNTER: 2 (RF Error) The first word in a response packet is the Overall Length. This 2-byte value indicates the total number of words in the response (including this the Overall Length field). Length will always be at least six words (0x0006).
CHAPTER 3: RFID COMMANDS Word # MSB LSB Description 05 (RF Retry) (Reserved) RF RETRY COUNTER: RESERVED: 0x00 The fifth word contains the RF Retry Counter in the MSB. This counter indicates the number of packets that required re-transmission to successfully complete the given command.
CHAPTER 3: RFID COMMANDS 3.2 RFID C O M M A N D S The HS500E uses a 2-byte Command ID number to specify the type of operation to perform. Commands 02, 03 and 05 must include the command prefix “AB” (0xAB), as in AB03 (for Command 03) .These three commands instruct the HS500E to perform standard RFID operations such as reading from and writing to an RFID tag. Commands F1, F3 and F4 must be appended with “00” (0x00), as in F300 (for Command F3).
CHAPTER 3: RFID COMMANDS COMMAND 02: READ DATA DESCRIPTION Command 02 instructs the H500E to retrieve a specified number of bytes from a contiguous (sequential) area of an RFID tag’s memory. The Read Data command consists of the Overall Length (OAL), the Command ID Number, Node ID value, Timeout Value, Start Address and Read Length. The minimum Read Length is 1 byte. If the Read Length extends beyond the last tag address, an error will occur. The Timeout Value is measured in .
CHAPTER 3: RFID COMMANDS Command 02: Read Data – Response Structure Field Name MSB LSB Word Value Overall Length (in words) 00 08 0008 MSB =RF Error Counter 00 02 0002 01 01 0101 RF Time RFT1 RFT2 XXXX MSB = RF Retry Counter 01 00 0100 Total Time TT TT TTTT Returned Data (bytes 1, 2) D1 D2 DATA Returned Data (bytes 3,4) D3 D4 DATA LSB = Command ID Echo MSB = Instance Counter LSB = Node ID Echo LSB = Reserved HS500E – OPERATOR’S MANUAL P/N: 17-1305 REV02 (12-05) PAGE 2
CHAPTER 3: RFID COMMANDS COMMAND 03: WRITE DATA DESCRIPTION Command 03 instructs the HS500E to write segments of data to contiguous addresses of an RFID tag’s memory. The Write Data command consists of an Overall Length, the Command ID, a Timeout Value, Start Address and Write Length, and the Data Byte Value(s) to be written to the tag. • Start Address: 0x0001 = Starts writing to the first accessible byte of tag memory (byte 0x0000 is reserved for the Battery Counter Value).
CHAPTER 3: RFID COMMANDS Command 03: Write Data – Response Structure Field Name MSB LSB Word Value Overall Length 00 06 0006 MSB =RF Error Counter 00 03 0003 01 01 0101 RF Time XX XX XXXX MSB = RF Retry Counter 01 00 0100 TT TT TTTT LSB = Command ID Echo MSB = Instance Counter LSB = Node ID Echo LSB = Reserved Total Time HS500E – OPERATOR’S MANUAL P/N: 17-1305 REV02 (12-05) PAGE 29 OF 82
CHAPTER 3: RFID COMMANDS COMMAND 05: FILL TAG DESCRIPTION Command 05 is used to instruct the HS500E to write a particular data byte value to all specified contiguous areas of tag memory beginning at the Start Address. EXAMPLE In this example, the HS500E will write the ASCII character “D” (0x44) to 8-bytes of tag memory starting at address 0x0001. The Timeout value is set for 5 seconds (0x0032 = 50 decimal, 50 x .10 = 5 seconds) for the completion of this command.
CHAPTER 3: RFID COMMANDS COMMAND F1: TEST LEDS / GET INFO DESCRIPTION Command F1 tests the HS500E’s LEDs and retrieves the unit’s currently installed software version number. This command causes the HS500E’s LEDs to flash a coded diagnostic pattern while also retrieving the version number of the installed software. EXAMPLE In this example the LEDs on the HS500E will be tested and its software version number will be retrieved.
CHAPTER 3: RFID COMMANDS Command F1: Test LEDs / Read Info – Response Structure Field Name MSB LSB Word Value Overall Length 00 06 0006 MSB =RF Error Counter 00 F1 00F1 01 01 0101 Response Data (first word) 31 2E 312E Response Data (second word) 30 41 3041 Response Data (third word) 2E 38 2E38 LSB = Command ID Echo MSB = Instance Counter LSB = Node ID Echo The software version number returned for this example is 1.0A.
CHAPTER 3: RFID COMMANDS COMMAND F2: START/STOP REPETITIVE COMMAND DESCRIPTION Command F2 is used to instruct the HS500E to continuously repeat a specified RFID command. Note that only Commands 02, 03 and 05 are repeatable. To begin repeating a command, set the Overall Length to a value of 0x0006 or greater. To stop this command, change the Overall Length to 0x0000 and re-issue the command (or cycle power to the unit).
CHAPTER 3: RFID COMMANDS Command F2: Repeat Command (Read Data) – Response Structure Word # Field Name MSB LSB Word Value 1 Overall Length (in words) 00 08 0008 2 MSB =RF Error Counter 00 02 0002 01 01 0101 LSB = Command ID Echo 3 MSB = Instance Counter LSB = Node ID Echo 4 RF Time XX XX XXXX 5 MSB = RF Retry Counter YY 00 YY, 00 LSB = Reserved 6 Total Time TT TT TTTT 7 Return Data (bytes 1, 2)* D1 D2 D1, D2 8 Return Data (bytes 3,4)* D3 D4 D3, D4 * Only applica
CHAPTER 3: RFID COMMANDS COMMAND F3: WRITE IP ADDRESS DESCRIPTION Command F3 is used to modify and store the IP address of the HS500E. NOTE: The unit’s IP address can also be changed using the built-in HTML Server. See Chapter 2 for instructions. Follow the steps below to configure the unit’s IP address. SETTING THE IP ADDRESS OF THE HS500E 1. Run Command F3 as shown below, (the R/W LED on the HS500E will blink repeatedly for 15 - 20 seconds). 2.
CHAPTER 3: RFID COMMANDS RESPONSE FROM HS500E There is no response for Command F3 because as soon as the IP address is changed on the HS500E, the existing TCP/IP connection with the Host will be terminated. To reset the IP address of the HS500E to factory default settings see: Appendix A: IP Address Reset. HS500E Factory Default IP Address: 192.168.0.
CHAPTER 3: RFID COMMANDS COMMAND F4: RESET BATTERY COUNTER DESCRIPTION Command F4 resets the value of a tag’s Battery Counter to zero (0x00). This command is intended to be used when replacing the batteries in an active RFID tag and will reset the value of the Battery Counter to zero (0x00). Located at tag address 0x0000, the Battery Counter stores a one-byte value that indicates the number of operating hours that the tag has been in use since it has last had its internal batteries replaced.
CHAPTER 4: ERROR CODES CHAPTER 4: E RROR C ODES The HS500E will generate an error response if it is unable to complete an operation. When an error occurs, the LSB of the second word in a response (the Command Echo word) will be replaced by a 1-byte error code that indicates the actual error that was experienced. 4.1 ERROR TYPES There are basically two types of errors that can occur. SYNTAX ERRORS The majority of errors that occur do so because of improperly formatted commands.
CHAPTER 5: ETHERNET/IP PROTOCOL CHAPTER 5: ETHERNET/IP PROTOCOL The HS500E is designed to support many common Industrial Ethernet protocols and can be implemented in a wide variety of existing Host / PLC Industrial Ethernet applications. One such popular protocol that can be used to transfer data over Ethernet to and from the unit is Ethernet/IP (EIP).
CHAPTER 5: ETHERNET/IP PROTOCOL 5.1 S T E P S TO C O N F I G U R E T H E HS500E See Chapter 2 for instructions on configuring the IP address of the HS500E. Sections 5.2 through 5.4 in this chapter will help you accomplish the following: Configure the HS500E via OnDemand Node Configuration Create “Controller Tags” in the PLC Verify PLC and HS500E connectivity 5.1.
CHAPTER 5: ETHERNET/IP PROTOCOL The OnDemand Configuration Page 3 At the HS500E’s OnDemand Configuration Page, select Node 01 from the drop-down list (Node 01 is selected in the image above). 4 Click Submit. The OnDemand Node 01 Configuration Page will be displayed.
CHAPTER 5: ETHERNET/IP PROTOCOL 5.2.2 OnDemand Node 01 Configuration Page The OnDemand Node 01 Configuration Page Use this page to modify the settings for Node 01. Controller Settings 5 Select the Controller Type from the drop-down menu. The Controller Type (in this case) specifies the type of PLC that will be communicating with the HS500E. 6 Enter the Controller’s IP address. Controller IP address is the IP address assigned to the PLC. 7 Enter the Controller’s Slot Number (0-255).
CHAPTER 5: ETHERNET/IP PROTOCOL 9 Write Tag Name / Write File Address: a. For ControlLogix: Specify a Write Tag Name that is 40 characters or less. The Write Tag Name refers to the name of the Controller Tag in the PLC where the HS500E will write PLC-bound data for Node 01 (example: EMS_WRITE1). Note: this is not to be confused with writing to an RFID transponder, which is often referred to as “writing to a tag.” OR b. For SLC505: Enter a value in each of the two Write File Address fields.
CHAPTER 5: ETHERNET/IP PROTOCOL 5.2.3 OnDemand Configuration Page (Summary) OnDemand Configuration Page When you return to the OnDemand Configuration Page, you will notice a brief summary (similar to the image above) that displays the current details of the Node configuration settings for the HS500E.
CHAPTER 5: ETHERNET/IP PROTOCOL 5.3 C O N F I G U R I N G PLC C O N T R O L L E R TA G S After you have configured Node 01 via OnDemand Node Configuration, open your PLC control software (RSLogix 5000 for ControlLogix) and define two Controller Tags (a Write Tag and a Read Tag). Be sure to use the same Write Tag Name and Read Tag Name specified in the OnDemand Node Configuration (i.e., EMS_WRITE1 and EMS_READ1).
CHAPTER 5: ETHERNET/IP PROTOCOL 5.4 C H E C K I N G O N D E M A N D S TAT U S Now that you have configured Node 01 for the HS500E and defined corresponding Write and Read Tags in the PLC, the last step is to check the communication status between the HS500E and the PLC. On the HS500E’s HTML Server - Main Page, click the link labeled: “OnDemand Status.” The OnDemand Status Page will be displayed. This message indicates that the PLC has established a connection with Node 01.
CHAPTER 5: ETHERNET/IP PROTOCOL 5.5 U S I N G T H E HS500E W I T H RSL O G I X 5000 At this point, communication between the PLC and the HS500E should be properly configured and a connection established. You can verify the exchange of information between devices using RSLogix 5000. Note that under the Ethernet/IP protocol, the HS500E acts as the client and the PLC acts as the Ethernet/IP server.
CHAPTER 5: ETHERNET/IP PROTOCOL 5.5.1 Ethernet/IP Handshaking To ensure that messages to and from the HS500E are properly delivered and received, a handshaking mechanism has been implemented that uses a pair of dedicated words in the exchange. The first two words in each Controller Tag are dedicated to handshaking.
CHAPTER 5: ETHERNET/IP PROTOCOL 3 After executing the command, the HS500E writes the response in the Write Tag and then increments the counter in EMS_WRITE1 [1]. This signals that there is new information for the PLC (the HS500E generated response). 4 After the PLC has processed the response information, it copies the counter from EMS_WRITE1 [1] to EMS_READ1 [0] which signals (to the HS500E) that the PLC has read the response data. 5 The HS500E will then clear the Write Tag by copying 0’s to memory.
CHAPTER 5: ETHERNET/IP PROTOCOL Write Tag (where responses are written by the HS500E) EMS_Write1 [0] = (2) the counter is copied here by the HS500E to ACK EMS_Write1 [1] = (3) the HS500E increments this counter to signal a response is available EMS_Write1 [2] = Data Size EMS_Write1 [3-102] = Data Read Tag (where commands are retrieved by the HS500E) EMS_Read1 [0] = (4) PLC copies the counter here to ACK the response EMS_Read1 [1] = (1) PLC increments this counter after writing a command EMS_Read1 [2] = Dat
CHAPTER 5: ETHERNET/IP PROTOCOL 5.6 HTML S E RV E R A N D O N D E M A N D PLC S U P P O RT Below is a partial list of the programmable logic controllers that are supported by EMS’ HTML Server and OnDemand Utility. ControlLogix – OnDemand supports all current versions RA’s PLC5E releases: • Series C, Revision N.1 • Series D, Revision E.1 • Series E, Revision D.
CHAPTER 6: MODBUS TCP PROTOCOL CHAPTER 6: MODBUS TCP PROTOCOL One of the most popular and well-proven industrial automation protocols in use today is Modbus. Modbus TCP allows the Modbus protocol to be carried over standard Ethernet networks. 6.1 M O D B U S TCP O V E RV I E W Under the Modbus TCP protocol, the HS500E acts as a Modbus Server and the Host or PLC is the Modbus Client.
CHAPTER 6: MODBUS TCP PROTOCOL 4 R/W 2-byte Timeout Value (0-65535) measured in milliseconds 5 R/W 2-byte Read/Write Start Address (0-65535) 6 R/W 2-byte Read/Write Data Length (0-65535) 7 – 32774 R/W HS500E Consume Data (when applicable) 32775 – 65536 R/W Reserved Modbus TCP Command Structure Node 01 Memory Map (Consume Registers) HS500E – OPERATOR’S MANUAL P/N: 17-1305 REV02 (12-05) PAGE 53 OF 82
CHAPTER 6: MODBUS TCP PROTOCOL 6.1.2 Modbus TCP Response Structure MAPPING NODE 33 (PRODUCE REGISTERS) Produce Registers hold data that is destined for the Host.
CHAPTER 6: MODBUS TCP PROTOCOL 6.2 M O D B U S TCP H A N D S H A K I N G Modbus TCP handshaking is governed by the changing of the “Overall Length” value within a data packet. The Overall Length value is typically the first 2-bytes of a command or response and indicates the total number of data words in the packet (including one word for the Overall Length value). Overall Length values are stored in the first holding register, 40001, of Device ID 1 (for commands) and Device ID 33 (for responses).
CHAPTER 6: MODBUS TCP PROTOCOL 6.2.2 Modbus TCP Command, Response & Handshaking Example 1 The Host issues an RFID command to the HS500E, writing the command string to the holding registers for Device ID 1. An Overall Length value of 0x06 is written last to holding register 40001. 2 The HS500E recognizes that the Overall Length value at holding register 40001 for Device ID 1 has changed, indicating that it has data waiting to be retrieved.
CHAPTER 7: RAW TCP/IP PROTOCOL CHAPTER 7: RAW TCP/IP PROTOCOL 7.1 RAW TCP/IP O V E RV I E W Another means of communicating with the HS500E is through the standard TCP/IP protocol. For this manual, the protocol is referred to as RAW TCP/IP to distinguish it from the other industrial protocols. In the RAW TCP/IP environment, the HS500E acts as the server and the Host or PLC acts as client. NOTE: The RAW TCP/IP Client (Host or PLC) must connect to the RAW TCP/IP Server (HS500E) on port 50200.
CHAPTER 7: RAW TCP/IP PROTOCOL 7.2 RAW TCP/IP C O M M A N D & R E S P O N S E EXAMPLES In RAW TCP/IP, RFID commands issued by the Host resemble Modbus TCP commands; however RAW TCP/IP commands require an additional two-byte header (which includes 0xFF in the MSB, and 0x01 - the Node ID of the HS500E - in the LSB). These two bytes are inserted in front of the standard Modbus TCP command string.
CHAPTER 7: RAW TCP/IP PROTOCOL 7.2.
APPENDIX A: IP ADDRESS RESET A PPENDIX A: IP A DDRESS R ESET To reset the IP address of the HS500E to factory default values, follow the steps below: 1. Disconnect the power supply and remove the Ethernet cable. 2. With a blunt toothpick (or similar non-metallic object), gently press and hold the small blue-colored button located within the RJ45 Ethernet connection socket. This is the HS500E’s IP Address Reset Button. 3. While continuing to press the reset button, re-connect power to the unit. 4.
APPENDIX B: ASCII CHART A PPENDIX B: ASCII C HART HS500E – OPERATOR’S MANUAL P/N: 17-1305 REV02 (12-05) PAGE 61 OF 82
APPENDIX B: ASCII CHART HS500E – OPERATOR’S MANUAL P/N: 17-1305 REV02 (12-05) PAGE 62 OF 82
APPENDIX C: ETHERNET/IP – OBJECT MODEL A PPENDIX C: E THERNET /IP - O BJECT M ODEL The Object Model is the logical organization of attributes (parameters) within classes (objects) and services supported by each device. Objects are broken down into three categories: Required Objects, Vendor Specific Objects and Application Objects. Required Objects are classes that must be supported by all devices on EtherNet/IP. The HS500E has six Required Objects.
APPENDIX C: ETHERNET/IP – OBJECT MODEL C.1 E T H E R N E T /IP - R E Q U I R E D O B J E C T S Under Ethernet/IP, the HS500E has six Required Objects: Required Objects: Identity Object (0x01) Message Router Object (0x02) Assembly Object (0x04) Connection Manager Object (0x06) TCP Object (0xF5) Ethernet Link Object (0xF6) C.1.
APPENDIX C: ETHERNET/IP – OBJECT MODEL 7 Product Name Get Structure of: Product Name Size USINT 11 Product Name String USINT[26] “HS500E” Status Word Bit Bit = 0 Bit = 1 0 No I/O Connection I/O Connection Allocated 1 – 15 Unused Unused Common Services Service Code Implemented for Service Name Class Level Instance Level 0EHEX Yes Yes Get_Attribute_Single 05HEX No Yes Reset HS500E – OPERATOR’S MANUAL P/N: 17-1305 REV02 (12-05) PAGE 65 OF 82
APPENDIX C: ETHERNET/IP – OBJECT MODEL C.1.2 Message Router Object (0x02) This object has no supported attributes. C.1.
APPENDIX C: ETHERNET/IP – OBJECT MODEL Instance 0x65 Attributes (Input Instance 2) Attribute ID Name 3 Serial Produce Data Data Type Default Data Value Access Rule Get Structure of: Consume Data Seq.
APPENDIX C: ETHERNET/IP – OBJECT MODEL Instance 0x70 Attributes (Output Instance 1) Attribute ID Name 3 Serial Consume Data Data Type Default Data Value Access Rule Get / Set Structure of: Produce Data Seq.
APPENDIX C: ETHERNET/IP – OBJECT MODEL Instance 0x71 Attributes (Output Instance 2) Attribute ID Name 3 Serial Consume Data Data Type Default Data Value Access Rule Get / Set Structure of: Produce Data Seq.
APPENDIX C: ETHERNET/IP – OBJECT MODEL C.1.4 Connection Manager Object (0x06) This object has no attributes. C.1.
APPENDIX C: ETHERNET/IP – OBJECT MODEL Interface Configuration 5 5 Get Structure of: IP Address UDINT 0 Network Mask UDINT 0 Gateway Address UDINT 0 Name Server UDINT 0 Name Server 2 UDINT 0 Domain Name Size UINT 0 Domain Name STRING 0 Host Name 6 6 Get Structure of: Host Name Size UINT 0 Host Name STRING 0 Common Services Service Code 0EHEX Implemented for Service Name Class Level Instance Level Yes Yes Get_Attribute_Single 5 See section 5-3.2.2.
APPENDIX C: ETHERNET/IP – OBJECT MODEL C.1.
APPENDIX C: ETHERNET/IP – OBJECT MODEL C.2 VENDOR SPECIFIC OBJECTS C.
APPENDIX C: ETHERNET/IP – OBJECT MODEL … … … … … 34 Consume Data [8,000-8,249] UINT 0 Get / Set … … … … … 38 Consume Data [9,000-9,249] UINT 0 Get / Set … … … … … 42 Consume Data [10,000-10,249] UINT 0 Get / Set … … … … … 82 Consume Data [20,000-20,249] UINT 0 Get / Set … … … … … 122 Consume Data [30,000-30,249] UINT 0 Get / Set … … … … … 126 Consume Data [31,000-31,249] UINT 0 Get / Set … … … … … 130 Consume Data [32,000-32,249] UINT 0 G
APPENDIX C: ETHERNET/IP – OBJECT MODEL Common Services Service Code 10 Implemented for Service Name Class Level Instance Level 05HEX No Yes Reset 10 0EHEX Yes Yes Get Attribute Single 10HEX No Yes Set Attribute Single This Service Code is used to flush all attributes to zero.
APPENDIX C: ETHERNET/IP – OBJECT MODEL C.
APPENDIX C: ETHERNET/IP – OBJECT MODEL … … … … … 38 Produce Data [9,000-9,249] UINT 0 Get … … … … … 42 Produce Data [10,000-10,249] UINT 0 Get … … … … … 82 Produce Data [20,000-20,249] UINT 0 Get … … … … … 122 Produce Data [30,000-30,249] UINT 0 Get … … … … … 126 Produce Data [31,000-31,249] UINT 0 Get … … … … … 130 Produce Data [32,000-32,249] UINT 0 Get 131 Produce Data [32,250-32,249] UINT 0 Get 132 Produce Data [32,500-32,249] UINT 0
APPENDIX C: ETHERNET/IP – OBJECT MODEL Common Services Service Code 11 Implemented for Service Name Class Level Instance Level 05HEX No Yes Reset 11 0EHEX Yes Yes Get Attribute Single 10HEX No Yes Set Attribute Single This Service Code is used to flush all attributes to zero.
APPENDIX C: ETHERNET/IP – OBJECT MODEL C.
APPENDIX C: ETHERNET/IP – OBJECT MODEL 14 Write File Offset (SLC/PLC Only) UINT 0 Get UINT 100 Get UINT 0 Get N7:Y where Y is the File Offset 15 Write Heartbeat Timeout: 0 = disabled 5-60000 ticks = enable (10ms Resolution) 21 Max Read Size in Words 0 – Disable 1 – 100 Words 22 Read Tag Name (ControlLogix Only) SHORT STRING 0 Get 23 Read File Number (SLC/PLC Only) UINT 7 Get UINT 0 Get UINT 100 Get NX:0 where X is the File Number 24 Read File Offset (SLC/PLC Only) N7:Y where
APPENDIX C: ETHERNET/IP – OBJECT MODEL Common Services Service Code 0EHEX Implemented for Service Name Class Level Instance Level Yes Yes HS500E – OPERATOR’S MANUAL Get Attribute Single P/N: 17-1305 REV02 (12-05) PAGE 81 OF 82
EMS WARRANTY EMS WARRANTY Escort Memory Systems warrants that all products of its own manufacturing conform to Escort Memory Systems’ specifications and are free from defects in material and workmanship when used under normal operating conditions and within the service conditions for which they were furnished.