Sy/Max Protocol

Date : 27/01/2001
Prepared by : Cesar Garcia
Original information : SquareD Buolletin
Version : 1.0.0

INTRODUCTION
The SY/MAX PC Family protocol which is based on the ANSI 3.28 standard, provides for many operator
fuctions. These functions consist of loading and retrieving ladder rungs, searching for I/O’sor registers,
forcing I/O, and reading or writing register data and I/O status. For the majority of applications, all that is
needed is register data and I/O status information.

The following is a description of the minimum programming requirements to obtain and send register data
and I/O status. I/O points and data storage are both defined as register values. Therefore, a register read will
bring back either I/O status or a data value depending on how the register has been assigned in the
programmable controller. A register write performs the function of entering a value into a data regsiter. A
register write to an I/O will cause the register value to change only until the logic of the particular I/O point
is scanned. At that point program control takes over.

It is assumed that the user has read and understands the set-up and programming of communication
statements of SY/MAX devices. All numeric values are decimal unless otherwise shown.

This information is subject to change without notice. Square D can accept no liability for actual use based
upon illustrations and examples within.

1. HARWARE REQUIREMENTS
All SY/MAX PC Family devices communicate via RS-422, otherwise referred to as differential. RS-422 is
not compatible with RS-232C and, therefore, a converter may be used.

The SY/MAX PC Family processor pinout is as follows:

www.plctools.org
Sy/Max Protocol

Pin Number Function

1 Transmitted Data -
2 Transmitted Data +
3 Received Data -
4 Received Data +
5 +5 volts DC
6 +5 volts DC
7 Signal Ground
8 Signal Ground
9 Chassis Ground (cable shield)

2. SY/MAX COMMUNICATION
A completed communication message between two devices using SY/MAX protocol consists of four steps as
outlined below. Note that the protocol has been developed so that either the SY/MAX device or the user
device can be the initiator of the communication.

1. The initiating (command) device sends address and register data (write command) or requests register
data (read command) from the responding device.
2. The responding device acknowledges the transmission.
3. The responding device sends bacl to the initiating device a reply message that consists of status register
data for a write command or both register data and status register data for a read command. The status
register defined within the protocol is used to monitor the transmission information and errors.
4. The initiating device acknowledges the transmission referred to in 3.

WRITE

READ

www.plctools.org
Sy/Max Protocol

3. COMMUNICATION RATES
All transmissions are asynchronous seria binary, full duplex;

1 start bit, 1 stop bit, even parity, 8 data bits.

The baud rate for the communication is determined by the value in SY/MAX Processor register 8169. Each
port (COMM or PRG) may have its baud rate individually set. SY/MAX Processors default to 9600 baud on
power up if the baud rate register has not been previously altered. The selected baud rates are stored in
battery backed up memory.

4. MESSAGE FORMAT
A read or write message has the following format:

NOTE: All numerical vaalues followed by an “H” refer to hexadecimal.

4.1 Start of Message

DLE|SOH Start of message flag.

EVE/ODD Alternating message ID character. This code must alternate with each message.
Eeven=DC1 (11H) or Odd=DC2 (12H)

ROUTE OPT Optional SY/Net Communications Network Routing information. See note 1
CAUTION: When connected to a SY/NET communication network via the Network Interface Module, the
device dupplicating the SY/MAX protocol must have the ability to reject unimplemented opcodes.

DLE|STX End of header/star of data flag.

OPCODE Message Description:

Read register command = 20H
Write register command = 1EH
Read register reply = 90H
Write register reply = 92H

DATA The data section will vary depending on the type of communication, read or write, and if the
transmission is a command or reply.

4.2 Data Section

www.plctools.org
Sy/Max Protocol

4.2.1 Read Register Command (20H)

Status Register Addres - The address of the regsiter in the initiating device used to monitor the read
operation.
Local Register Address - The final destination in the initiating device of data.
Remote Register Address - The source of the requested data in the responding device.
Count - The number of sequential registers, starting with remote register address, being requested. The
count value is placed in the protocol as two byte number computed by subtracting one from the desired count
value. The Sy/MAX count number is 16 bit wide. The count must be sent as two 8 bit words. The upper 8
bits are sent followed by the lower 8 bits. If only one register is requested the count value is 0.0. If 6 register
are requested, the ciunt is 0.5.

4.2.2 Write Register Command (1EH)

Status Register Addres - The address of the regsiter in the initiating device used to monitor the read
operation.
Remote Register Address - The final destination in the receiving device of the data being transferred.
Register Data - The data being transferred. If more than on register is transferred, the register data is sent,
by register address, in sequential ascending order. The SY/MAX data register are 16 bits wide. The data
must be sent as two 8 bit words. The upper 8 bits (most significant bits) are sent followed by the lower 8 bits
(least significant bits).

4.2.3 Read Register Reply (90H)

Status Register Addres - The address of the regsiter in the initiating device used to monitor the read
operation.
Status Data - The Status data is used to monitor the data transfer. The bit pattern is set by the responding
device. SY/MAX Processor status data is:

Bit Meaning if Bit Has Been Set to 1

16 Good communication has transpired, there were no errors.
15 SY/MAX Processor that is responding is in rung.
1 An error has occurred.
1 and 3 Illegal Operation - An attempt was made to read from a device with no registers.
1, 3 and 4 Receiver Overflow - Too many registers were sent or resquested.

Any error (an error is indicated by bit 1 set to a 1) will cause the message data to be ignored by the initiating
device.
Local Register Address - The final destination in the initiating device of data.
Register Data - The data being transferred. If more than on register is transferred, the register data is sent,
by register address, in sequential ascending order. The SY/MAX data register are 16 bits wide. The data
must be sent as two 8 bit words. The upper 8 bits (most significant bits) are sent followed by the lower 8 bits
(least significant bits).

4.2.4 Write Register Reply (92H)

Status Register Address - The same address as the status register in the command statement.
Status Data - The status register bit pattern set by a SY/MAX Processor for a write command is as follows:

Bit Meaning if Bit Has Beenn Set to 1

www.plctools.org
Sy/Max Protocol

16 Good communication has transpired, ther were no errors.

15 Proccesor that is responding is in run.
1 Communication error has ocurred.
1 and 2 Illegal Address - An attempt was made to write into and address that does not exist.
1 and 3 Illegal Operation - An attempt was made to write to a device that does not contain
registers.
1 and 4 Write to a read Only register - An attempt was made to write to a read only register or a
I/O register.
1 and 5 Receiver Overflow - Too many registers were sent to the remote proccesor.

Any error (bit 1 set) will cause communication to be terminated. If a Sy/MAX Proccesor is the responding
device and a error accurs, the data in thewrite commandis thrown away.

4.3 Data Section

DLE|ETX End of data flag.

CHECK SUM Eight bit 2’s compliment of the sum of all character following “SOH” and through “ETX”.
PAD End of message (FEH) - one or more pads must be sent to terminate the communication.

5. ACKNOWLEDGE RECEPTION
After each (command or reply) message transmission, the device that receives the (command or reply)
message must check that the message for errors and then respond to the device that transmitted the
(command or reply) message with an acknowledge/negative acknowledge or too busy to process the message.
This response must be sent within ten character times os the end of transmission. The response messages
should take the following forms:

5.1 Positive Acknowledge

DLE|EVEN/ODD if the even/odd code matches the transmitted code, the transmission is completed.
If the even/odd code does not match, the response should be treated as a DEL NAK.

5.2 Negative Acknowledge

DLE|NAK The receiving device will respond with a DEL NAK if an error (check sum, parity, overrun or
incorrect format) is detected. The originating device should automatically resend the message up to 8 times.
(SY/MAX Proccesor will automatically resend the message.)

5.3 Device Busy Acknowledge

DLE|SYN Indicates the receiving device was too busy to respond. The message should be automatically
resent until a DEL EVEN/ODD or DEL NAK is received. At that time, the rules for DEL,EVEN/ODD and
DEL NAK should be followed.

6. EMBEDDED RESPONSE
Acknowledge reception responses (DEL EVEN/ODD, NAK or SYN) can be embedded within a command or
reply message, or interleaved between messages. A SY/MAX PC Family device will embed a response if,
while it is transmitting a message, it receives a message through the same port. The response will be placed
inside the message currently being transmitted. These embedded responses are not allowed:

www.plctools.org
Sy/Max Protocol

1. Between DEL and a control code (ETX, SOH, STX or DEL).

2. Between ETX and the checksum.

Embedded responses accur because the protocol specifies that an acknoeledgement to a message must be sent
within 10 character times of the end of a received message. Because the SY/MAX device has full duplex
communication capability, a message can be received while a totally different message is being transmitted.
If the received message is completed, and the transmitted message has more than 10 characters left to
transmit, the DEL EVEN/ODD, NAK or SYN must be embedded in the message currently being sent.

To avoid having to transmit or receive an embedded response, follow the two rules below:

1. The deice duplicating the protocol must act as the communication master. It must initiate al lread and
write command.
2. Allow only one communication at a time. Once a command is sent, another command cannot be sent
until the reply is received and acknowledged.

If both the above procedures are not followed, the device duplicating the protocol must be capable of
handling embedded response situation.

7. SPECIFIC PROTOCOL FORMAT REQUERIMENTS

ADDRESSES - All addresses (status, local and remote) are put into SY/MAX protocol using the following
formula:
1. Multiply the decimal address by 2.
2. Subtract 2.
3. Result is the SY/MAX protocol value of the address.

Example : Address 40
40*2 = 80
80-2=78 Address 0040 in SY/MAX protocol is 0078.

EVEN/ODD - With every command or reply communication message, an alternating code of 11 hex or 12
hex will be sent in the message. All acknowledgements to messages must be made using the same even/odd
code. If the acknowledgement does not match the message even/odd code, the processor will assume the
acknowledgement is incorrect and resend the original message. The even/odd byte should not be alternate
when a message retry is necessary. If the last response to a transmitted DEL ENQ was a DEL NAK, the
ODD/EVEN code can be set to either odd or even.

DATA - The 16 bit data registers are sent as two 8 bit words. The first 8 bits are sent as the most significant
byte (M.S.B.), the second 8 bits are sent as the least significant byte (L.S.B.).

8. ROUTING
CAUTION: When performing register read and writes as erations over SY/NET it is possible to encounter
protocol situations not covered in this literature. Therefore, all computers dupplicating the SY/MAX
protocol should reject all messages that are not register read and write described above.

www.plctools.org
Sy/Max Protocol

Route characters can be optionally inserted in a communication message. For a simple communication (not
over SY/NET) no route information is needed. A route consists of the network interface module numbers
that must handle the message between its source and destination.

The network interface module has an eight bit number transmitted as 2 ASCII hex characters. A
transmission along a single networks requires a minimum of two drop numbers of two characters apiece.
One pair for the source (sender) and one pair for the destination (receiver). There can be maximun of eight
route number pairs in a message.

The decimal route numbers are converted to SY/MAX protocol by:

1. Converting the decimal route number into its hexadecimal equivalent.

2. Converting each hex digit into the Hex ASCII code for that digit.
3. The Hex ASCII digits are then placed in the read or write statement.

Example: Route 15 is converted to 0F hex. The Hex ASCII code for 0 is 30H; for F it is 46.
A route of 15 has the protocol form 30 46.

Rounting example for SY/MAX Proccesor:

This is sent as:

The receiving device turns the route around in its reply.

DEL even/odd, DEL NAK and DEL SYN replys do not need routing. This data does not go out over the
network, it is processed by the SY/NET Network Interface module.

9. DLE IN DATA FIELD

It is possible that a byte of data between the first DEL STX and the last DEL ETX may be a “DEL” (10H).
In order to prevent this data from begin interpreted as part of a control sequence, an extra “DEL” must be
sent with each data byte that happens to be a “DEL” (10 hex). The extra DEL’s should be added into the
checksum. When the receiving device sees two “DEL’s”, one of them should be removed from the data field
(but remember it’s still part of the checksum).

If a message’s checksum is equal to 10H (DEL) no extra “DEL’s” should be sent.

10. RETRANSMISSION
A DEL ENQ is sent by a SY/MAX Proccesor to the responding device to request retransmission of that
devices most recently transmitted response (DEL EVEN/ODD, NAK, or SYN). A DEL ENQ will be sent by
the processor for the following reasons:

1. If the SY/MAX Proccesor has not received a valid response (DEL EVEN/ODD, NAK, or SYN) after
sending a message and waiting 10 character times, the SY/MAX processor will send a DEL ENQ to
request retransmission of the last response. The procedure must be followed in order to prevent dropped
or duplicated messages. If the SY/MAX processor sends 32 DL ENQ’s (10 character times apart) and no
valid response is received, the processor assumes the communication link has been broken. The
SY/MAX processor will place an error code in register 8175 and proceed with any other communication

www.plctools.org
Sy/Max Protocol

that may be present. See the Programmer or Processor Instruction Bulletins for an explanation of error
codes.
2. A DEL ENQ is continuosly sent by the processor if the communication link is idle. This is done to
determine if the serial link is operational. If 32 DEL ENQ (10 character time apart) are sent by the
proccesor with no response, the processor assumes that the link is not operational. The processor will
then respond to the next DEL ENQ sent to it with a DEL NAK.
3. When power is firts applied, a SY/MAX Proccesor sens a DEL ENQ request to check if:a) any devices
are connected to its ports, and b) find the odd/even code of the connected device. If no response is
generated, tha last response is set to NAK as explained in b.

NOTE : Although the above discussion on DEL ENQ refers to the processor, any device duplicatting the
protocol must also follow the above procedure to assure message transmissions.

RECEIVING A DLE ENQ

The reception of a DEL ENQ should cause the receiving device to resend its last response. The only valid
responses to a DLE ENQ are DLE DC! (odd), DLE DC2 (even), DLE NAK or DLE SYN. A DLE SYN
does not satisfy the DLE ENQ, it only resets the ENQ counter.

CAUTION: The DLE ENQ is used for error recovery and must be implemented in order to prevent dropped
or duplicated messages.

11. SY/MAX MODEL 100

The Model 100 obeys all of the preceding protocol information. However, the Model 100 will not transmit a
reply to a read register or write register command without first being sent a DEL ENQ. Therefore, when
implementing a protocol with Model 100, after sending the command message, a DEL ENQ must be sent to
initiate the reply sequence.

12. EXAMPLES OF A SY/MAX PROCESSOR INITIATED COMMUNICATION.

12.1 Read

The following is a example of the data generated when a processor performs a “read register” statement.

The message is sent on an open to closed transition of the initiating contact.

Command Message

Number of ASCII Code Hex Code

Bytes
1 DEL 10
1 SOH 01
1 DC1 or DC2 11 or 12
1 DEL 10
1 STX 02
1 Opcode 20
2 Status Reg. Address 00 M.S.B.
26 L.S.B.

www.plctools.org
Sy/Max Protocol

2 PC reg. Address 00 M.S.B

28 L.S.B.
2 User Reg. Address 00 M.S.B.
00 L.S.B.
1 Count 00 M.S.B
04 L.S.B.
1 DEL 10
1 ETX 03
1 Checksum 58 or 57
(depending on
Even/Odd)
1 to 10 PAD FE

Acknowledge Command:

The receiving device now acknowledge with

Number of ASCII Code Hex Code

Bytes
1 DEL 10
1 Odd or Even 11 or 12
or NAK or SYN or 15 or 16.

This completes one side of the transmission. The receiving device now assembles the proper bits and replys
to the PC with following:

Assume receiving device has the following values in its firts 5 registers.

Reg. # Value
S1 10
S2 11
S3 12
S4 13
S5 14

Reply Message:

Number of ASCII Code Hex Code

Bytes
1 DEL 10
1 SOH 01
1 DC1 or DC2 11 or 12
1 DEL 10
1 STX 02
1 Opcode 90

www.plctools.org
Sy/Max Protocol

2 Status Reg. Address 00 M.S.B.

26 L.S.B.
2 Status Reg. Data 80 M.S.B
00 L.S.B.
2 PC Register Address 00 M.S.B.
28 L.S.B.
2 Data 00 M.S.B.
0A L.S.B.
2 Data 00 M.S.B.
0B L.S.B.
2 Data 00 M.S.B.
0C L.S.B.
2 Data 00 M.S.B.
0D L.S.B.
2 Data 00 M.S.B.
0E L.S.B.
1 DEL 10
1 ETX 03
1 Checksum 30 or 2F
1 to 10 PAD FE

Acknowledge Reply:

The PC now sends:

Number of ASCII Code Hex Code

Bytes
1 DEL 10
1 DC1 or DC2 or NAK 11 or 12 or 15

The transmission is complete. The data is in the PC’s register 21-25.

12.2 Write

The following is an example of the data generated when a processor performs a “write register” statement.

The message is sent on an open to closed transition of initiating contact.

Reg. 10 of the local processor is assumed to contin A00 Hex.

Command Message:

Number of ASCII Code Hex Code

Bytes
1 DEL 10
1 SOH 01
1 DC1 or DC2 11 or 12

www.plctools.org
Sy/Max Protocol

2 Route 01
Route 07
1 DEL 10
1 STX 02
1 Opcode 1E
2 Status Reg. Address 80 M.S.B
0E L.S.B.
2 PC Address Local 00 M.S.B.
12 L.S.B.
2 User Reg. Adrress 00 M.S.B.
(remote) 1C L.S.B.
2 Local reg. Adrress 00 M.S.B.
AA L.S.B.
1 DLE 10
1 ETX 03
1 Checksum BE or BD
1 to 10 PAD FE

Acknowledge Command:

The receiving device now acknowledges

Number of ASCII Code Hex Code

Bytes
1 DEL 10
1 DC1 or DC2 or NAK or SYN 11,12, 15 or 16

This ends the first prt of the communication. The user places the data sent it in the proper register and then
returns the status data.

Reply Message:

Number of ASCII Code Hex Code

Bytes
1 DLE 10
1 SOH 01
1 DC1 or DC2 11 or 12
2 Route 07
Route 01
1 DLE 10
1 STX 02
1 Opcode 92
2 Status Reg. Address 00 M.S.B
0E L.S.B.
2 Status Reg. Data 80 M.S.B.
00 L.S.B.

www.plctools.org
Sy/Max Protocol

1 DLE 10
ETX 03
1 Checksum A2 or A1
1 to 10 PADS FE

Acknowledge Reply:

The PC will now sen a reply:

Number of ASCII Code Hex Code

Bytes
1 DEL 10
1 DC1 or DC2 or NAK or SYN 11,12, 15 or 16

This ends the communication.

13. ASCII / HEXADECIMAL CODE EQUIVALENTS

ASCII Code Hex Code

DEL 10
EVEN/ODD
Even = DC1 11
Odd = DC2 12
ENQ 05
ETX 03
NAK 15
OPCODE
Read register command 20
Write register command 1E
Read register reply 90
Write register reply 92
PAD FE
SOH 01
STX 02
SYN 16

www.plctools.org
Sy/Max Protocol

www.plctools.org