Allen Bradley DF1 Protocol and Command Set Reference Manual
Important User Information Because of the variety of uses for the products described in this publication, those responsible for the application and use of this control equipment must satisfy themselves that all necessary steps have been taken to assure that each application and use meets all performance and safety requirements, including any applicable laws, regulations, codes and standards.
Summary of Changes What's Changed in This Document About This Document This document contains important information concerning the DF1 Protocol and Command Set Reference Manual. This information extends and explains information provided in the Data Highway/Data Highway Plust/DH-485 Communication Protocol and Command Set Reference Manual, publication 1770-6.5.16 — November 1991 Changes to this document are indicated by a revision bar in the margin.
Table of Contents What's Changed in This Document . . . . . . . . . . . . . . soc-i About This Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Changes to This Document . . . . . . . . . . . . . . . . . . . . . . . . . soc-i soc-i About This Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . P-1 Purpose of This Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . Who Should Use This Manual . . . . . . . . . . . . . . . . . . . . . . . What This Manual Contains . .
ii Table of Contents Using Half duplex Protocols to Send and Receive Messages . . . . . . . . . . . . . . . . . . . . . . . 3-1 Half duplex Protocol Message Transmission . . . . . . . . . . . . Transmitter and Receiver Message Transfer . . . . . . . . . . . . Half duplex Protocol Environment . . . . . . . . . . . . . . . . . . . . Message Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . Master Polling Responsibilities . . . . . . . . . . . . . . . . . . . . . . Duplicate Detection . .
Table of Contents iii Data link Layer Message Frames . . . . . . . . . . . . . . . . 5-1 Half duplex Protocol Message Frames . . . . . . . . . . . . . . . . . Polling Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Master Message Frame . . . . . . . . . . . . . . . . . . . . . . . . . Slave Message Frame . . . . . . . . . . . . . . . . . . . . . . . . . . Full duplex Protocol Message Frames . . . . . . . . . . . . . . . . . From user application program . . . . . . . . . . . . . .
iv Table of Contents echo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . enable outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . enable PLC scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . enter download mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . enter upload mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . exit download/upload mode . . . . . . . . . . . . . . . . . . . . . . . . .
Table of Contents v word range read (read block) . . . . . . . . . . . . . . . . . . . . . . word range write (write block) . . . . . . . . . . . . . . . . . . . . . . . write bytes physical (physical write) . . . . . . . . . . . . . . . . . . PLC 5 Type/Data Parameter Examples . . . . . . . . . . . . . . . . SLC 500 Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reading and Writing SLC 500 Data . . . . . . . . . . . . . . . . . . .
vi Table of Contents 1775 Cat. Nos. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1775 KA, S5, SR5 DH Diagnostic Counters . . . . . . . . . . . 1775 S5, SR5 DH+ Diagnostic Counters . . . . . . . . . . . . . 1779 Cat. Nos. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1779 KP5 DH+ Diagnostic Counters . . . . . . . . . . . . . . . . 1784 Cat. Nos. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1784 KT and 1784 KT2 DH+ Diagnostic Counters . . .
Table of Contents vii 1785 LT (PLC 5/15) and 6008 LTV (PLC 5 VME) Status Bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1785 LT3 (PLC 5/12) and 1785 LT2 (PLC 5/25) Status Bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1785 L11B, L20B, L20E, L30B, L40B, L40E, L40L, L60B, L60L Status Bytes . . . . . . . . . . . . . . . . . . . . 5130 Cat. Nos. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5130 RM1, RM2 (PLC 5/250) Status Bytes . . . . . . .
viii Table of Contents Downloading to an SLC 500 Processor . . . . . . . . . . . . . . Procedure 1 SLC 500, SLC 5/01 and SLC 5/02 Processors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Procedure 2 SLC 5/03 and SLC 5/04 Processors . . . 12-10 12-11 12-12 PLC Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-1 PLC 2/1774 PLC Addressing . . . . . . . . . . . . . . . . . . . . . . . PLC 2/1774 PLC Logical Addressing . . . . . . . . . . . . . . . .
Preface About This Manual Read this preface to familiarize yourself with this manual.
P–2 About This Manual What This Manual Contains ➊Network Basics Chapter 1, Network Layers This manual is divided into five units: ➋Protocol ➌Message Packets ➍Module Diagnostics ➎Reference Chapter 2, Understanding DF1 Protocol Chapter 5, Data link Layer Message Frames Chapter 9, Diagnostic Counters Chapter 11, Data Encoding Chapter 3, Using Half duplex Protocol to Send and Receive Messages Chapter 6, Application Layer Message Packets Chapter 10, Diagnostic Status Information Chapter 12, Upload
About This Manual Terms and Abbreviations P–3 Term local node Definition The node sending the command node The point at which devices, such as programmable controllers, interface to the network. Each device on a network must have a unique node address. In some Allen Bradley documentation, you may find the term station used in place of the term node. Related Publications physical link Cable and associated hardware, such as transmitter and receiver circuits.
P–4 About This Manual Related Products Allen-Bradley offers a wide range of interfaces for the DH, DH+, and DH485 networks, including: Catalog Number Product 1747 KE DH485/RS 232 Interface Module Related Documentation 1747 2.3.7, product data 1747 6.12, user manual 1770 KF2 DH or DH+ Asynchronous (RS 232 or RS 422 A) Interface Module 1770 6.5.13, user manual 1770 6.5.13 RN1 release notes 1770 KF3 DH485 Asynchronous (RS 232) Interface Module 1770 6.5.18, user manual 1770 6.5.
About This Manual " P–5 Communication, diagnostic, and driver software DH 6001-NET Network Communications Software (Series 6001) provides a DH driver for many DEC computers. For more information, refer to the DH/DH+/DH II Network Communication Software Overview (publication 6006-2.3). Conventions Used in This Manual We use these conventions in this manual: This convention: " Is used to: call attention to helpful information refer you to other Allen Bradley documents that might be useful 1770 6.5.
Network Basics Network Layers Chapter 1
Chapter 1 Network Layers Your network is made up of several layers, including: Nodes send data through the layers. Application layer serves as the window through which applications access communication services, including file transfers, virtual terminal functions, and email. Presentation layer manages data formats for the applications. Session layer establishes and terminates network communications between applications. Transport layer performs segmentation and re assembly of messages.
1–2 Network Layers Physical Layer The physical layer is a set of cables and interface modules that provides a channel for communication between the nodes. A node is a connection point onto a network, typically containing a unique address.
Network Layers 1–3 DH Link A DH link is a local area network (LAN) designed for factory-floor applications. This link accepts 64 devices and can transmit 57.6 K bits of data per second. A DH link consists of a trunk cable up to 10,000 feet (3,048 meters) long and drop cables as long as 100 feet (30.48 meters) each. Each node is at the end of a drop cable and connects to the DH link through a station connector (cat. no. 1770-SC). This is the only configuration tested and supported by Allen-Bradley.
1–4 Network Layers Unlike a master/slave relationship, a floating master relationship does not require the current master to poll each node to grant permission to transmit. Therefore, it provides a more efficient network because there is less overhead—i.e., time—per transaction. PLC 2/30 processor personal computer SC = station connector; 1770 SC 1771 KG modem modem PLC 3 processor cat. nos. 1775 KA or S5 SC PLC 5/250 processor 5130 RM1 RS 232 C link (50 cable ft. max.
Network Layers 1–5 DH+ Link A DH+ link is similar to a DH link, but is optimally used for smaller networks consisting of limited nodes (about 15 maximum). A DH+ link accepts 64 devices and can transmit data at 57.6, 115.2, or 230.4K bits. (PLC-5/250, SLC, and PLC processors support 57.6 and 115.2K bits; SLC 5/04 processors support 230.4K bits; PLC-5 processors are expected to support 230.4K bits early in 1997.) This processor Connects to a DH+ link PLC 2 through the PLC 2 Family Interface module (cat.
1–6 Network Layers DH485 Link A DH485 link is a low cost, peer-to-peer programming and data-acquisition link for a variety of Allen-Bradley products. DH485 topology is similar to DH and DH+ topology. You can connect as many as 32 nodes to a DH485 link. The DH485 link is based on the Electrical Industries Association (EIA) Standard RS-485 Electrical Signalling Specification.
Network Layers Software Layers 1–7 Your DF1 links and network links (DH, DH+, and DH485) each use two layers of software to enable communication: • the data-link layer • the application layer This figure shows how these layers fit together.
1–8 Network Layers Application Layer This layer controls and executes the actual commands specified in the communication between nodes. This layer is the same for both DF1 and network links. The application layer: • interfaces to user processes and databases • interprets commands • formats user data into packets The application layer depends upon the type of node the application is running on since it must interface to the user process and interpret the user database.
Network Layers " 1–9 Messages See Chapter 7, “Communication Commands,” for: • a description of the command messages for each type of PLC processor • information on how to program the application layer fields of a message packet for an asynchronous link Message Packet Structure All messages on a network have the same fundamental structure, regardless of their function or destination.
1–10 Network Layers Message Priority You specify the priority level for each DH command in the message command code. The node that receives a command message must establish the same priority level for its corresponding reply message: This link Classifies a message as DH high priority or normal priority Priority levels of messages determine the order in which nodes transmit messages on a DH link.
Network Layers 1–11 Types of Commands From your computer on a DF1 link to a node on a DH, DH+ or DH485 link, you can send four types of commands: • read • write • diagnostic • upload/download For additional information on the commands you can send, see Chapter 7, “Communication Commands.” Error Codes When your computer sends a command on the asynchronous link, a status code is returned in the reply message. This code tells you the status of the command sent from your computer.
Protocol Understanding DF1 Protocol Chapter 2 Using Half duplex Protocols to Send and Receive Messages Chapter 3 Using Full duplex Protocols to Send and Receive Messages Chapter 4
Chapter 2 Understanding DF1 Protocol If you are connecting an interface module to a computer, you must program the computer to understand and issue the proper protocol character sequences.
2–2 Understanding DF1 Protocol DF1 Protocol A link protocol is a set of programming rules for interpreting the signals transmitted over a physical link. A protocol, such as DF1: • carries a message, error free, from one end of the link to the other It has no concern for the content of the message, the function of the message, or the ultimate purpose of the message.
Understanding DF1 Protocol " 2–3 Using half-duplex protocol When you use half-duplex protocol, the intended environment is a multidrop link with all nodes interfaced through half-duplex modems. Unless there is only one slave directly connected to a master, you must use a modem.
2–4 Understanding DF1 Protocol Full duplex Protocol Use full-duplex protocol: • over a point-to-point link that allows two-way simultaneous transmission • over a multidrop link where interface modules are able to arbitrate transmission on the link • for high performance applications where it is necessary to get the highest possible throughput from the available medium If you connect an interface module to another Allen-Bradley communication interface module, the modules automatically handle the link arbit
Understanding DF1 Protocol Character Transmission 2–5 Allen-Bradley interface modules send data serially over the RS-232-C/RS-422-A interface, one 10-bit byte—11-bit byte with parity—at a time. The transmission format conforms to ANSI X3.16, CCITT V.4, and ISO 1177 standards, with the exception that the parity bit is retained while the data length is extended to eight bits. Make sure that your computer conforms to this mode of transmission.
2–6 Understanding DF1 Protocol Transmission Symbols Both half-duplex and full-duplex protocols are character-oriented. They use the ASCII control characters in the tables below, extended to eight bits by adding a zero for bit 7: Table 2.A Half duplex Protocol Abbreviation Hexadecimal Value Binary Value STX 02 0000 0010 SOH 01 0000 0001 ETX 03 0000 0011 EOT 04 0000 0100 ENQ 05 0000 0101 ACK 06 0000 0110 DLE 10 0001 0000 NAK 0F 0000 1111 Table 2.
Understanding DF1 Protocol 2–7 Table 2.C Half duplex Transmission Symbols Symbol Type Meaning DLE SOH control symbol Sender symbol that indicates the start of a master message. DLE STX control symbol Sender symbol that separates the multi drop header from the data. DLE ETX BCC/CRC control symbol Sender symbol that terminates a message. DLE ACK control symbol Response symbol which signals that a message has been successfully received.
2–8 Understanding DF1 Protocol Table 2.D Full duplex Transmission Symbols Publication 1770 6.5.16 - October 1996 Symbol Type Meaning DLE STX control symbol Sender symbol that indicates the start of a message frame. DLE ETX BCC/CRC control symbol Sender symbol that terminates a message frame. DLE ACK control symbol Response symbol which signals that a message frame has been successfully received.
Chapter 3 Using Half duplex Protocols to Send and Receive Messages In half-duplex protocol, devices share the same data circuits, therefore only one device can “talk” at a time. Half-duplex protocol can be likened to a one-lane bridge: each car must wait its turn to cross the bridge. (To compare half-duplex to full-duplex protocol, refer to Chapter 4, “Using Full-duplex Protocols to Send and Receive Messages.”) Read this chapter to help learn how to use half-duplex protocol to send and receive messages.
3–2 Using Half-duplex Protocols to Send and Receive Messages Half duplex Protocol Message Half-duplex protocol: Transmission • is a multidrop protocol for one master and one or more slaves • provides a lower data throughput than full-duplex • allows communication with each node on the multidrop link • allows communication with nodes on links connected to the multidrop link If the master is programmed to relay messages, then nodes on the multidrop can engage in virtual slave-to-slave transfers.
Using Half-duplex Protocols to Send and Receive Messages Transmitter and Receiver Message Transfer 3–3 Each node on a multidrop link contains a software routine to transmit and receive messages. DH and DH+ interface modules already contain a slave transceiver routine, so they can be configured to function as slave nodes in half-duplex mode. Instead of a single routine, you can program separate transmitter and receiver routines. However, in this chapter, we assume you are using a single routine.
3–4 Using Half-duplex Protocols to Send and Receive Messages The following program describes the actions of the transceiver in detail: TRANSCEIVER is defined variables LAST-HEADER is 4 bytes copied out of the last good message BCC is an 8-bit block check accumulator LAST-HEADER = invalid loop reset parity error flag GET-CODE if it’s a DLE SOH then begin GET-CODE if it’s a data code and it matches the station number or it is 255 (the broadcast address) then begin BCC = the data code GET-CODE if it’s a DLE
Using Half-duplex Protocols to Send and Receive Messages 3–5 GETMESSAGE is defined as GET-CODE while it is data code begin if buffer is not overflowed put data in buffer GET-CODE end if it is a control code and it is an ETX then begin if parity error flag is set then return a NAK if BCC is not zero then return a NAK if message is too small then return a NAK if message is too large then return a NAK return an ACK end else end GET-CODE is defined as loop variable GET-CHAR if char is not a DLE begin add char
3–6 Using Half-duplex Protocols to Send and Receive Messages The following flowchart shows the software logic for implementing half-duplex protocol from the master node’s point of view: XCVR Yes Does master have message to send? No Select node Send poll Start timeout Receive DLE EOT? No Receive message? No Yes Node in active list? Yes Yes No Active node? Duplicate message? No Send message to application layer Add node to active list Get message from application layer 3 timeouts this poll?
8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV 0HVVDJH &KDUDFWHULVWLFV ï ,GHDOO\ WKH GDWD OLQN OD\HU SURWRFRO LV QRW FRQFHUQHG ZLWK WKH FRQWHQW RU IRUP RI WKH PHVVDJHV LW LV WUDQVIHUULQJ +RZHYHU KDOI GXSOH[ SURWRFRO SODFHV WKH IROORZLQJ UHVWULFWLRQV RQ WKH PHVVDJHV WKDW DUH VXEPLWWHG WR LW IRU WUDQVIHU 0LQLPXP VL]H RI OLQN OD\HU GDWD LV E\WHV 0D[LPXP VL]H RI OLQN OD\HU GDWD GHSHQGV RQ WKH DSSOLFDWLRQ OD\HU FRPPDQG 6RPH SURWRFRO LPSOHPHQWDWLRQV UHTXLUH WKDW WKH ILUVW E\WH RI D PHV
ï 8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV )XOO 6LQNV :KHQ D QRGH WLPHV RXW WR D PHVVDJH FRPPDQG SROO WKH QRGH WR VHH LI LW UHVSRQGV ,I LW UHVSRQGV WR WKH SROO ZLWK D '/( (27 EXW FRQVLVWHQWO\ IDLOV WR $&.
8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV 6ODYH 7UDQVFHLYHU $FWLRQV ï 6LQFH LQSXW VHQW WR WKH WUDQVFHLYHU FDQ RIWHQ EH DIIHFWHG E\ QRLVH IURP WKH SK\VLFDO ZRUOG WKH WUDQVFHLYHU PXVW EH FDSDEOH RI UHVSRQGLQJ WR PDQ\ DGYHUVH VLWXDWLRQV VXFK DV 7KH PHVVDJH VLQN FDQ EH IXOO OHDYLQJ QRZKHUH WR SXW D PHVVDJH $ PHVVDJH FDQ FRQWDLQ D SDULW\ HUURU 7KH %&& &5& FDQ EH LQYDOLG 7KH '/( 62+ '/( 67; RU '/( (7; %&& &5& PD\ EH PLVVLQJ 7KH PHVVDJH FDQ EH WRR ORQJ RU WRR VKRUW $ VS
ï 8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV 9HULILHV '/( (7; %&& &5& 3HUIRUPV GXSOLFDWH GHWHFWLRQ 5HFHLYHV D SROO ,I DQ\ FRQWURO V\PERO RWKHU WKDQ D '/( (7; %&& &5& LV UHFHLYHG DW WKH HQG RI WKH SDFNHW WKH PHVVDJH LV GLVFDUGHG DQG DOO LQSXW LV LJQRUHG XQWLO WKH QH[W '/( 62+ RU '/( (14 LV UHFHLYHG :KHQ WKH '/( (7; %&& &5& LV UHFHLYHG WKH HUURU IODJ WKH %&& &5& WKH PHVVDJH VL]H DQG WKH DGGUHVV RSWLRQDOO\ DUH DOO YHULILHG ,I '/( (7; %&& &5& FRQWHQW LV 7KHQ WKH LQFRUUHFW PHVVDJH
8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV ï 7UDQVPLWV D PHVVDJH :KHQ D PHVVDJH LV WUDQVPLWWHG DIWHU UHFHLYLQJ D SROO LWV IRUPDW LV LGHQWLFDO WR D IXOO GXSOH[ PHVVDJH SDFNHW $IWHU VHQGLQJ D PHVVDJH WKH WUDQVFHLYHU KROGV WKH PHVVDJH XQWLO D '/( $&. LV UHFHLYHG RU WKH QXPEHU RI WLPHV WKH PHVVDJH KDV EHHQ SROOHG H[FHHGV WKH OLPLW 5HFHLYHV '/( $&. :KHQ D '/( $&.
ï 8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV 1RUPDO 0HVVDJH 7UDQVIHU ,Q WKLV WUDQVIHU GDWD E\WHV DUH VHQW IURP WKH VRXUFH WR WKH PDVWHU DQG WUDQVPLWWHG WR D VODYH WKH VLQN VHQGV D ´QRW IXOOµ PHVVDJH WKH GDWD LV VHQW WR WKH VLQN DQG D '/( $&. LV VHQW WR WKH PDVWHU WKH PDVWHU WHOOV WKH VRXUFH WKDW WKH PHVVDJH ZDV GHOLYHUHG 6RXUFH 6LQN 0DVWHU [[[[ /LQN 6RXUFH 6LQN 6ODYH '/( 62+ 671 '/( 67; [[[[ '/( (7; %&& &5& QRW IXOO [[[[ '/( $&. 2.
8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV ï 0HVVDJH 7UDQVIHU ZLWK $&. 'HVWUR\HG ,Q WKLV WUDQVIHU WKH PDVWHU VHQGV D PHVVDJH WKH VODYH DFFHSWV WKH PHVVDJH DQG UHWXUQV D '/( $&. EXW WKH '/( $&. LV GHVWUR\HG WKH PDVWHU UH WUDQVPLWV DQG SURFHHGV ZLWK D QRUPDO PHVVDJH WUDQVIHU ,I GXSOLFDWH GHWHFW LV HQDEOHG WKH GXSOLFDWH PHVVDJH LV GLVFDUGHG 6RXUFH 6LQN 0DVWHU [[[[ /LQN 6ODYH 6RXUFH 6LQN '/( 62+ 671 '/( 67; [[[[ '/( (7; %&& &5& QRW IXOO [[[[ '/("""&.
ï 8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV 3ROO ZLWK 0HVVDJH 5HWXUQHG ,Q WKLV WUDQVIHU WKH PDVWHU SROOV IRU D PHVVDJH DQG WKH VODYH UHWXUQV D PHVVDJH ZLWK IDXOW\ GDWD VLQFH LW GLG QRW UHFHLYH D '/( $&. RQ LWV ILUVW DWWHPSW WKH VODYH UH WUDQVPLWV WKH VDPH PHVVDJH WKH PDVWHU UHVSRQGV ZLWK D '/( $&. 6RXUFH 6LQN QRW IXOO 0DVWHU /LQN 6ODYH 6RXUFH 6LQN '/( (14 671 %&& [[[[ '/( 67; [["""[[ '/( (7; %&& &5& '/( (14 671 %&& '/( 67; [[[[ '/( (7; %&& &5& VDPH PHVVDJH [[[[ '/( $&.
8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV ï 'XSOLFDWH 0HVVDJH 7UDQVPLVVLRQ ,Q WKLV WUDQVIHU D VODYH GRHV QRW UHFHLYH D '/( $&. IURP WKH PDVWHU DIWHU WKH PDVWHU UHFHLYHV WKH VODYH·V PHVVDJH ZKHQ WKH PDVWHU SROOV WKH VODYH DJDLQ WKH VODYH VHQGV WKH VDPH PHVVDJH WKH PDVWHU VHQGV D '/( $&.
ï 8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV 0HVVDJH 6LQN )XOO &DVH ,Q WKLV WUDQVIHU WKH VODYH·V PHVVDJH VLQN LV IXOO ,I D VODYH GRHV QRW UHVSRQG WR D FRPPDQG WKHQ WKLV PLJKW LQGLFDWH WKDW WKH VODYH·V EXIIHUV DUH IXOO ,I WKH VODYH·V EXIIHUV DUH IXOO WKHQ D SROO E\ WKH PDVWHU UHVXOWV LQ WKH VODYH WUDQVPLWWLQJ D UHSO\ RWKHU WKDQ '/( (27 6RXUFH 6LQN 0DVWHU [[[[ /LQN 6ODYH 6RXUFH 6LQN '/( 62+ 671 '/( 67; [[[[ '/( (7; %&& &5& IXOO WLPHRXW QRW IXOO VRPHWLPH ODWHU '/( 62+
8VLQJ +DOI GXSOH[ 3URWRFROV WR 6HQG DQG 5HFHLYH 0HVVDJHV ï 0HVVDJH 6LQN )XOO &DVH ,Q WKLV WUDQVIHU WKH VODYH·V PHVVDJH VRXUFH DQG PHVVDJH VLQN VKDUH WKH VDPH PHPRU\ SRRO DV ZLWK WKH .
Chapter 4 Using Full duplex Protocol to Send and Receive Messages In full-duplex protocol, devices share the same data circuits, and both devices can “talk” at the same time. Full-duplex protocol can be likened to a two-lane bridge: traffic can travel in both directions at one time. (To compare full-duplex to half-duplex protocol, refer to Chapter 3, “Using Half-duplex Protocols to Send and Receive Messages.”) Read this chapter to help learn how to use full-duplex protocol to send and receive messages.
4–2 Using Full-duplex Protocol to Send and Receive Messages Full duplex Protocol Message Transmission With full-duplex protocol, a link uses two physical circuits for two-way simultaneous message transmission (command or reply message packets). These two physical circuits provide communication on four logical paths: Figure 4.
Using Full-duplex Protocol to Send and Receive Messages 4–3 Figure 4.
4–4 Using Full-duplex Protocol to Send and Receive Messages Figure 4.3 shows the protocol environment for message symbols from transmitter A to receiver B (path 1) and response codes from receiver B to transmitter A (path 2). Figure 4.
Using Full-duplex Protocol to Send and Receive Messages 4–5 How the Transmitter Operates The following program describes the actions of the transmitter: Whenever the message source can supply a message packet and the transmitter is not busy, it sends a frame on the link to the destination address. It then starts a timeout, and waits for a response. When this response is received from the receiving address The message packet DLE ACK has been successfully transferred.
4–6 Using Full-duplex Protocol to Send and Receive Messages The following flowcharts the software logic for implementing the transmitter: T retransmit same message message frame DLE STX Data DLE ETX BCC/CRC Field timeout loop Received DLE ACK? Yes Legend: T = Ready to transmit next message P = Recovery procedure * = Default values used by the module No Received DLE NAK? No Timed out? Yes Yes T 3* NAKs received for this message? Yes P Yes 3* ENQ sent? No No DLE Important: Public
Using Full-duplex Protocol to Send and Receive Messages 4–7 How the Receiver Operates The receiver must be capable of responding to adverse situations.
4–8 Using Full-duplex Protocol to Send and Receive Messages The following program describes the actions of the receiver in detail. The receiver keeps a record of the last response sent to the transmitter. The value of this response is either DLE ACK or DLE NAK. It is initialized to DLE NAK. When a DLE ENQ (enquiry) is received from the transmitter, the receiver sends the value of the last response. The receiver ignores all input until a DLE STX or DLE ENQ is received.
Using Full-duplex Protocol to Send and Receive Messages 4–9 The following flowchart is the software logic for implementing the receiver. RCVE LAST = NAK Received DLE ENQ? Yes No No Received message? Yes BCC/ CRC OK? No LAST = NAK Yes LAST = ACK Send DLE LAST Publication 1770 6.5.
4–10 Using Full-duplex Protocol to Send and Receive Messages Full duplex Protocol Diagrams These transfer diagrams show events that occur on various interfaces. Time is represented as increasing from the top of the diagram to the bottom. Link-layer data bytes are represented by “xxxx” and corrupted data by “???”.
Using Full-duplex Protocol to Send and Receive Messages 4–11 Message Transfer with NAK In this transfer: • the transmitter sends corrupted data to the receiver and the receiver responds with a DLE NAK • the transmitter retransmits and the transmission is successful • the receiver sends a DLE ACK to the transmitter • reply is successfully returned Source Transmitter command xxxx Link Receiver Sink DLE STX x???x DLE ETX BCC/CRC DLE NAK DLE STX xxxx DLE ETX BCC/CRC not full xxxx DLE ACK OK reply (so
4–12 Using Full-duplex Protocol to Send and Receive Messages Message Transfer with Timeout and ENQ In this transfer: • the receiver receives a transmission, but sends back a DLE ACK that is corrupted • the transmitter times out waiting for the DLE ACK and sends a DLE ENQ • the receiver sends back a DLE ACK • a reply is successfully returned Source Transmitter command xxxx Link DLE STX xxxx DLE ETX BCC/CRC DL???CK Receiver Sink not full xxxx (timeout) DLE ENQ DLE ACK OK reply (sometime later ...
Using Full-duplex Protocol to Send and Receive Messages 4–13 Message Transfer with Re Transmission In this transfer: • noise destroys the DLE ACK while also producing invalid characters at the receiver • because of the invalid characters, the receiver changes its last response variable to a DLE NAK • since the DLE ACK was destroyed, the transmitter sends a DLE ENQ (enquiry), and the receiver returns the DLE NAK • the transmitter retransmits the message and the receiver sends an ACK • the receiver discards
4–14 Using Full-duplex Protocol to Send and Receive Messages Message Transfer with Message Sink Full In this transfer: • the transmitter sends a message but the message sink is full, so the receiver sends back a DLE NAK • the transmitter retransmits and the sink is no longer full, so the receiver returns a DLE ACK • a reply is successfully returned Source Transmitter command xxxx Link DLE STX xxxx DLE ETX BCC/CRC Receiver Sink Full DLE NAK DLE STX xxxx DLE ETX BCC/CRC Full DLE NAK DLE STX xxxx D
Using Full-duplex Protocol to Send and Receive Messages 4–15 Message Transfer with NAK on Reply In this transfer: • the message is successfully transmitted on the network • the reply is corrupted and the transmitter responds with a DLE NAK • the reply is sent again and is successful Source Transmitter command xxxx Link Receiver DLE STX xxxx DLE ETX BCC/CRC DLE ACK Sink not full xxxx OK (sometime later ...
4–16 Using Full-duplex Protocol to Send and Receive Messages Message Transfer with Timeout and ENQ for the Reply In this transfer: • the message is successfully transmitted on the network • the receiver sends a reply from the network but the transmitter sends back a DLE ACK that is corrupted • the receiver times out waiting for the DLE ACK and sends a DLE ENQ • the transmitter sends back a DLE ACK Source Transmitter command xxxx Link DLE STX xxxx DLE ETX BCC/CRC DLE ACK Receiver Sink not full xxxx
Using Full-duplex Protocol to Send and Receive Messages 4–17 Message Transfer with Message Source Full on the Reply In this transfer: • the message is successfully transmitted on the network • the receiver sends a reply but the message source is full, so the transmitter sends back a DLE NAK • the receiver retransmits and the source is no longer full, so the transmitter returns a DLE ACK Source Transmitter command xxxx Link Receiver DLE STX xxxx DLE ETX BCC/CRC DLE ACK Sink not full xxxx OK (somet
Message Packets Data link Layer Message Frames Chapter 5 Application Layer Message Packets Communication Commands Chapter 6 Chapter 7 Message Packet Status Codes (STS and EXT STS) Chapter 8
Chapter 5 Data link Layer Message Frames In the data-link layer of a message frame: • half-duplex protocol uses three types of message transmission • full-duplex protocol implements its message fields at different network layers • at the end of each polling and message frame, there is a one-byte BCC field or a two-byte CRC field Read this chapter to help learn the fields that your computer uses in the data-link layer of a message frame.
5–2 Data-link Layer Message Frames Half duplex Protocol Message Frames Half-duplex protocol uses three types of transmissions: • polling frame • master message frame • slave message frame The master node transmits both polling frames and master message frames, and slave nodes transmit slave message frames. The following figure illustrates the formats of these frames. The slave message frame has the same format as the full-duplex message frame.
Data-link Layer Message Frames Full duplex Protocol Message Frames Full-duplex protocol implements different message frames, depending on the network layer.
5–4 Data-link Layer Message Frames BCC and CRC Fields At the end of each polling frame and each message frame, there is a one-byte BCC (block check character) field, or a two byte CRC (cyclic redundancy check) field. You select BCC or CRC through switch settings or software configuration.
Data-link Layer Message Frames 5–5 Full-duplex protocol example If a message frame contained the data 08. 09, 06, 00, 02,04, and 03 (decimal), the message symbols are: 10 DLE 02 STX 08 09 06 00 02 04 03 APP DATA 10 03 DLE ETX E0 BCC The sum of the application data bytes in this message frame is 32 decimal or 20 hex. The BCC is the 2's complement of this sum, or E0 hex.
5–6 Data-link Layer Message Frames CRC Field For these protocols You calculate the CRC value➀ full duplex using the value of the link layer data bytes and the ETX byte. half duplex •for master messages using the value of the link layer data bytes and the STN, STX and ETX bytes➁ •for slave messages using the value of the link layer data bytes and the ETX byte ➀ The polynomial for a CRC value is: X16 + X15 + X2 + X0. ➁ Do not add in the associated DLE for STX and ETX values.
Data-link Layer Message Frames 5–7 The full-duplex and half-duplex slave and master protocol examples below provide you with procedures for determining the CRC-16 value.
Chapter 6 Application Layer Message Packets Read this chapter to help learn about the application layer for your asynchronous driver and the fields that your computer uses in the application layer of a message packet. It contains these sections: Section Page How Your Application Program Sends and Receives Messages 6-2 Message Packet Format 6-3 Publication 1770 6.5.
6–2 Application Layer Message Packets How Your Application Program Sends and Receives Messages There are two types of application programs: • command initiators • command executors This application program Sends command initiator command messages - specify which command function to execute at a particular remote node Each command message requires one reply message. The command initiator must check for error codes and, depending on the type of error, retransmit the message or notify the user.
Application Layer Message Packets Message Packet Format 6–3 Most devices send and receive messages using this message packet format: Command DST SRC CMD STS Command specific data packet TNS FNC Reply read write SRC DST CMD STS TNS SRC DST CMD STS TNS ADDR SIZE DATA Command specific data packet The bytes are shown from left to right in the order they are transmitted across the link.
6–4 Application Layer Message Packets DST and SRC Form the DST and SRC bytes of a reply message by interchanging the DST and SRC bytes of the corresponding command message: Command Reply Byte DST (destination) SRC (source) DST SRC SRC DST Contents Value supplied by Value range receiving message application layer sending message data link layer •0 to 376 (octal) for DF1 •0 to 376 (octal) for DH •0 to 77 (octal) for DH+ •0 to 31 (decimal ) for DH485 When sending messages from asynchronous dev
Application Layer Message Packets 6–5 CMD and FNC These bytes work together to define the activity that is to be performed by the command message at the destination node. Values for these bytes are supplied by the application layer. The message format depends on the CMD and FNC values.
6–6 Application Layer Message Packets STS and EXT STS These bytes work together to indicate the status of the message transmission. This byte STS (status) Four high bits of STS byte all = 1 (F0 hex)? Yes EXT STS byte Has this value command The application program sets = 0. = 0 when the command has executed with no error. = one of the status codes listed in Chapter 8, Message Packet Status Codes (STS, EXT STS)." This byte will also 0 if an error occurs.
Application Layer Message Packets 6–7 TNS The TNS (transaction) bytes contain a unique 16-bit transaction identifier. Generate this number by maintaining a 16-bit counter. Increment the counter each time your command initiator (application program) creates a new message, and store the counter value in the two TNS bytes of the new message. In a multi-tasking environment, you must use only one TNS counter, and the procedure to read and increment the TNS must be indivisible.
6–8 Application Layer Message Packets ADDR The ADDR (address) bytes contain the byte address of a memory location in the command executor where the command is to begin executing, except in SLC 500 processors, where the ADDR byte is interpreted as the word address. In SLC 5/02, SLC 5/03, and SLC 5/04 processors, the CIF Addressing Mode bit, S:2/8, can be set to a one to change the interpretation of the ADDR byte to the byte address, so that it is compatible with other PLC processors.
Chapter 7 Communication Commands This chapter contains the format you should use when sending communication commands to Allen-Bradley processors. Use this key to help learn the conventions that depict the communication commands listed in this chapter: command command name This text describes how the command is used.
7–2 Communication Commands Use this table to locate commands you want to use. For additional information on the commands, refer to the specified pages. ATTENTION: Using command codes not listed will produce unpredictable results.
Communication Commands Command CMD FNC Processors Micro Logix 1000 protected typed file write protected typed logical read with three address fields protected typed logical write with three address fields 7–3 SLC 500Ã SLC 5/03 SLC 5/04 1774 PLC PLC 2 Page PLC 3 PLC 5 PLC 5 /250 PLC 5/ VME 0F AF 4 4 4 4 0F A2 4 4 4 4 4 7-17 0F AA 4 4 4 4 4Á 7-18 protected write 00 Â read bytes physical 0F 17 read diagnostic counters 06 01 reset diagnostic counters 06 07 rea
7–4 Communication Commands apply port configuration • • • • Changes the configuration of some or all ports. If there are no parameters, changes all ports. This command reconfigures the ports based on information in the processor’s physical memory. It is normally used as part of a physical download operation where the processor memory and configuration are to be fully restored. A programming device must have the edit resource to use this command.
Communication Commands 7–5 change mode MicroLogix 1000 Changes the mode of the MicroLogix processor. • • • • MicroLogix 1000 SLC 500 SLC 5/03 SLC 5/04 C DST SRC CMD STS 0F TNS FNC Mode 3A xxh R SRC DST CMD STS 4F TNS EXT STS Mode - 01 = change to Program mode (REM program) 02 = change to Run mode The EXT STS field may be attached to the reply packet only when there is an error. SLC 500 Changes the mode of the SLC processor.
7–6 Communication Commands diagnostic status Reads a block of status information from an interface module. The reply contains the status information in its DATA field. The status information varies with the type of interface module. (For additional information, see Chapter 10, “Diagnostic Status Information.”) • • • • • • 1774 PLC MicroLogix 1000 PLC 2 PLC 3 PLC 5 PLC 5/250 (receive only) • SLC 500 • SLC 5/03 • SLC 5/04 C DST SRC CMD STS 06 TNS FNC 03 R SRC DST CMD STS 46 TNS Data (max.
Communication Commands 7–7 download all request (download) • PLC 5 • PLC 5/250 (receive only) • PLC 5/VME Places a PLC-5 processor in Download mode before downloading a complete system. A “no privilege” error is returned if the requestor does not have privilege to place the processor in Download mode.
7–8 Communication Commands download request (download privilege) • PLC 3 Used by a computer to inform an interface module that it wants to perform a download. If the module grants the download privilege, the computer may begin issuing physical reads or physical writes. If another node already has the download privilege, the second node is denied the privilege. Before performing an upload/download, issue diagnostic status to get the last word of memory to read or write.
Communication Commands 7–9 enable outputs • 1774 PLC Returns control of the outputs to the 1774-PLC ladder diagram program. Use this command to cancel the effect of disable outputs. C DST SRC CMD STS 07 TNS R SRC DST CMD STS 47 TNS FNC 01 enable PLC scanning Restarts the 1774-PLC processor’s program scanner after a physical write has been performed. • 1774 PLC C DST SRC CMD STS 07 TNS R SRC DST CMD STS 47 TNS FNC 03 enter download mode Puts the PLC-2 processor in the download mode.
7–10 Communication Commands enter upload mode Puts the PLC-2 processor in Upload mode. Use this command on a PLC-2 node before sending a physical read to the node. • PLC 2 C DST SRC CMD STS 07 TNS R SRC DST CMD STS 47 TNS Important: FNC 06 When you send an enter upload mode, the industrial terminal port is disabled until you send an exit download/upload mode. exit download/upload mode Takes the PLC-2 processor out of the Upload or Download mode.
Communication Commands 7–11 file write (write file) Writes data, starting at a file symbol or block address. This starting address must point to a file of words. • PLC 3 • PLC 5/250 C DST SRC CMD 0F STS TNS FNC 03 Packet Offset Total Trans Logical Address (2 51 bytes.) Data (up to [239 bytes - the PLC 3 logical address length]; must be an even number) This reply is the same as the reply packet for all unprotected, protected, and privileged bit writes.
7–12 Communication Commands initialize memory Resets the processor’s memory to the default directory (the directory the processor is shipped with). Using this command does not reset the communication configuration. • MicroLogix 1000 • PLC 5 • PLC 5/250 (receive only) • SLC 500 • SLC 5/03 • SLC 5/04 C DST SRC CMD STS 0F TNS FNC 57 R SRC DST CMD STS 4F TNS EXT STS The EXT STS field may be attached to the reply packet if an error occurs.
Communication Commands 7–13 open file Opens a file in an SLC 500 processor. If the file is successfully opened, a Tag (low byte, high byte) is returned. Protection • SLC 500 • SLC 5/03 • SLC 5/04 C CMD DST SRC 0F STS TNS R SRC DST CMD 4F STS TNS Protection - FNC 81 File number File type Tag 01h = read 02h = not supported 03h = read/write Tag is used to access the open file using a protected type file read or protected type file write. Tag is also used to close the file.
7–14 Communication Commands physical write Downloads data into the PLC data table or program memory. Use this command to download the contents of a computer file into PLC memory. • PLC 2 • 1774 PLC • PLC 3 PLC-2 For PLC-2 processors, enter download mode must precede the first physical write. C DST SRC CMD STS 03 TNS R SRC DST CMD STS 43 TNS ADDR Data (max. 244 bytes) ADDR Data (max.
Communication Commands 7–15 protected bit write • • • • • 1774 PLC PLC 2 PLC 3 PLC 5 PLC 5/250 DATA DATA is: •4 byte blocks, each of which contains a 16 bit address field •a set mask •a reset mask Sets or resets individual bits within limited areas of the PLC data table memory. The access is limited by memory access rungs in the communication zone of the PLC processor’s ladder diagram program.
7–16 Communication Commands protected typed file read Reads data from an open file in a MicroLogix 1000 or an SLC 500 processor. • • • • MicroLogix 1000 SLC 500 SLC 5/03 SLC 5/04 C DST SRC CMD STS 0F TNS R SRC DST CMD STS 4F TNS FNC A7 Size Tag Offset File Type DATA Offset is the word offset into the file (low byte, then high byte).
Communication Commands 7–17 protected typed logical read with three address fields Reads data from a logical address in a SLC 500 module. • SLC 500 • SLC 5/03 • SLC 5/04 C DST SRC CMD STS 0F TNS R SRC DST CMD STS 4F TNS FNC Byte A2 Size File File Ele. S/Ele. No. Type No. No. DATA EXT STS Field Description Byte Size The size of data to be read (in bytes), not including the address fields or other overhead bytes. File Number Addresses files 0 254 only.
7–18 Communication Commands protected typed logical write with three address fields Writes data to a logical address in a SLC processor. • SLC 500 • SLC 5/03 • SLC 5/04 C DST SRC CMD STS 0F TNS FNC Byte AA Size R SRC DST CMD STS 4F TNS EXT STS File File Ele. S/Ele. No. Type No. No. DATA The EXT STS field is only included if there is an error. Field Description Byte Size The size of data to be read (in bytes), not including the address fields or other overhead bytes.
Communication Commands 7–19 protected write • • • • • 1774 PLC PLC 2 PLC 3 PLC 5 PLC 5/250 Writes words of data into limited areas of the PLC data table memory. Its access is limited by memory access rungs in the communication zone of the processor’s ladder diagram program. C DST SRC CMD STS 00 TNS R SRC DST CMD STS 40 TNS Data (max.
7–20 Communication Commands read link parameters Reads the DH485 parameter, Maximum Solicit Address. This parameter specifies the maximum node address that a DH485 node tries to solicit onto the link. • SLC 500 • SLC 5/03 • SLC 5/04 (Channel 0 configured for DH485) C DST SRC CMD STS 06 TNS R SRC DST CMD STS 46 TNS FNC 09 Address 0000 Size 01 Data Data - the maximum node address that can be solicited (1 byte).
Communication Commands 7–21 read modify write N Sets or resets specified bits in specified words of data table memory. The variable N lets you specify the number of sets modified. The interface that receives this command performs this procedure for each PLC-5 system address, AND Mask, and OR Mask in the message packet: • PLC 5/250 ONLY 1. Copies the specified word in the data table. 2. Resets the bits specified in the AND mask. 3. Sets the bits specified in the OR mask. 4.
7–22 Communication Commands read section size Reads the size of the section most fully addressed by the system address given. The size represents the size of the memory addressed most fully expressed in words. If the address is more general than a file address, the size also includes the overhead memory used to maintain the file structure. If the address specifies a file, user data is returned. • PLC 3 • PLC 5 C DST SRC CMD STS 0F TNS FNC 29 R SRC DST CMD STS 4F TNS EXT PLC 3 STS PLC sys.
Communication Commands 7–23 restart request (restart) • PLC 3 Terminates an upload or a download. The computer cannot issue this command until after it has successfully completed an upload or download operation with the destination node. This command causes the interface module to revoke the upload and download privileges for the source computer node and to initialize a PLC-3 restart.
7–24 Communication Commands return edit resource Returns the edit resource (sole access) of the processor when editing is completed. When you return the edit resource, the programming device can be written to or modified. • • • • • PLC 5 PLC 5/VME SLC 500 SLC 5/03 SLC 5/04 C DST PSN SRC PSN CMD STS 0F R LNH LNH CMD DST PSN SRC PSN STS HI LO 4F TNS FNC 12H TNS EXT STS LNH - length of the optional portion of the reply packet in bytes.
Communication Commands 7–25 set ENQs • PLC 2 • PLC 3 • PLC 5 Sets the maximum number of ENQs that the asynchronous interface module issues per message transmission. Put the number in the DATA field. The default setting for most modules is 10 ENQs per transmission (3 ENQs for the 1771-KG and 1771-KE, 9 ENQs for the 1785-KE). C DST SRC CMD 06 STS TNS R SRC DST CMD 46 STS TNS FNC DATA 06 set link parameters Sets the DH485 parameter, Maximum Solicit Address.
7–26 Communication Commands set CPU mode Sets the operating mode of the processor at the next I/O scan. The operating mode is set to the mode indicated in the flag byte (shown below). A “no privilege” error is returned if the requester does not have the privilege of placing the host in Download mode.
Communication Commands 7–27 set timeout • PLC 2 • PLC 3 • PLC 5 Sets the maximum amount of time that the asynchronous interface module waits for an acknowledgment to its message transmission. The setting is expressed as the number of cycles of an internal clock. (For example, 40 cycles equals 1 second for the 1770-KF2.) C DST SRC CMD 06 STS TNS R SRC DST CMD 46 STS TNS FNC DATA 04 See the following table for settings and defaults for the module you are setting.
7–28 Communication Commands shutdown Asks the interface module to initiate either a PLC-3 shutdown (if the computer has download privileges) or a freeze on file allocations (if the computer has upload privileges). The computer cannot issue this command until it has successfully transmitted an upload or download request to the module. • PLC 3 C DST SRC CMD STS 0F TNS FNC 07 R SRC DST CMD STS 4F TNS EXT STS The EXT STS field may be attached to the reply packet only when there is an error.
Communication Commands 7–29 Data Type ID (Bits 4 7) Data Type Size (Bits 0 3) The following table contains a list of the types of data you can read and write and the ID value of each: Data Type ID Type of Data If the data type defined in the ID Value field uses Then enter 7 or fewer bytes for each piece of data zero (0) in bit 3 of the flag byte. Enter the actual number of bytes used for each element of data in bits 0, 1, and 2 (Size Value Field).
7–30 Communication Commands typed write (write block) • • • • Writes a block of data to the processor starting at the PLC-5 system address plus the packet offset. The type of data sent with the typed write command must match the data type of the file to which it is being written. If not, the remote host returns an error reply. PLC 5 PLC 5/VME SLC 5/03 SLC 5/04 C R DST SRC SRC DST CMD STS 0F CMD STS 4F FNC 67 TNS TNS Packet Offset Total Trans PLC 5 sys.
Communication Commands Important: 7–31 The interface module at the receiving PLC node executes this command by first making a copy of the addressed PLC byte. It then sets or resets the appropriate bits and writes the byte back into PLC memory. At the same time, the PLC processor can be changing the states of the original bits in memory. Because of this, some data bits may unintentionally be overwritten.
7–32 Communication Commands unprotected write 1774-PLC, PLC-2, PLC-3, PLC-5 Writes words of data into any area of PLC and PLC-2 data table memory. In PLC-3 and PLC-5 processors, the data is written into the PLC-2 compatibility file. • • • • • • 1774 PLC PLC 2 PLC 3 PLC 5 SLC 500 MicroLogix 1000 C DST SRC CMD STS 08 TNS R SRC DST CMD STS 48 TNS ADDR Data (max. 244 bytes) SLC 500, MicroLogix 1000 Writes data to a common interface file (CIF).
Communication Commands 7–33 upload all request (upload) Places a PLC-5 processor in Upload mode before uploading a complete system. (A T50 terminal displays “download” mode.) • PLC 5 • PLC 5/VME A “no privilege“ error is returned if the programmed device does not have the privilege of placing the processor into Upload mode.
7–34 Communication Commands upload completed After uploading a complete system, use to return the processor to the mode it was in prior to executing the upload all request command. • PLC 5 • PLC 5/VME C DST SRC CMD STS 0F TNS R SRC DST CMD STS 4F TNS FNC 55 EXT STS The EXT STS field may be attached to the reply packet only when there is an error. upload Informs the interface module that it wants to perform an upload. If the module grants the upload privilege, the computer issues physical reads.
Communication Commands 7–35 word range write (write block) Writes to a word or file starting at a specified address. A special case of this command is the single-word write, where the data field is only one word long. • PLC 3 • PLC 5 C DST SRC CMD STS 0F TNS FNC 00 R SRC DST CMD STS 4F TNS EXT STS Packet Offset Total Trans PLC system address Data (max. 240 bytes the PLC address field) The EXT STS field may be attached to the reply packet only when there is an error.
7–36 Communication Commands PLC 5 Type/Data Parameter Examples The type/data parameter is a variable length field. The most significant bit of each nibble determines additional bytes used. The value of this field can be extended to a 7-byte unsigned integer. The bytes are ordered least to most significant. All zero most-significant bytes are permitted, but the fields generated by them are no different than those that omit these insignificant bytes.
Communication Commands 7–37 Example 2: Type/data parameter for writing or reading integer data This example shows the type/data parameter for reading an array (ID = 9). The array data type includes an additional byte called the descriptor byte, located after the ID byte. The descriptor byte is a second flag byte which describes the type of data in the array. You include the descriptor byte as part of the data field size.
7–38 Communication Commands SLC 500 Information Reading and Writing SLC 500 Data Reading and Writing SLC 500 Data (using PLC 2 terminology) Publication 1770 6.5.16 - October 1996 Important: There are also some limitations on the basic commands SLC 500 family nodes support: Command Limitation Diagnostic Loop Maximum data field size is 95 bytes, not 243. Unprotected Read Maximum data field size is 95 bytes, not 244.
Communication Commands 7–39 You can map the SLC 500 CIF file to PLC-2 memory as shown in the following example. The maximum size of PLC-2 memory that you can simulate is 256 words (octal 00 through 377).
7–40 Communication Commands Example: Reading the 18th and 19th bytes shown in the example on page 7-39 These examples compare two methods for reading SLC 500 data from an SLC 500 (assumes S:2/8 = 0 so that word addressing is selected) and from a PLC 2 processor. When using the SLC 500 method, you do not multiply by two (as in step 2, below) as you do with the PLC 2 method. Read N9:9 from SLC 500 processor: 1. Convert decimal element to hex: 9 (decimal) 0009 (hex) 2.
Chapter 8 Message Packet Status Codes (STS, EXT STS) Use this chapter to help interpret status codes that appear in asynchronous link message packets. You use asynchronous-link status codes to determine the status of a command sent from your computer to another device on your DH, DH+, or DH485 link.
8–2 Message Packet Status Codes (STS, EXT STS) STS Byte The STS byte provides information about the execution or failure of the corresponding command that was transmitted from the computer. If the reply returns a code of 00, the command was executed at the remote node. All other codes can be divided into two types: This error type Occurs when local the local node is unable to transmit a message to the remote node.
Message Packet Status Codes (STS, EXT STS) 8–3 Remote STS Error Codes The remote STS error code nibble contains errors found by the remote node receiving the command.
8–4 Message Packet Status Codes (STS, EXT STS) EXT STS Codes for CMD 0F Hex Code Explanation 0 1 2 3 4 5 6 7 8 Not used A field has an illegal value Less levels specified in address than minimum for any address More levels specified in address than system supports Symbol not found Symbol is of improper format Address doesn't point to something usable File is wrong size Cannot complete request, situation has changed since the start of the command Data or file is too large Transaction size plus word addr
Message Packet Status Codes (STS, EXT STS) 8–5 DH485 EXT STS Codes Remote STS and EXT STS Codes Hex Code Explanation 07H 0BH 0CH 0EH 12H 14H 19H 1AH 1BH Insufficient memory module size (0000h is returned) Access denied, privilege violation Resource not available or can not do CMD can not be executed Invalid parameter Failure during processing Duplicate label File open by another node + owner's local node address, 1 byte Program owned by another node + program owner's local node address, 1 byte For t
8–6 Message Packet Status Codes (STS, EXT STS) Remote STS and EXT STS Codes from a PLC 3 Processor A PLC-3 interface module (1775-KA,-S5,-SR5) inserts the reply error code in the STS byte of any reply message packet it returns to a remote node (your computer). The meaning of each error code depends on the command message received from the computer. The following pages describe the error conditions that the various commands can generate.
Message Packet Status Codes (STS, EXT STS) 8–7 Command EXT STS Code STS Code Explanation PLC/PLC 2 read - 10 •The required two byte ADDR field and one byte SIZE field are missing in the command message. •The ADDR value is odd (that is, it does not specify a word address). •The value of SIZE is 0. •The value of SIZE is greater than 244. •The SIZE value specifies an odd number of bytes.
8–8 Message Packet Status Codes (STS, EXT STS) Command EXT STS Code STS Code Explanation PLC 3 word write - 10 - 30 - 40 - 60 1 70 F0 2 F0 3 F0 4 5 F0 F0 •There are not at least two bytes of data after the end of the block address. •There is an odd number of data bytes after the end of the block address. •The sum of packet offset and size values specifies more than 65,535 words. •The sum of packet offset and size is greater than total transaction size.
Message Packet Status Codes (STS, EXT STS) 8–9 Command EXT STS Code STS Code Explanation PLC 3 physical reads - 10 •There is more than one byte of data after the byte address. •The number of bytes to read: - is an odd number. - equals zero. - is greater than the maximum allowed in a reply packet (244). •The sum of packet offset and size of data in words is greater than 65,535. •The sum of packet offset and size of data in words is greater than the total transaction size.
8–10 Message Packet Status Codes (STS, EXT STS) Command EXT STS Code STS Code Explanation PLC 3 bit write - 10 - 30 - 40 1 60 70 F0 2 F0 3 F0 4 5 F0 F0 More than four bytes of data exist after the PLC 3 address in the command message. The local PLC 3 interface module has executed a shutdown request. A backplane error (memory parity, timeout, or disconnect) has occurred. The keyswitch setting does not allow access to file. The local PLC 3 in the Program mode.
Module Diagnostics Diagnostic Counters Chapter 9 Diagnostic Status Information Chapter 10
Chapter 9 Diagnostic Counters Diagnostic counters are bytes of information stored in RAM in each module. The counters occupy a block of the module’s internal scratch RAM. Most are single-byte counters that wrap around to zero when they overflow. They are used to record events that can be used in debugging and long-term reliability analysis. These counters provide a useful tool for diagnosing problems.
9–2 Diagnostic Counters " Reading diagnostic counters To read diagnostic counters, you issue a diagnostic read command from a device that: • is connected to an interface module that supports an asynchronous port • can format the diagnostic commands (Therefore, a PLC user program is unable to initiate a diagnostic command.
Diagnostic Counters 1747 Cat. Nos. 9–3 Cat. Nos.
9–4 Diagnostic Counters 1747 L541, L542, and L543 (SLC 5/04 processors) DH+ Diagnostic Counters Publication 1770 6.5.
Diagnostic Counters 9–5 1747 L541, L542, and L543 (SLC 5/03 and 5/04 processors) DH485 Diagnostic Counters This counter byte Counts the number of 0 Total message packets received, low byte 1 Total message packets received, high byte 2 Total message packets sent, low byte 3 Total message packets sent, high byte 4 Message packet retries 5 Retry limit exceeded 6 NAK, no memory sent 7 NAK, no memory received 8 Total bad message packets received 9 Bad messages due to illegal type (i.e.
9–6 Diagnostic Counters 1747 L541, L542, and L543 (SLC 5/03 and SLC 5/04 processors) DF1 Diagnostic Counters Publication 1770 6.5.
Diagnostic Counters 1761 Cat. Nos. 9–7 Cat. Nos.
9–8 Diagnostic Counters 1770 Cat. Nos. Cat. Nos. Link Pages 1770 KF2 1770 KF2 DH DH+ 9-8 9-11 1770 KF3 DH485 9-3 1770 KFC DF1 9-13 1770 KF2 and 1771 KE/KF DH and Asynchronous Link Diagnostic Counters Publication 1770 6.5.16 - October 1996 This counter byte Counts the number of 0 Bad CRCs or I/O errors on ACK. Same causes as bad CRC on messages. 1 Times the sender timed out waiting for an acknowledgment.
Diagnostic Counters 9–9 This counter byte Counts the number of 9 Frames that were rejected because they were less than 6 bytes long. This counter records all status frames that were received by a node that disabled its address recognizer in the second step of the mastership timeout process. This happens often on a heavily loaded link. 10 Frames that were rejected because the destination address was incorrect. This can have the same cause as counter byte 9.
9–10 Diagnostic Counters Publication 1770 6.5.16 - October 1996 This counter byte Counts the number of 21, 22 Times the node attempted to send a message. 23, 24 Messages were successfully transmitted and ACKed. 25, 26 ACKs received. 27 ACKs successfully passed from the receiver's separator to the transmitter. 28 NAKs received. 29 NAKs passed from the separator to the transmitter. 30 Timeouts waiting for a response. 31 ENQs sent. 32 Messages that could not be successfully sent.
Diagnostic Counters 9–11 1770 KF2 and 1785 KE DH+ and Asynchronous Link Diagnostic Counters This counter byte Counts the number of 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21, 22 23, 24 25, 26 27, 28 29, 30 31, 32 33 34 Times received ACK with bad CRC. Times timeout expired with no ACK received. Transmit re tries exhausted. NAK/illegal protocol operation received. NAK/bad LSAP received. NAK/no memory received. Received ACK/NAK too short.
9–12 Diagnostic Counters This counter byte Counts the number of 35, 36 37, 38 39, 40 41 Times node attempted to send a message. Messages that were successfully transmitted and ACKed. ACKs that were received. ACKs successfully passed from the receiver's separator to the transmitter. NAKs received. NAKs passed from the separator to the transmitter. Timeouts waiting for a response. ENQs sent. Messages that could not be successfully sent. Reply messages that could not be forwarded and were destroyed.
Diagnostic Counters 9–13 1770 KFC DF1 Diagnostic Counters This counter byte Counts the number of 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Total DF1 packets received, low byte. Total DF1 packets received, high byte. Total DF1 packets transmitted, low byte. Total DF1 packets transmitted, high byte. Number of DF1 retries. Number of DF1 packets where the retry limit was exceeded. Number of DF1 NAKs sent. Number of DF1 NAKs received. Number of DF1 bad messages received.
9–14 Diagnostic Counters 1771 Cat. Nos. Cat. Nos. Link Pages 1771 KA, 1771 KA2, and 1774 KA DH 9-14, 9-15 1771 KC DH 9-16, 9-18 1771 KE/KF DH 9-8 1771 KG, KGM DH 9-19 1771 KA, 1771 KA2, and 1774 KA DH Diagnostic Counters This counter byte 0 1 2 3 4 5 6 7 8 Publication 1770 6.5.16 - October 1996 Counts the number of Times CRC was in error on an ACK. Times the sender timed out waiting for an acknowledgement.
Diagnostic Counters This counter byte 9 10 11 12 13 14 15 16 17, 18 19, 20 21, 22 23, 24 25, 26 27 28 29 9–15 Counts the number of Frames that were rejected because the header was incomplete. This is counted only because of undebugged software or in the unlikely event that a bad frame fooled the CRC checker. Frames that were rejected because the destination address was incorrect. This can have the same cause as counter byte 8.
9–16 Diagnostic Counters This counter byte 30 Important: Counts the number of Replies lost because they could not be delivered over the DH link. Undeliverable commands can be signaled to the user, because the user" is located in PC memory, and can always be reached. If a reply message cannot be delivered over the link, there is no way to signal the user (of that message) who is also over the highway that this node cannot signal a reply.
Diagnostic Counters 9–17 This counter byte Counts the number of 8 Times the receiver received a status frame instead of a message frame. This occurs if a poll timeout is imminent (a master has had mastership for more than 170ms) and the node has disabled its address recognizer to test for any valid traffic. The probability of errors in counter bytes 8, 9 and 10 increases substantially. 9 Frames that were rejected because the header was incomplete.
9–18 Diagnostic Counters Publication 1770 6.5.16 - October 1996 This counter byte Counts the number of 15 Duplicate frames received. A duplicate frame is sent by a transmitter when it fails to receive an ACK. If the reason it failed to receive an ACK was that the ACK was lost rather than that the original message was lost the duplicate is redundant and is discarded.
Diagnostic Counters 9–19 1771 KG, KGM Diagnostic Counters Asynchronous Link Diagnostic Counters This counter byte Counts the number of 0, 1 2, 3 4, 5 6 7 8 9 10 11 12 13, 14 15, 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 Times a node attempted to send a message. Messages that were successfully transmitted and ACKed. ACKs that were received. ACKs successfully passed from the receiver's separator to the transmitted. NAKs received NAKs passed from the separator to the transmitter.
9–20 Diagnostic Counters Internal Event Counters This counter byte Counts the number of 35 36 37 38 39 40 41 42, 43 44, 45 46, 47 48, 49 50 51 Publication 1770 6.5.16 - October 1996 Messages routed to RS 232 port. Commands routed to command executor. Replies routed to reply processor. Messages sent to self Routing errors on inbound messages. Routing errors on outbound messages. Messages with incorrect network address. Messages sent by command initiator. Commands received by command executor.
Diagnostic Counters 1775 Cat. Nos. 9–21 Cat. Nos. Link Pages 1775 KAÀ DH 9-21 1775 S5, SR5 DH+ 9-21 À PLC 3 processors 1775 KA, S5, SR5 DH Diagnostic Counters DH Port Counters This counter byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17, 18 19, 20 21, 22 23, 24 25, 26 27, 28 Counts the number of Bad CRCs on acknowledgment. Timeouts that occurred before an ACK was received. Contentions (while master, detected message transmission by another node). ACKs containing an error.
9–22 Diagnostic Counters Asynchronous Link Counters (1775 KA only) This counter byte Counts the number of 29, 30 31, 32 33, 34 35, 36 37, 38 39, 40 41, 42 43, 44 45 46, 47 48 49 50 51 Publication 1770 6.5.16 - October 1996 Command messages sent. Reply messages received. Command messages received. Reply messages sent. ACKs received. ACKs sent. NAKs received. NAKs sent. Undeliverable reply messages. Computer link timeouts (preset to 500 ms). NAKs accepted per message (preset to 10) maximum number.
Diagnostic Counters 9–23 1775 S5, SR5 DH+ Diagnostic Counters This counter byte 0, 1 2, 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17, 18 Counts the number of Messages sent successfully. Message received successfully (not counting duplicate messages). Undeliverable messages (message was NAKed or retries were used up). ACK timeouts; sent a packet that did not get acknowledged or wait acknowledged. Received NAKs.
9–24 Diagnostic Counters 1779 Cat. Nos. Cat. Nos. Link Pages 1779 KP5 DH+ 9-24 1779 KP5 DH+ Diagnostic Counters This counter byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21, 22 23, 24 25, 26 27, 28 29, 20 31, 32 33 34 Publication 1770 6.5.16 - October 1996 Counts the number of ACKs received with bad CRC. Timeouts that expired with no ACK received. Times transmit retries exhausted. NAK or illegal protocol operations received. NAKs - bad LSAPs received. NAKs - no memory received.
Diagnostic Counters 1784 Cat. Nos. 9–25 Cat. Nos. Link Pages 1784 KR DH485 9-3 1784 KT, KT2 DH+ 9-25 1784 KT and 1784 KT2 DH+ Diagnostic Counters This counter byte Counts the number of 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22, 23 24, 25 26, 27 28, 29 30, 31 32, 33 34 35 Times received ACKs with a bad CRC. Timeouts expired with no ACK received. Transmit retries exhausted. NAK or illegal protocol operations received. NAKs - bad LSAP received. NAK - no memory received.
9–26 Diagnostic Counters 1785 Cat. Nos. Cat. Nos. Link Pages 1785 KE DH+ 9-11 1785 KA3 DH+ 9-28 1785 KA DH 9-26 1785 KA DH+ 9-27 1785 KA5 1785 KA5 DH+ DH485 9 29 9-29 1785 L11B, L20B, L30B, L40B, L60B, L80B processors DH+ 9-30 1785 L20E, L40E, L40L, L60L, L80E processors DH+ 9-32 1785 KA DH Diagnostic Counters This counter byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17, 18 19, 20 21, 22 23, 24 25, 26 27, 28 29 Publication 1770 6.5.
Diagnostic Counters 9–27 1785 KA DH+ Diagnostic Counters This counter byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23, 24 25, 26 27, 28 29, 30 31, 32 33, 34 35 36 Counts the number of Times received ACKs with a bad CRC. Timeouts expired with no ACK received. Transmit re tries exhausted. NAK/illegal protocol operations received. NAK/bad LSAP received. NAK/no memory received. Received ACKs/NAKs too short. Received ACKs/NAKs too long. Times something other than an ACK/NAK received.
9–28 Diagnostic Counters 1785 KA3 DH+ Diagnostic Counters This counter byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23, 24 25, 26 27, 28 29, 30 31, 32 33, 34 35 36 37 38 39 40 41 42 Publication 1770 6.5.16 - October 1996 Counts the number of Received ACKs with a bad CRC. Timeouts that expired with no ACK received. Transmit retries exhausted. NAKs sent due to an illegal protocol operation. NAKs sent due to a bad LSAP. NAKs sent due to memory available.
Diagnostic Counters 9–29 1785 KA5 DH+ Diagnostic Counters This counter byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23, 24 25, 26 27, 28 29, 30 31, 32 33, 34 35 36 ➀ Counts the number of➀ Timeouts that expired with no ACK received. Transmit retries exhausted. NAKs due to illegal protocol operations. NAKs due to bad LSAPs. NAKs due to memory available. Duplicate tokens detected. Duplicate nodes detected. Token pass timeouts. Token pass retries exhausted. Claim token sequences entered.
9–30 Diagnostic Counters 1785 KA5 DH485 Diagnostic Counters This counter byte 0, 1 2, 3 4 5 6 7 8 9 Counts the number of Total packets received (low byte first). Total messages sent (low byte first). Messages ACK, timeout count. Message retried, failure count. NAK NO MEM sent. NAK NO MEM received. Bad messages received. Reserved. 1785 L11B, L20B, L30B, L40B, L60B, and L80B DH+ Channel Diagnostic Counters Publication 1770 6.5.
Diagnostic Counters 9–31 Below are diagnostic counters for the channel 0 serial port. These counters vary depending on whether the port is configured for: • point-to-point (full-duplex) • half-duplex slave • half-duplex master This counter byte Counts the number of 0, 1 General status words.
9–32 Diagnostic Counters 1785 L20E, L40E, L40L, L60L, L80E DH+ Diagnostic Counters Publication 1770 6.5.16 - October 1996 This counter byte Counts the number of 0 1 2 3 4 5 6 7 8, 9 10, 11 12, 13 14, 15 16, 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 ACK timeouts. NAKs due to no memory received. Claim tokens. NAKs due to no memory sent. CRC errors. Duplicate packets. Token timeouts. Retries. Messages sent (high byte first). Messages received (high byte first).
Diagnostic Counters 5250 Cat. Nos. 9–33 Cat. Nos. Link Pages 5250 LP1, LP2, LP3, LP4À processors DH+ 9-33 À PLC 5/250 processors 5250 LP1, LP2, LP3, LP4 DH+ Diagnostic Counters This counter byte Counts the number of 0, 1 2, 3 4 Messages sent successfully. Messages received successfully (not counting duplicate messages). Undeliverable messages (message was NAKed or retries were used up). Response timeouts. NAKs received.
Chapter 10 Diagnostic Status Information In chapter 8, we showed you the diagnostic status message packet format. When you send diagnostic status to a node, the node returns bytes of data. Use this chapter to interpret the data returned from the node (DH, DH+, or DH485 interface) that received the diagnostic status. It contains these sections: Section Page 1747 Cat. Nos. 10-2 1761, 1770, and 1771 Cat. Nos. 10-5 1773, 1775, and 1779 Cat. Nos. 10-11 1784 Cat. Nos. 10-15 1785 Cat. Nos.
10–2 Diagnostic Status Information 1747 Cat. Nos. For status information from these cat. nos. See page 1747 KE 10-2 1747 L20, L30, L40, L511, L514, L524 (SLC 500, SLC 5/01 and SLC 5/02 processors) 10-3 1747 L532, L542 (SLC 5/03 and SLC 5/04 processors) 10-4 1747 KE Status Bytes Bytes Bits Contents Description 1 2 3 4 5 1 2 3 4 0 4 5 7 all all Mode/Status Type Extender Extended Interface Type Not used Series/Revision 00 (no modes) FE 2C 00 = 0 release1; = 1 release 2, etc.
Diagnostic Status Information 10–3 1747 L20, L30, L40, L511, L514, L524 (SLC 500, SLC 5/01 and SLC 5/02 processors) Status Bytes Bytes Bits Contents Description 1 2 3 4 0 7 0 7 0 7 0 7 mode/status type extender extended interface type extended processor type 5 0 4 series/revision 00 EE 1F 1A = 20, 30, & 40 I/O SLC fixed controllers 18 = 1747 L511, L514 SLC 5/01 controller 25 = 1747 L524 and SLC 5/02 controller = 0 (firmware release1) = 1 (firmware release 2), etc.
10–4 Diagnostic Status Information 1747 L532, L541, L542, L543 (SLC 5/03 and SLC 5/04 processors) Status Bytes Bytes Bits Contents Description 2 3 0 5 6 7 0 7 0 7 mode/status 00 testing edits edits in processor EE 4 0 7 extended processor type 5 0 4 series/revision 1 type extender extended interface type 5 7 6 - 16 bulletin number/name (in ASCII) Product specific Information 17 all major error word 18 all major error word 19 processor mode 0 4 status/control word 20 21 22 23 all 5
Diagnostic Status Information Bytes Bits Contents 24 0 directory file corrupted 1 2 7 not used program owner node address 10–5 Description =0 = 00-1F for nodes 0 through 31 = 3E for nodes 20 through FF = 3F: no program owner ➀ SLC 5/03 processors only. ➁ SLC 5/04 processors only. 1761, 1770, and 1771 Cat. Nos. For status information from these cat. nos.
10–6 Diagnostic Status Information 1761 L16AWA, L16BBB, L16BWB, L32AWA, L32BWA, L32BWB (MicroLogix 1000 processors) Status Bytes Bytes 1 2 3 Bits 0 7 0 7 0 7 Contents mode/status type extender extended interface type 4 5 0 7 0 4 extended processor type series/revision 5 7 6 - 16 bulletin number/name (in ASCII) Product specific Information 17 all major error word 18 all major error word 19 processor mode 0 4 status/control word 20 21 22 23 24 Description 00 EE 34 = DF1 full duplex protocol o
Diagnostic Status Information 10–7 1770 KF3 Status Bytes Bytes Bits Contents Description 1 2 3 4 5 1 2 3 4 0 4 5 7 all all Mode/Status Type Extender Extended Interface Type Not used Series/Revision 00 (no modes) FE 2C 00 = 0 release1; = 1 release 2, etc. = 0 series A; = 1 series B, etc.
10–8 Diagnostic Status Information Bytes 9 Bits Contents Description 0-4 Series and revision level of interface module. 1770 KF2/A identifies itself as Series D" in byte y 9,, bits 5 to 7. Series B 1770 KF2 identifies itself as Series E, and so on. 1771 KA identifies itself as a Series A. 1771 KA2 Series A identifies itself as a Series B, and so on. Settings of the option switches on the node interface module. 0 = Revision A 1 = Revision B, etc.
Diagnostic Status Information Bytes Bits 1 2 4, 3, 0 5-7 Contents 10–9 Description 1771 KG Module (Series B) 0 = second module; 1 = first module 0 = accept physical/unprotected reads and writes disabled 1 = accept physical/unprotected reads and writes enabled Binary values: Value Parity Error Embedded Protocol Check Responses 000 none BCC disabled full duplex 100 even BCC disabled full duplex 010 none BCC enabled full duplex 110 even BCC enabled full duplex 001 none BCC disabled half duple x 101 even
10–10 Diagnostic Status Information Bytes Bits Contents Description 1 Settings switches on the g of the option p node interface module.
Diagnostic Status Information 1773, 1775, and 1779 Cat. Nos. 10–11 For status information from these cat. nos.
10–12 Diagnostic Status Information Bytes 9 Bits Contents Description 0-4 Module series and revision level 0 = Revision A 1 = Revision B, etc. 0 = Series A 1 = Series B, etc. 5-7 10 11 to 114 all Publication 1770 6.5.16 - October 1996 Not used Eight, 13 byte groups of processor status data, one group for each of eight possible controllers on the loop. If a particular controller on the loop is not active or does not respond to the diagnostic status command, its 13 status bytes are all zeros.
Diagnostic Status Information 10–13 1775 KA, S5 and SR5 Status Bytes Bytes Bits Contents Description 1 0-1 Operating status of PLC 3 processor 0 = Program mode 1 = Test mode 2 = Run mode Not used 0 = Normal 1 = Major processor fault 0 = Normal 1 = Shutdown request 0 = Normal 1 = Shutdown in effect Not used 6 = 1775 KA - Data Highway port, 1775 S5, or 1775 SR5 7 = 1775 KA - RS 232 C port 12 = 1775 S5, SR5 (new revisions only) 2 3 4 5 2 6-7 0-3 4-7 Type of node interface and processor 3 all
10–14 Diagnostic Status Information 1779 KP5 Status Bytes Bytes Bits Contents Description 1 2 3 4 5-6 7-8 all all all all all all 00 Interface Type and Processor Type Interface Type Expansion Byte Processor Type Expansion Byte 00 Address of Active Node Table 9 - 10 all Diagnostic Counter Address 11 0-4 1779 KP5 Revision and Series Level Not used EE = see expansion bytes (bytes 3 and 4) 1A = 1779 KP5 17 = DH+ information Not used byte 7 = low byte byte 8 = high byte byte 9 = low byte byte 10 =
Diagnostic Status Information 1784 Cat. Nos. 10–15 For status information from these cat. nos. See page 1784 KR 10-15 1784 KT, KT2 10-15 1784 KR Status Bytes Bytes Bits Contents Description 1 2 3 4 5 0 7 0 7 0 7 0 7 0 4 Mode/Status Type Extender Extended Interface Type Not used Series/Revision 00 (no modes) FE 24 00 = 0 release1 = 1 release 2, etc. = 0 series A = 1 series B, etc.
10–16 Diagnostic Status Information 1785 Cat. Nos. For status information from these cat. nos.
Diagnostic Status Information 10–17 1785 KA5 Status Bytes DH+ Status Bytes Bytes Bits Contents Description 0 1 2 3 4-5 6-7 8 all all all all all all all mode type interface type processor type DH485 diagnostic counters address DH+ diagnostic counters address module revision, series 9 10 all all options DH+ active node table address 0 extended (EE) 1785 KA5 (30) 1785 KA5 (2F) low byte first low byte first 0:4 revision 5:7 series 0 low byte first DH485 Status Bytes Bytes Bits Contents Descript
10–18 Diagnostic Status Information Bytes Bits Contents 3-4 all Octal address of the start of the PLC program 5-6 7-8 all all 9 0-4 Starting byte address of diagnostic counters and timers. Series and revision level of interface module. 5-7 10 0-1 Settings g of the option p switches on the node interface module 2 3 4 5 6 7 11 0 1 2 12 3-7 0-2 3 Not used Indicates the number of I/O racks the PLC 2 is configured for.
Diagnostic Status Information 10–19 1785 KE Status Bytes Bytes Bits Contents Description 1 2 Operating status of PLC processor. Type yp of interface module and pprocessor 3 4 5-6 all 0-3 4-7 all all all For the 1785 KE, this byte is always 0. E = Check interface module expansion byte (byte3) F = Computer 19 = 1785 KE 00 = not used low byte first.
10–20 Diagnostic Status Information 1785 LT (PLC 5/15) and 6008 LTV (PLC 5 VME) Status Bytes Bytes Bits Contents Description 1 0-2 Operating status of PLC 5 processor 0 = Program load 1 = Not used 2 = Run mode 3 = Not used 4 = Remote program load 5 = Remote test 6 = Remote run 7 = Not used 3 4 5 6 7 2 3-6 7 0-3 4-7 0-4 Processor Type yp Size of user memory Series and revision of the PLC 5 5-7 8 9 all all Processor number on DH+ link I/O address 10 0 1 2 5 6 all all 0 4 all all I/O and c
Diagnostic Status Information 10–21 1785 LT3 (PLC 5/12) and 1785 LT2 (PLC 5/25) Status Bytes Bytes Bits Contents Description 1 0-2 Operating status of PLC 5 processor 0 = Program load 1 = Not used 2 = Run mode 3 = Not used 4 = Remote program load 5 = Remote test 6 = Remote run 7 = Not used 3 4 5 6 7 2 0-3 4-7 3 4-7 8 Processor Type yp Processor Expansion Byte 0-4 Size of user memory Series and revision of the PLC 5 5-7 9 10 all all Processor number on DH+ Link all I/O address 11 0 1 2 5
10–22 Diagnostic Status Information 1785 L11B, L20B, L20E, L30B, L40B, L40E, L40L, L60B, L60L Status Bytes Bytes Bits Contents Description 1 0-2 Operating status of PLC 5 processor 0 = Program load 1 = Not used 2 = Run mode 3 = Not used 4 = Remote program load 5 = Remote test 6 = Remote run 7 = Not used 0 = Normal 1 = Major processor fault 0 = Normal 1 = Download mode Not used 0 = Not testing edits 1 = Testing edits 0 = Not testing edits 1 = Testing edits B = PLC 5 E = Expansion byte 15 = 1
Diagnostic Status Information Bytes Bits Contents Description 19 all Debug mode 20 - 21 22 - 23 24 - 25 26 - 27 28 - 29 30 - 31 32 - 33 34 - 35 36 all all all all all all all all all Hold point file Hold point element Edit time stamp seconds Edit time stamp minute Edit time stamp hour Edit time stamp day Edit time stamp month Edit time stamp year Port number this command received on = 0, OFF 0 0, ON used if Debug mode is ON. Low byte first. used if Debug mode is ON. Low byte first.
10–24 Diagnostic Status Information Bytes Bits Contents Description 6-7 8-9 10 - 11 all all all Program Change Sequence Count Data Change Sequence Count User Defined Data Change Sequence Count 1 word 1 word 1 word Publication 1770 6.5.
Reference Data Encoding Chapter 11 Uploading and Downloading with A B Processors Chapter 12 PLC Addressing Chapter 13 Line Monitor Examples ASCII Codes Chapter 14 Chapter 15
Chapter 11 Data Encoding This chapter provides: • definitions of numbering systems you can use in your application • a message packet’s order of transmission It contains these sections: Section Page Numbering Systems 11-2 Order of Transmission 11-6 Publication 1770 6.5.
11–2 Data Encoding Numbering Systems In general, PLC processors store binary data (1s and 0s) in 16-bit groups called words. If you are looking at this data from a computer, however, you may interpret it in a number of different ways, depending on your application needs.
Data Encoding 11–3 Binary The binary numbering system is a simple method for computer and PLC applications because it is the most natural way to represent data bits. However, since the binary system uses the digits 0 and 1, it is cumbersome to show values in binary format. Each digit in a binary number has a place value expressed as a power of 2.
11–4 Data Encoding Hexadecimal The hexadecimal (hex) numbering system is the most compact way to represent binary data and allows for the easiest conversion to and from binary. Hex uses 16 digits, numbers 0 to 9 and letters A to F. (Letters A to F are equivalent to the decimal numbers 10 to 15, respectively.) Each group of four data bits represents one hex digit between 0 and F. Thus, each 16-bit data word can have a hex value between 0 and FFFF.
Data Encoding 11–5 Octal The octal number system is another easy way to represent binary data. This system uses the eight digits, 0 through 7. Each group of three data bits represents one octal digit between 0 and 7. This factor presents a slight conversion problem because bytes and words usually contain an even number of bits. Thus, an 8-bit byte can have an octal value between 0 and 377, while a 16-bit word can have an octal value between 0 and 177777.
11–6 Data Encoding Order of Transmission PLC processors store data in 16-bit (2-byte) words. The bits in these words are numbered (addressed) 0 through 17 octal, going from right to left within a word, as follows: PLC Word Bits: 17 16 15 14 13 12 11 10 07 06 05 04 02 03 01 00 When a module transmits data over its asynchronous link, it transmits one byte at a time.
Data Encoding 11–7 A 16-Bit Word in PLC Memory Bit (Octal) 17 16 15 14 13 12 11 10 7 6 5 4 3 2 1 0 1 0 1 0 0 1 0 1 0 1 1 1 0 1 1 0 Odd, high byte Even, low byte Value - A576 hex A 16-Bit Computer Word with Left-to-Right Byte and Bit Order This figure shows a 16 bit computer word with right to left byte and bit order (as in DEC PDP 11/34 or VAX 11/780). It also represents a 16 bit word in an 8 bit processor (such as Zilog Z 80 or Intel 8088 microprocessor).
Chapter 12 Uploading and Downloading with A B Processors Read this chapter to help you perform uploads from and downloads to Allen-Bradley processors.
12–2 Uploading and Downloading with A-B Processors Uploading from the Processor To make sure the program image is stable during an upload, the PLC interface prohibits program changes during an upload. When you are using the following procedures, the interface blocks all access to PLC memory. To upload information from See page PLC 2 processors 12-2 PLC 3 processors 12-2 PLC 5 processors 12-3 SLC 500 processors 12-6 Uploading from a PLC 2 Processor 1.
Uploading and Downloading with A-B Processors 12–3 Uploading from a PLC 5 Processor Important: Uploads cannot be performed on a PLC-5 processor that is memory protected. You set or remove memory protection by using switch settings on either the I/O rack or on your PLC-5 family processor. (For more information, refer to your processor’s installation manual.
12–4 Uploading and Downloading with A-B Processors Procedure 1 — PLC-5/15/B processors, revision E and earlier 1. Place the PLC-5 processor in Program or Remote Program mode using set CPU mode or the keyswitch on the front of the processor. (For more on set CPU mode, see page 7–26.) 2. Place the PLC-5 processor in Upload mode using upload all request. This locks out all other users from accessing PLC-5 memory. (For more on upload all request, see page 7–33.
Uploading and Downloading with A-B Processors 12–5 Procedure 2 The processor can be in any mode while uploading. 1. Verify the processor type using diagnostic status. (For more on diagnostic status, see page 7–6.) 2. Place the processor in Upload mode using upload all request. (For more on upload all request, see page 7–33.) This command returns a reply which contains the addresses of: • PLC-5 memory segments that you can upload • memory segments that can be verified after upload 3.
12–6 Uploading and Downloading with A-B Processors Uploading from an SLC 500 Processor 1. Open the directory to be read using open file. (For more on open file, see page 7–13.) 2. Read the directory using file read. (For more on file read, see page 7–10.) " File read This may take more than one transaction. 3. Read all other processor files using logical reads. (For more on logical reads, see page 7–17.) 4. Close the program file 0, using close file. (For more on close file, see page 7–5.
Uploading and Downloading with A-B Processors 12–7 Downloading to a PLC 2 Processor 1. Place the PLC-2 processor in Download mode by setting the mode selector switch on the PLC-2 processor to the RUN/PROG or PROG position. ! ATTENTION: Leaving outputs on during a download can cause unexpected machine motion. If you are downloading to a PLC-2/20 or mini-PLC-2 processor in RUN or RUN/PROGRAM mode, the only way to turn an output off is to use physical write to set all output image bits to 0. 2.
12–8 Uploading and Downloading with A-B Processors Downloading to a PLC 3 Processor 1. Determine if the destination PLC-3 processor exists using diagnostic status. (For more on diagnostic status, see page 7–6.) 2. Request the right to download to a PLC-3 processor using download request. (For more on download request, see page 7–8.) 3. Shut down the PLC-3 processor using shutdown request. (For more on shutdown request, see page 7–28.) 4. Download the information using one or more physical writes.
Uploading and Downloading with A-B Processors 12–9 Procedure 1 (PLC-5/15/B rev E and earlier) 1. Place the PLC-5 processor in Program or Remote Program mode using set CPU mode or the keyswitch on the front of the processor. (For more on set CPU mode, see page 7–26.) 2. Place the PLC-5 processor in Download mode using download all request. (For more on download all request, see page 7–8.) This command locks out all other users from accessing the PLC-5 processor.
12–10 Uploading and Downloading with A-B Processors Procedure 2 1. Verify the processor type using diagnostic status. (For more on diagnostic status, see page 7–6.) 2. Place the PLC-5 processor in Program or Remote program mode using set CPU mode or the keyswitch on the front of the processor. (For more on set CPU mode, see page 7–26.) 3. Place the PLC-5 processor in Download mode using download all request. (For more on download all request, see page 7–7.) 4.
Uploading and Downloading with A-B Processors 12–11 Procedure 1 — SLC 500, SLC 5/01 and SLC 5/02 Processors 1. Determine the current mode of the SLC processor using diagnostic status, CMD 06H FNC 03H. (For more on diagnostic status, see page 7–6.) 2. Place the processor in Program mode using change mode, CMD 0FH FNC 80H. (For more on change mode, see page 7–5.) 3. Disable forces using disable forces, CMD 0FH FNC 41H. (For more on disable forces, see page 7–6.) 4.
12–12 Uploading and Downloading with A-B Processors Procedure 2 — SLC 5/03 and SLC 5/04 Processors 1. Make sure the mode selector switch is in the REM (remote) position. 2. Determine the current mode of the processor using diagnostic status, CMD 06H FNC 03H. (For more on diagnostic status, see page 7–6.) 3. Place the processor in the program mode using change mode, CMD 0FH FNC 80H. (For more on change mode, see page 7–5.) 4. Disable forces—if present—using disable forces, CMD 0FH FNC 41H.
Chapter 13 PLC Addressing PLC processors support these types of addressing: Type of Addressing logical Description Type of addressing that a PLC processor uses in its ladder diagram program to access its own data table memory. This is the same type of addressing you use in non privileged commands (that is, in commands that access only PLC data table memory). physical Type of addressing a computer uses to send a privileged command to a PLC node.
13–2 PLC Addressing PLC 2/1774 PLC Addressing PLC-2 and 1774-PLC processors support logical and physical addressing: For information on See page PLC 2/1774 PLC logical addressing 13-2 PLC 2 physical addressing 13-3 1774 PLC physical addressing 13-3 PLC 2/1774 PLC Logical Addressing PLC-2 and 1774-PLC processors access their data tables by using an octal word address. For PLC-2/1774-PLC command messages, you must put the equivalent of this address in the 2-byte message packet field labeled ADDR.
PLC Addressing 13–3 PLC 2 Physical Addressing PLC-2 processors use physical addresses that are directly related to the logical addresses. To convert a logical address to its corresponding physical address: 1. Move bit 7 of the logical address to bit position 1. 2. Shift bits 1 through 6 to the left one position. The following figure illustrates the conversion process for logical word address 121. Remember that the logical PLC-2 address is a byte address, so the physical address is also a byte address.
13–4 PLC Addressing PLC 3 Addressing PLC-3 family controllers support logical, physical, and symbolic addressing. For information on logical addressing 13-5 physical addressing 13-7 symbolic addressing 13-8 Important: " See page PLC-3 processors can accept and transmit PLC-2/1774-PLC command messages with the PLC-2/1774-PLC logical addressing format.
PLC Addressing 13–5 PLC 3 Logical Addressing PLC-3 processors use a form of logical addressing known as extended addressing. With extended addressing, you specify the address for each level (or sub-division) of PLC-3 memory, down to the smallest subdivision you want to access. You can use this method to specify up to 6 levels of extended addressing, which is enough to address any particular word in PLC-3 memory.
13–6 PLC Addressing Example: PLC 3 logical binary addressing format E3 1 8 260 0 0 Data table area = level 1 Context = level 2 Section = level 3 File = level 4 Structure = level 5 Word = level 6 Publication 1770 6.5.
PLC Addressing 13–7 PLC 3 Physical Addressing PLC-3 processors use physical addresses that are related to logical addresses by means of pointers. Since no two PLC-3 systems are configured identically, the pointers are not fixed. Therefore, there is no algorithm for converting logical to physical PLC-3 addresses. A PLC-3 physical address goes in the 4-byte field labeled PLC-3 PHYSICAL ADDR in the PLC-3 physical reads or physical writes. (See Chapter 7, “Communication Commands.
13–8 PLC Addressing PLC 3 Symbolic Addressing Symbolic addressing uses ASCII symbols to represent a logical address. Before using a symbolic address in a message, you must first define the symbol at the PLC-3 processor that is to receive the message. (For more information, refer to your PLC-3 user manual.
PLC Addressing PLC 5 Addressing 13–9 PLC-5 processors support logical and physical addressing: " For information on See page logical addressing 13-10 physical addressing 13-16 floating point 13-17 Transmitting commands from PLC-5 processors To transmit commands from a PLC-5 processor to your computer, set up a computer buffer to simulate a PLC-5 file and write computer application programs.
13–10 PLC Addressing PLC 5 Logical Addressing PLC-5 processors, like PLC-3 processors, use a form of logical addressing. With logical addressing, you specify the address for each level (or sub-division) of PLC-5 memory, down to the smallest subdivision you want to access: With this processor PLC 5 PLC 5/250 You can specify up to 4 levels of extended addressing, which is enough to address any word in PLC 5 memory. 7 levels of extended addressing, which is enough to address any word in PLC 5/250 memory.
PLC Addressing 13–11 PLC-5 Logical Binary Addressing Byte 1 Contents the mask byte This byte determines which four levels of the address are specified. The mask is read from the LSB to the MSB. If a level of an address is not specified, it uses the default value, which is always 0, except for the file number which has a default of 1. You must always specify the last level of an address (even if it is a 0) so that the actual number of levels in a particular address can be determined.
13–12 PLC Addressing PLC 5 Logical Binary Address to Access the Address N7:30 Byte mask byte: indicates 3 levels of addressing will be encoded.
PLC Addressing 13–13 PLC 5 Memory (for use with figures on page 13-12 ) level 1 level 2 level 3 level 4 0 (data table) file number element number sub element number Default files 0 output 1 input 2 status 3 binary 4 timer 5 counter 6 control 7 integer 8 float 0 - 999 9 - 999 user config timer/counter 0 control 1 preset 2 accumulated control 0 control 1 length 2 position PD➀ 0, 1 control 2 SP 4 Kp 6 Ki 8 Kd 26 PV BT 0 control 1 RLEN 2 DLEN 3 data file # 4 element # 5 rack/grp/slot $ N 10 : 3
13–14 PLC Addressing Important: If the value of the mask or a level of the address is greater than or equal to 255, then you cannot encode it into 1 byte. You must flag this case by programming an FF hex at the level address to signify that the level address is greater than or equal to 255 and the next 2 bytes contain the level address. Then code the level into the following two bytes. The following figures show examples of PLC-5/250 logical binary addresses.
PLC Addressing 13–15 PLC 5/250 RM/LP Memory (for use with figures on page 13-14) level 1 level 2 1 public stat word 2 data 0 system level 3 level 4 sect file 0 binary 1 integer 2 long integer 3 reserved 4 float 5 timer 6 counter 7 control 8 PID 9 message 10 string level 5 level 6 level 7 element member submember 0 EN 1 TT 2 DN 3 PRE 4 ACC 0 CU 1 CD 2 DN 3 OV 4 UN 5 PRE 6 ACC Logical ASCII Addressing Logical ASCII addressing is supported by PLC-5/250, PLC-5, and PLC-3 processors.
13–16 PLC Addressing PLC 5 Physical Addressing PLC-5 processors use physical addresses that are related to logical addresses by means of pointers. Since no two PLC-5 systems are configured identically, the pointers are not fixed. Therefore, there is no algorithm for converting logical to physical PLC-5 addresses. A PLC-5 physical address goes in the 4-byte field labelled PLC-5 PHYSICAL ADDR in the PLC-5 physical read or write command message packets. A physical address is made of 24 bits.
PLC Addressing 13–17 PLC 5 Floating Point PLC-5 type reads and type writes use the IEEE floating point. (This is the default for PLC-5 processors.) This means data is returned: • low word then high word • low byte then high byte Example: PLC 5 type read 2.0 = FF FF FF low word low BF high word high low high exponent MSB mantissa middle MSB mantissa 1000.00 = 00 00 7A 44 00 00 LSB mantissa Example: PLC 5 word range read 1000.00 = 7A 44 low word low high word high low 2.
Chapter 14 Line Monitor Examples This chapter contains line monitor examples for DF1 protocol. Each example shows how actual commands and replies look on a line monitor (bytes are shown in hexadecimal). It contains these sections: Section Page Half duplex Line Monitor Example 14-2 Full duplex PLC 2 Line Monitor Example 14-3 Full duplex PLC 3 Line Monitor Example 14-6 Publication 1770 6.5.
14–2 Line Monitor Examples Half duplex Line Monitor Example When monitoring half-duplex protocol in two-wire mode, you need to monitor only one line. The example below shows a message sent by the master and a reply sent by the slave in response to a poll.
Line Monitor Examples Full duplex PLC 2 Line Monitor Example 14–3 In the following example an unprotected read (CMD 01 hex) is sent: • from a computer connected to a 1770-KF2 with Data Highway node address 012 (octal) • to the PLC-2/30 connected to a 1771-KA2 with Data Highway node address 011 (octal) DH link node 012 1770 KF2 1771 KA2 computer PLC 2/30 node 011 Command Path 1 DLE STX DST SRC CMD STS TNS 10 02 09 00 01 00 01 ADDR 00 11 00 SIZE DLE ETX BCC 02 10 03 E2 Path
14–4 Line Monitor Examples Command Field DLE STX (2 bytes) DST (destination) Value 10 02 09 SRC (source) 00 CMD (command) 01 STS TNS (transaction) (2 bytes) 00 01 00 ADDR (address) (2 bytes) 11 00 SIZE DLE ETX (2 bytes) BCC (block check character) 02 10 03 E2 DLE ACK 10 06 Function Indicates the start of a message Indicates the remote node address that the computer is communicating to. 09 hex equals 011 octal, the address of the 1771 KA2.
Line Monitor Examples Reply Field DLE STX (2 bytes) DST (destination) Value 10 02 0A SRC (source) 09 CMD (command) 41 STS (status) 00 TNS (transaction) (2 bytes) 01 00 DATA FF FF DLE ETX (2 bytes) BCC (block check character) 10 03 DLE ACK AD 10 06 14–5 Function Indicates the start of the reply message Indicates the node address that the reply is being sent back to.
14–6 Line Monitor Examples Full duplex PLC 3 Line Monitor Example In this example three word range reads (CMD 0F, FNC 01) are sent: • from a computer connected to a 1770-KF2 with DH node address 012 (octal) • to the PLC-3 connected to a 1775-KA with DH node address 011 (octal) This example requires three commands and the corresponding replies to read 684 bytes of data from the PLC-3 processor. The following describes the first command and reply fields only.
Line Monitor Examples 14–7 Command Field DLE STX (2 bytes) DST (destination) Value 10 02 09 SRC (source) 00 CMD (command) 0F STS TNS (transaction) (2 bytes) 00 02 00 FNC (function) 01 PACKET OFFSET (2 bytes) 00 00 TOTAL TRANS (total transaction) (2 bytes) 56 01 ADDRESS (variable number of bytes) 2C 08 0A 00 SIZE E4 DLE ETX (2 bytes) BCC (block check character) 10 03 6C DLE ACK 10 06 Function Indicates the start of a message Indicates the remote node address that the computer is commu
14–8 Line Monitor Examples Reply Field DLE STX (2 bytes) DST (destination) Value 10 02 0A SRC (source) 09 p CMD (command) 4F STS (status) 00 TNS (transaction) (2 bytes) 02 00 DATA 228 bytes DLE ETX (2 bytes) BCC (block check character) 10 03 DLE ACK 10 06 Function Indicates the start of the reply message Indicates the node address that the reply is being sent back to.
Chapter 15 ASCII Codes ASCII NUL Hex 00 Binary 00000000 Decimal 0 ASCII ) Hex 29 Binary 00101001 Decimal 41 SOH 01 00000001 1 * 2A 00101010 42 STX 02 00000010 2 + 2B 00101011 43 ETX 03 00000011 3 ' 2C 00101100 44 EOT 04 00000100 4 - 2D 00101101 45 ENQ 05 00000101 5 .
15-2 ASCII Codes Publication 1770 6.5.
ASCII Codes ASCII Hex AC Binary 10101100 Decimal 172 AD 10101101 AE 10101110 AF ASCII 15-3 Hex D9 Binary 11011001 Decimal 217 173 DA 11011010 218 174 DB 11011011 219 10101111 175 DC 11011100 220 B0 10110000 176 DD 11011101 221 B1 10110001 177 DE 11011110 222 B2 10110010 178 DF 11011111 223 B3 10110011 179 E0 11100000 224 B4 10110100 180 E1 11100001 225 B5 10110101 181 E2 11100010 226 B6 10110110 182 E3 11100011 227 B7 10110111 183 E4
Index Symbols **Empty**, P-1, P-2, P-4, P-5, 2-2, 2-3, 6-1, 6-2, 6-3, 7-1 1775-KA, 9-21 1775-S5, 9-21, 9-23 1775-SR5, 9-21, 9-23 1779, 9-24 Numbers 16-bit computer word, 11-7 16-bit PLC word, 11-7 1747, 9-3 1747-KE, 9-3 1747-L20, 9-3 1747-L30, 9-3 1779-KP5, 9-24 1784, 9-25 1784-KR, 9-3 1784-KT, 9-25 1784-KT2, 9-25 1784-KT, Connection to Data Higway Plus, 2-1 1747-L40, 9-3 1784-KT2, Connection to Data Highway Plus, 2-1 1747-L511, 9-3 1785, 9-26, 9-33 1747-L514, 9-3 1785-KA, 9-26, 9-27 1747-L524, 9
I–2 Index Application layer, 1-7 description of, 1-8 Application layer protocol, 6-1 Application program, how it sends and receives messages, 6-2 Apply port configuration, 7-4 ASCII codes, 15 1 numerical values, 15 1 Cyclic redundacy check (CRC), 5-6 D Dat Highway Plus diagnostic counters, PLC-5, 9-32 DATA, definition, 6-3 Data bytes, description of, 1-9 Asynchronous link, description of, 1-2 Data encoding, 11-1 asynchronous link, definition, 1-2 Data Highway baud rate, 1-3 description, 1-3 floating
Index Data link layer protocols, 2-4 Data type ID, 7-29 E Data type size, 7-29 Error codes, 1-11 returned by local node, 1-11 Decimal, 11-2 EXT STS, 6-6 DH+ diagnostic counters, 1747-L542, 9-4, 9-5, 9-6 EXT STS byte, EXT STS byte, 8-3 DH-485 connection to Data Highway Plus, 1-6 description, 1-6 example network, 1-6 Extended addressing, 13-5 DH485 diagnostic counters 1747-KE, 9-3 1747-L20, 9-3 1747-L30, 9-3 1747-L40, 9-3 1747-L511, 9-3 1747-L514, 9-3 1747-L524, 9-3 1747-L532, 9-3 1747-PA2x, 9-3 17
I–4 Index M Manual purpose, P-1 who should read, P-1 Master, 2-3 Master packet, 5-2 Message priority, 1-10 reply, 1-9 Message bytes, data bytes, 1-9 message bytes, protocol bytes, 1-9 Message packet format, command and reply, 6-3 Message packet formats, 7-1 Message packets, how they are sent, 1-9 Message priority high, 1-10 how to specify, 1-10 normal, 1-10 Message sink, 3-3 Message source, 3-3 Message transer, poll with no message available, 3-11, 3-13 Message transfer duplicate message, 3-11, 3-15 messa
Index Protocol environment definition, 4-3 message characteristics, 4-4 message sink, 4-3 message source, 4-3 transmitter operation, 4-5 R Receiver operation, 4-7 ACK, 4-8 DLE ENQ, 4-8 NAK, 4-8 Releated Products, P-4 Remote error, 8-2 remote node, definition of, P-3 Remote STS and EXT STS codes, meaning, from a PLC-3, 8-6 Remote STS Codes, meaning, sent from a PLC-2 or 1774-PLC, 8-5 remote STS error codes, 8-3 responder, definition, 1-8 I–5 Status codes, asynchronous link, 8-1 Status DATA 1770-KF3, 10-7
Allen Bradley Publication Problem Report If you find a problem with our documentation, please complete and return this form. DF1 Protocol and Command Set Reference Manual Pub. Name Cat. No. various Check Problem(s) Type: Pub. No. 1770 6.5.16 Pub. Date October 1996 Part No.
PLEASE FASTEN HERE (DO NOT STAPLE) PLEASE FOLD HERE NO POSTAGE NECESSARY IF MAILED IN THE UNITED STATES BUSINESS REPLY MAIL FIRST-CLASS MAIL PERMIT NO.
Allen Bradley, a Rockwell Automation Business, has been helping its customers improve productivity and quality for more than 90 years. We design, manufacture and support a broad range of automation products worldwide. They include logic processors, power and motion control devices, operator interfaces, sensors and a variety of software. Rockwell is one of the world's leading technology companies. Worldwide representation.
