Modulo CMM311 - GeFanuc PDF
Modulo CMM311 - GeFanuc PDF
Modulo CMM311 - GeFanuc PDF
GE Fanuc Manuals
http://www.pdfsupply.com/automation/ge-fanuc-manuals/series-90-709070/GFK-0582
series-90-70-9070
1-919-535-3180
GE Fanuc Automation
Programmable Control Products
Users Manual
GFK-0582D November 2000
GFL002
Caution
Caution notices are used where equipment might be damaged if care is not taken.
Note
Notes merely call attention to information that is especially significant to understanding and operating the equipment. This document is based on information available at the time of its publication. While efforts have been made to be accurate, the information contained herein does not purport to cover all details or variations in hardware or software, nor to provide for every possible contingency in connection with installation, operation, or maintenance. Features may be described herein which are not present in all hardware and software systems. GE Fanuc Automation assumes no obligation of notice to holders of this document with respect to changes subsequently made. GE Fanuc Automation makes no representation or warranty, expressed, implied, or statutory with respect to, and assumes no responsibility for the accuracy, completeness, sufficiency, or usefulness of the information contained herein. No warranties of merchantability or fitness for purpose shall apply.
The following are trademarks of GE Fanuc Automation North America, Inc.
Alarm Master CIMPLICITY CIMPLICITY 90-ADS CIMSTAR Field Control FrameworX GEnet Genius Helpmate Logicmaster Modelmaster Motion Mate PowerTRAC ProLoop PROMACRO Series Five Series 90 Series One Series Six Series Three VersaMax VersaPro VuMaster Workmaster
E Copyright 1989 - 2000 GE Fanuc Automation North America, Inc. All Rights Reserved
Preface
Whats new in this Manual
Information has been added about the following products and features: D D D D D D D D Series 90 Serial Port Communications Capabilities table (Chapter 1) IC693CPU363 and Series 9070 CPU serial ports (Chapter 3) Break-Free SNP (Chapter 3) Serial I/O protocol (Chapters 3 and 9) Port Isolator IC690ACC903 (Appendix G) SNP multidrop (Appendix H) Use of modems (Appendices I, J, and K) RTU wiring methods (Chapter 8)
Chapter 2.
Chapter 3.
Chapter 4
Chapter 5.
GFK-0582D
Preface
Chapter 6. SNP Service: Defines the SNP and SNP-X service commands; explains how the parameters of the service commands are included in the Data Block of the COMMREQ. Numerous ladder programming examples are given. Protocol Definitions - CCM, RTU, SNP, SNP-X: Describes the CCM, RTU, SNP, and SNP-X Protocols. Cable Connection Diagrams: Describes how to construct serial communications cables and wire them to serial devices. Includes new section on RTU 2/4wire, and data sheets for the IC693CBL316 serial Station Manager cable and the IC690CBL714A serial Multidrop cable. Serial I/O Protocol: Describes how to use this feature to write custom protocols for communicating with devices such as bar code readers and pagers. Glossary: Contains a concise, alphabetized listing of communications terms and acronyms. ASCII Code List: Contains a complete ASCII Code List. CCM Compatibility: Provides a comparison among the Series 90, Series Six, Series Five, and Series One PLC CCM protocol implementations. RTU Compatibility: Provides a comparison among the Series 90, Series Six, and Series Five PLC RTU implementations. Serial Line Interface: Describes the Serial Line Interface as implemented by the Series 90 PLCs. Communication Networks: Describes the types of communications networks that can be used to interconnect Series 90 PLCs. IC690ACC903 Port Isolator: Data sheet for the Port Isloator product. SNP Multidrop: Describes various configurations of SNP multidrop for Series 90 products. Discusses cables and troubleshooting. General Modem Information: Modem recommendations, operating tips, and sample diagram. Using Modems with LM90: Describes how to set communications parameters in Logicmaster when using modems. Modem Setup with VersaPro and Control: Describes how to set communications parameters in VersaPro or Control when using modems. Getting Help: Lists phone numbers and web addresses where you can obtain help for a variety of serial communications problems. Series 90 Micro Serial Ports: Describes the capabilities of the Series 90 Micro PLC serial ports.
GFK-0582D
Chapter 7.
Chapter 8.
Chapter 9.
Appendix A.
Appendix B. Appendix C.
Appendix D.
Appendix E.
Appendix F.
Appendix G. Appendix H.
Appendix I.
Appendix J.
Appendix K.
Appendix L.
Appendix M.
iv
Preface
Appendix N. IC655CCM590 Isolated Repeater Converter (Obsolete Product): Provides a data sheet for this product. IC690ACC901 Miniconverter/Cable Kit: Provides a data sheet for this product.
Appendix O.
Related Publications
GFK-0255 GFK-0487 GFK-0263 GFK-0265 GFK-0466 GFK-0467 GFK-0402 GFK-0262 GFK-0356 Series 90 Programmable Coprocessor Module and Support Software Users Manual Series 90 Programmable Coprocessor Module Reference Manual Logicmaster 90-70 Programming Software Users Manual Logicmaster 90-70 Programmable Controller Reference Manual Logicmaster 90 Series 90-30/20/Micro Programming Software Users Manual Logicmaster 90-30/20/Micro Programmable Controller Reference Manual Hand-Held Programmer for Series 90-30/20/Micro programmable Controllers Users Manual Series 90-70 Programmable Controller Installation Manual Series 90-30 Programmable Controller Installation Manual
Preface
Contents
Chapter 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Quick Guide to the Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Series 90 Serial Port Communications Capabilities . . . . . . . . . . . . . . . . . . . . Series 90 Micro PLC Serial Communications Protocol Support . . . . . . . . . . . Serial Communications Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . .
11
11 12 13 13
Chapter 2
21
21
22
23 24 24
27
27 28 210 210 210 212
Chapter 3
31
31 32 35 36 37 39 315
Chapter 4
41 42
42 43 44
vii
GFK-0582D
Contents
Section 2: The COMMREQ Ladder Instruction . . . . . . . . . . . . . . . . Section 3: The COMMREQ Command Block . . . . . . . . . . . . . . . . . . Chapter 5 CCM Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Section 1: The CCM COMMREQ Data Block . . . . . . . . . . . . . . . . .
Structure of the CCM Data Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Block Summary for CCM Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CCM Memory Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The CCM Scratch Pad (Memory Type 6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Diagnostic Status Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CCM Memory Addressing and Data Lengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . CCM Memory Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CCM Data Lengths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
45 47 51 52
52 53 55 56 58 59 59 510
Section 2: The CCM COMMREQ Status Word . . . . . . . . . . . . . . . . Section 3: CCM COMMREQ Programming Examples . . . . . . . . . .
Ladder Program Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CCM Command Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set Q Response: 06001 (1771) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Clear CCM Diagnostic Status Words: 06002 (1772) . . . . . . . . . . . . . . . . . . . Read CCM Diagnostic Status Words to Source Registers: 06003 (1773) . . . Software Configuration Command: 06004 (1774) . . . . . . . . . . . . . . . . . . . . Read Target to Source Memory: 06101-06103 (17D5-17D7) . . . . . . . . . . . . Read Q-Response to Source Register Table: 06109 (17DD) .............................................................. Single Bit Write: 06110 (17DE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write to Target from Source: 06111-06113 (17DF-17E1) . . . . . . . . . . . . . . .
511 514
514 516 516 517 517 518 519 520 521 522
Chapter 6
61 62
63
64
65 66
GFK-0582D
Contents
Section 3: SNP COMMREQ Programming Example . . . . . . . . . . .
Ladder Program Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Clear Diagnostic Status Words: 07000 (1B58) . . . . . . . . . . . . . . . . . . . . . . . . Read Diagnostic Status Words: 07001 (1B59) . . . . . . . . . . . . . . . . . . . . . . . . Change SNP ID: 07002 (1B5A) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set X-Status Bits Address: 07003 (1B5B) . . . . . . . . . . . . . . . . . . . . . . . . . . . Disable Break-Free SNP Slave Operation: 07004 (1B5C) . . . . . . . . . . . . . . . Enable BreakFree SNP Slave Operation COMMREQ: 7005 (1B5D) . . . . . X-Read: 07101 (1BBD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X-Write: 07102 (1BBE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Attach: 07200 (1C20) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change Privilege Level: 07201 (1C21) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Read System Memory: 07202 (1C22) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write System Memory: 07203 (1C23) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Read Task Memory: 07204 (1C24) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write Task Memory: 07205 (1C25) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Read Program Block Memory: 07206 (1C26) . . . . . . . . . . . . . . . . . . . . . . . . Write Program Block Memory: 07207 (1C27) . . . . . . . . . . . . . . . . . . . . . . . . PLC Short Status: 07208 (1C28) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Return Control Program Name: 07209 (1C29) . . . . . . . . . . . . . . . . . . . . . . . . Return Controller Type and ID Information: 07210 (1C2A) . . . . . . . . . . . . . Return PLC Time/Date: 07211 (1C2B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Return Fault Table: 07212 (1C2C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set PLC Time/Date: 07213 (1C2D) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Toggle Force System Memory: 07214 (1C2E) . . . . . . . . . . . . . . . . . . . . . . . . Establish Datagram: 07215 (1C2F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Update Datagram: 07216 (1C30) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cancel Datagram: 07217 (1C31) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Update Real-Time Datagram: 07218 (1C32) . . . . . . . . . . . . . . . . . . . . . . . . . Long Attach: 07300 (1C84) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Autodial Command: 07400 (1CE8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
616
616 620 621 622 624 625 627 629 630 632 634 638 640 641 642 643 644 645 646 648 650 652 653 655 656 658 661 662 663 665 668
Chapter 7
71 72
72 77 79 711 713 714 716 717 718 719
ix
GFK-0582D
Contents
Section 2: RTU Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Character Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Timeout Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cyclic Redundancy Check (CRC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Calculating the CRC-16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Example CRC-16 Calculation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Calculating the Length of Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Communication Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Invalid Query Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Serial Link Timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Invalid Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
720
720 720 721 722 724 724 724 724 725 726 726 728 729 744 744 745 746
747
747 747 750 754
GFK-0582D
Contents
Section 4: SNP-X Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Overview of SNP-X Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X Communication Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Broadcast Capability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Modem Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Slave PLC Status Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Slave Memory Access Bits (X-Status Bits) . . . . . . . . . . . . . . . . . . . . . . . . . . . Timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Block Check Code (BCC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X Protocol Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Establish Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Directed Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Broadcast Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X Message Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X-Request Message Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X-Response Message Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X-Buffer Message Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X-Attach Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X-Read Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . X-Write Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X State Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X Master State Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X Master Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X Slave State Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNP-X Slave Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
757
757 757 758 758 758 759 759 760 762 763 764 764 765 767 767 769 771 772 772 775 777 784 784 785 786 787
Chapter 8
Cable Connection Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Section 1: Cable Assembly Specifications . . . . . . . . . . . . . . . . . . . . . . Section 2: RS-232 Cable Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . Section 3: RS-422/RS-485 Cable Diagrams . . . . . . . . . . . . . . . . . . . . .
RS-422/RS-485 Interface and Cabling Information . . . . . . . . . . . . . . . . . . . . . . . RS-422/RS-485 Cable Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2Wire and 4Wire RTU RS422/RS485 Cable Connections . . . . . . . . . . . . . 2Wire and 4Wire RS422/RS485 Serial I/O Connections . . . . . . . . . . . .
81 82 83 85
85 86 810 814
xi
GFK-0582D
Contents
Section 4: IC693CBL316 Serial Cable . . . . . . . . . . . . . . . . . . . . . . . . . Section 5: IC690CBL714A MultidropCable . . . . . . . . . . . . . . . . . . . . Chapter 9 Serial I/O Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Overview of Serial I/O Protocol Communications . . . . . . . . . . . . . . . . . . . . . Serial Communications Sequence of Operations . . . . . . . . . . . . . . . . . . . . . . . Format of the Communication Request Function . . . . . . . . . . . . . . . . . . . . . . Command Block for the COMMREQ Function . . . . . . . . . . . . . . . . . . . . . . . Example of a Serial I/O COMMREQ Instruction . . . . . . . . . . . . . . . . . . . . . . Configuring Serial Ports Using the COMMREQ Function . . . . . . . . . . . . . . . RTU Slave/SNP Slave Operation With Programmer Attached . . . . . . . . . . . . COMMREQ Command Block for Configuring SNP Protocol . . . . . . . . . . . . COMMREQ Data Block for Configuring RTU Protocol . . . . . . . . . . . . . . . . . COMMREQ Data Block for Configuring Serial I/O Protocol . . . . . . . . . . . . . Calling Serial I/O COMMREQs from the PLC Sweep . . . . . . . . . . . . . . . . . . Serial I/O COMMREQ Status Word Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . Serial I/O COMMREQ Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . COMMREQ Overlap Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Initialize Port Function (4300) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set Up Input Buffer Function (4301) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Flush Input buffer Function (4302) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Read port status Function (4303) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Port Status Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write port control Function (4304) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cancel COMMREQ Function (4399) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Autodial Function (4400) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Autodial Command Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write bytes Function (4401) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Read bytes Function (4402) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Return Data Format for the Read Bytes Function . . . . . . . . . . . . . . . . . . . . . . Read String Function (4403) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Return Data Format for the Read String Function . . . . . . . . . . . . . . . . . . . . . .
816 817 91
92 93 94 95 96 98 99 910 911 912 913 914 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931
Appendix A Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Commonly used Acronyms and Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
xii Series 90 PLC Serial Communications Users Manual November 2000
A1
A2 A3
GFK-0582D
Contents
Appendix B ASCII Code List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix C CCM Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix D RTU Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix E Serial Line Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Information Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transmission Errors and Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Noise Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transmission Timing Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Asynchronous Transmission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Serial Communications Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Modems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Interface Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B1 C1 D1 E1
E1 E2 E2 E3 E4 E5 E5 E6
F1
F1 F2 F3
G1 H1
H1 H2 H4 H5 H6
Appendix I
I1
I1 I2 I2 I3 I4 I5
Appendix J
J1
J1 J2 J4 J7
xiii
GFK-0582D
Contents
Appendix K Using Modems with VersaPro and Control . . . . . . . . . . . . . . . . . . . . .
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Contents of this Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PLC CPU Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing a Modem in Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting Up the Communications Configuration Utility (CCU) . . . . . . . . . . . . Connecting to the PLC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using HyperTerminal to Establish Connection . . . . . . . . . . . . . . . . . . . . . . . .
K1
K1 K1 K2 K3 K6 K9 K10
L1
L1 L2 L2 L2
Appendix M Series 90 Micro PLC Serial Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix N IC655CMM590 Isolated Repeater/Converter . . . . . . . . . . . . . . . . . . .
Description of the Isolated Repeater/Converter . . . . . . . . . . . . . . . . . . . . . . . . . . System Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cable Diagrams for IC655CMM590 Converter . . . . . . . . . . . . . . . . . . . . . . . . . .
M1 N1
N1 N5 N7
O1
xiv
GFK-0582D
restart lowapp ARestart oddapp: ARestarts for autonumbers that do not restart in each chapter. figure bi level 1, reset table_big level 1, reset chap_big level 1, reset1 Lowapp Alwbox restart evenap:A1app_big level 1, resetA figure_ap level 1, reset table_ap level 1, reset figure level 1, reset Figure 1. table level 1, reset Table 1. these restarts oddbox reset: 1evenbox reset: 1must be in the header frame of chapter 1. a:ebx, l 1 resetA a:obx:l 1, resetA a:bigbx level 1 resetA a:ftr level 1 resetA c:ebx, l 1 reset1 c:obx:l 1, reset1 c:bigbx level 1 reset1 c:ftr level 1 reset1 Reminders for autonumbers that need to be restarted manually (first instance will always be 4) let_in level 1: A. B. C. letter level 1:A.B.C. num level 1: 1. 2. 3. num_in level 1: 1. 2. 3. rom_in level 1: I. II. III. roman level 1: I. II. III. steps level 1: 1. 2. 3.
Chapter
1 Introduction
1
This chapter includes a quick reference to the manual and provides a summary of the serial communications capabilities of the Series 90 products.
Appendix I, J, and K:
GFK-0582D
11
1
Series 90 Serial Port Communications Capabilities
Series 90 Serial Port Communications Capabilities
Protocol or Feature SNP (slave) SNP (master) BreakFree SNP SNPX (slave) SNPX (master) RTU (slave) RTU (master) CCM (slave) CCM (master & peer) Serial I/O Read Serial I/O Write MegaBasic programming C programming Datagrams C programmer printf support CDebugger support RS232 RS422/485 Series 9030 CPU Ports 1 and 26 Yes Yes1 Yes1 Yes No Yes2 No No No Yes4 Yes2 No Yes5 Yes1 No No Port 1 Ports 2 and 3, and Standard SNP port on single port CPUs Series 9070 CPUs Yes No Yes1 No No No No No No No No No Yes Yes Yes1 Yes1 Port 1 Ports 2 and 3, and Standard SNP port on single port CPUs Yes3 Yes3 Yes3 Series 90 PCMs Yes3 (with C file) Yes3 (with C file) No (with C file) (with C file) Series 90 CMMs Yes Yes No Yes Yes Yes No Yes Yes No No No No Yes No No All ports Port 2 of CMM311 Both ports of CMM711
Yes3 (with Megabasic file) Yes3 (with Megabasic file) Yes Yes No No Yes Yes (with C file) Yes No All ports except for Port 2 of PCM300 Port 2 of PCM300, PCM301, and PCM311 Both ports of PCM711
1 2
3 4 5 6
Not available for all CPU firmware releases and may not be supported by all releases of Logicmaster, VersaPro, or Control PLC programming software. See Chapter 3 for details on CPU capabilities. Only available on Ports 1 and 2 of CPUs 351 (firmware release 8.00 and later), 352 (firmware release 8.00 and later), and 363 (all versions), starting with firmware release 8.00. See Chapter 3 for additional information. Requires an application file, which can be downloaded free of charge from the GE Fanuc Technical Support web site (www.gefanuc.com/support). Only available on CPUs 352 and 363 starting with firmware release 10.00. See Chapter 3 for additional information. Only available on CPUs 350 and higher. Only CPUs 351, 352, and 363 have Ports 1 and 2. The Standard SNP port on all Series 9030 CPUs (accessed through the power supply connector) only supports SNP slave and SNPX slave protocols.
12
GFK-0582D
SNP/SNPX Slave
Port 1 All releases Ports 1 and 2, Rel. 3.00 and later Ports 1 and 2, Rel. 2.01 and later
SNP/SNPX Master*
not supported Port 2 Rel. 3.00 and later Port 2 Rel. 3.00 and later
*Also requires the following versions or later hardware: IC693UDR001LP1, IC693UDR002LP1, IC693UAA003JP1, IC693UDR005JP1, IC693UAL006BP1, IC693UAA007HP1, and IC693UDR010BP1.
The SNP master and slave as implemented on the CMM module do not support PLC programming or configuration functions. Logicmaster 90 may be connected to a CMM serial port configured as an SNP slave for data display and modification only. (The SNP-X protocol does not support PLC programming or configuration under any circumstances.) The SNP and SNP-X protocols can be enabled on none, one, or both serial ports of the CMM module using either the RS-232 or RS-422/RS-485 electrical standard. Essentially, any combination of protocols, ports, and electrical standards are available with one exception: The Series 90-30 CMM cannot support RS-422/RS-485 on port 1. Port selection, data rate, parity, flow control, number of stop bits, timeouts, and turnaround delay values can be configured.
CCM Protocol
CCM protocol is included in the EPROM firmware for both the Series 90-70 and Series 90-30 CMM modules. The CCM protocol was originally developed for the Series Six Communications Control Module (CCM) and is available on most GE Fanuc PLCs. It is available on the CMM and PCM modules, but not on Series 90 CPU serial ports. The CCM protocol allows for the following types of operation: D D
GFK-0582D
Master - the initiating device in a Master/Slave system. Slave - the responding device in a Master/Slave system.
13
Chapter 1 Introduction
1
D Peer - initiates and responds to another Peer device.
The CCM protocol can be enabled on none, one, or both of the serial ports of the CMM module using either the RS-232 or RS-422/RS-485 electrical standard. Essentially, any combination of protocols, ports, and electrical standards are available with one exception: The Series 90-30 CMM cannot support RS-422/RS-485 on port 1. Port selection, data rate, parity, flow control, timeouts, turnaround delay, station address/CPU ID, and retry values can be configured.
RTU Protocol
RTU protocol is available on the Series 90-30 CPU ports, 351, 352 and 363 serial ports, and the Series 90-70 and Series 90-30 CMM modules. RTU protocol as implemented on the CMM is a subset of the ModbustRemote Terminal Unit (RTU) serial communications protocol. RTU is a halfduplex protocol. It is commonly wired in either of two configurations: 2Wire or 4Wire. For details on this subject, please refer to the section 2Wire and 4Wire RTU in Chapter 7. The RTU protocol as implemented on the CMMs and CPUs provides for Slave operation only. However, a MegaBasic application file is available that enables a PCM module to support the RTU Master or Slave implementation. This file is available for free download from the GE Fanuc Technical Support site. See Appendix G, Getting Help, for information on the GE Fanuc web site. D D Master - the initiating device in a Master/Slave system. Slave - the responding device in a Master/Slave system.
The RTU protocol can be enabled on none, one, or both of the serial ports of the CMM module, on several CPU serial ports, and on PCM serial ports (using the MegaBasic application file) using either the RS-232 or RS-422/RS-485 electrical standard. Essentially, any combination of protocols, ports, and electrical standards are available with one exception: The Series 90-30 CMM cannot support RS-422/RS-485 on port 1. Port selection, station address, data rates, flow control, and parity values can be configured.
14
GFK-0582D
Chapter
This chapter describes the Communications Coprocessor modules (CMM311, CMM711) and explains how to install and configure the modules. Also included is a discussion of the system operation of the modules in the Series 90 PLC: The chapter is divided into two sections. D D Section 1: Description of CMM Hardware and Operation Section 2: Installing and Configuring the CMM
GFK-0582D
21
a44901
BD OK
PORT 1
PORT 2
DOOR
MODEL 70
CMM 711
MODULE OK PORT 1 PORT 2
ON = OK, ACTIVE BLINK = COMMUNICATING PUSH TO RESTART APPLICATION PORT 1 RS232 OR RS422 COMPATIBLE
MODULE FUNCTION SERIES 9070 COMMUNICA TIONS COPROCESSOR PORT 1 & 2 RS232 PIN SIGNAL 1 SHIELD 2 TD 3 RD 4 RTS 5 CTS 7 GROUND 8 DCD * 20 DTR * PORT 1 & 2 RS422 PIN SIGNAL 7 GROUND SD (A) 9 10 RTS (A) * CTS (A) * 11 12 TERM PIN 11 * 13 RD (A) 21 SD (B) 22 RTS (B) * 23 CTS (B) * 24 TERM PIN 25 * 25 RD (B) * CONFIGURA TION DEPENDENT
22
GFK-0582D
CCM Modules
COMM COPROC
OK US1 US2
OK US1 US2
a44902
RESTART
LED Indicators
The three LED indicators, as shown in the figures above, are located along the top front edge of the CMM board.
Module OK LED
The MODULE OK LED indicates the current status of the CMM board. It has three states: Off: When the LED is off, the CMM is not functioning. This is the result of a hardware malfunction (that is, the diagnostic checks detect a failure, the CMM fails, or the PLC is not present). Corrective action is required in order to get the CMM functioning again. On: When the LED is steady on, the CMM is functioning properly. Normally, this LED should always be on, indicating that the diagnostic tests were successfully completed and the configuration data for the module is good. Flashing: The LED flashes during power-up diagnostics.
Restart/Reset Pushbutton
If the Restart/Reset pushbutton is pressed when the MODULE OK LED is on, the CMM will be re-initialized from the Soft Switch Data settings. If the MODULE OK LED is off (hardware malfunction), the Restart/Reset pushbutton is inoperative; power must be cycled to the entire PLC for CMM operation to resume.
Serial Ports
The serial ports on the CMM are used to communicate with external devices. The Series 90-70 CMM (CMM711) has two serial ports, with a connector for each port. The Series 90-30 CMM (CMM311) has two serial ports, but only one connector. The serial ports and connectors for each PLC are discussed below.
Note
When using the RS-485 mode, the CMM can be connected to RS-422 devices as well as RS-485 devices. The connector pin assignments for both ports of the Series 90-70 CMM are shown below:
SHIELD RS-232 TD RS-232 RD RS-232 RTS RS-232 CTS NO CONNECTION SIGNAL GROUND RS-232 DCD RS-485 SD ( A ) RS-485 RTS ( A ) RS-485 CTS ( A ) TERMINATION ( CTS ) RS-485 RD ( A )
1 14 2 3 4 5 6 7 8 9 15 16 17 18 19 20 21 22 23 24 10 11 12 25 13
a42734 RESERVED RESERVED RESERVED RESERVED RESERVED RESERVED RS-232 DTR RS-485 SD ( B ) RS-485 RTS ( B ) RS-485 CTS ( B ) TERMINATION ( RD ) RS-485 RD ( B )
Figure 2-3. Serial Port Pin Assignments for the Series 90-70 CMM
Note
In the figure above, SD (Send Data) and RD (Receive Data) are the same as TXD and RXD (used in the Series SixTM PLC). (A) and (B) are the same as and +. A and B denote inputs, and A and B denote outputs. To terminate the RS-485 CTS input signal, jumper pins 11 and 12; to terminate the RD input signal, jumper pins 24 and 25. 24
Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
CCM Modules
NOTE
When using the RS-485 mode, the CMM can be connected to RS-422 devices as well as RS-485 devices. The connector pin assignments for the Series 90-30 CMM are shown below.
SHIELD ( PORT 1 ) RS-232 TD ( PORT 1 ) RS-232 RD ( PORT 1 ) RS-232 RTS ( PORT 1 ) RS-232 CTS NO CONNECTION SIGNAL GROUND ( PORT 1 ) RS-232 DCD ( PORT 2 ) RS-485 SD ( A ) ( PORT 2 ) RS-485 RTS ( A ) ( PORT 2 ) RS-485 CTS ( A ) ( PORT 2 ) TERMINATION ( CTS ) ( PORT 2) RS-485 RD ( A )
1 14 15 16 17 18 19 20 21 22 23 24 25 2 3 4 5 6 7 8 9 10 11 12 13
a44357
RS-232 TD ( PORT 2 )
RS-232 CTS ( PORT 2 ) RS-232 RD ( PORT 2 ) RS-232 DTR ( PORT 2 ) RS-232 DCD ( PORT 2 ) RS-232 RTS ( PORT 2 ) RS-232 DTR ( PORT 1 ) RS-485 SD ( B ) (PORT 2 ) RS-485 RTS ( B ) ( PORT 2 ) RS-485 CTS ( B ) ( PORT 2 ) TERMINATION ( RD ) (PORT 2) RS-485 RD ( B ) ( PORT 2 )
SHIELD ( PORT 1 ) RS-232 TD ( PORT 1 ) RS-232 RD ( PORT 1 ) RS-232 RTS ( PORT 1 ) RS-232 CTS NO CONNECTION SIGNAL GROUND ( PORT 1 ) RS-232 DCD ( PORT 2 ) RS-485 SD ( A ) ( PORT 2 ) RS-485 RTS ( A ) ( PORT 2 ) RS-485 CTS ( A ) ( PORT 2 ) TERMINATION ( CTS ) ( PORT 2) RS-485 RD ( A )
1 2 3 4 5 6 7 8 9 14 15 16 17 18 19 20 21 22 23 24 10 11 12 13 25
a44357
RS-232 TD ( PORT 2 )
RS-232 CTS ( PORT 2 ) RS-232 RD ( PORT 2 ) RS-232 DTR ( PORT 2 ) RS-232 DCD ( PORT 2 ) RS-232 RTS ( PORT 2 ) RS-232 DTR ( PORT 1 ) RS-485 SD ( B ) (PORT 2 ) RS-485 RTS ( B ) ( PORT 2 ) RS-485 CTS ( B ) ( PORT 2 ) TERMINATION ( RD ) (PORT 2) RS-485 RD ( B ) ( PORT 2 )
PORT 1
1 2 3 4 5 6 7 8 9 14 15 16 17 18 19 20 21 22 23 24 25 10 11 12 13
SHIELD
RS-232 TD RS-232 RD
RS-232 DTR
RS-485 SD ( A )
TERMINATION ( CTS )
RS-485 RD ( A)
PORT 2
1 2 3 4 5 6 7 8 9 14 15 16 17 18 19 20 21 22 23 24 25 10 11 12 13
a44358
a44225 PIN 1
PORT 1 PORT 2
IC693CBL305
PIN 1
CCM Modules
This section explains how to install the CMM in the rack (Series 90-70) or baseplate (Series 90-30) and how to configure the module using Logicmaster 90 or the windows-based programming software. Topics covered are: D D D What you will Need Installing the CMM Configuring the CMM
If this application uses CCM protocol with standard default settings for a Series 90-30 CMM (CMM 311), no other equipment is required. For other applications, you will also need the following: D D A computer with a hard disk. Programming software (either Logicmaster 90 or windows-based programming software).
GFK-0582D
27
Overview
In a single rack system, the CMM resides in the same rack as the CPU. In a Series 90-70 multiple rack system, the CMM can reside in either the CPU rack or in an expansion rack. The Series 90-30 CMM must reside in the same rack as the CPU. The following illustration shows one possible system configuration for installing a Series 90-70 CMM in a local or expansion rack:
LOCAL RACK CONFIGURATION a44915 P S C C P M U M CPU RACK EXPANSION RACK P S C B P T U M P S B C R M M M
D 28
CCM Modules
Note
The top LED (MODULE OK) of the Series 90-30 CMM will not light if the PLC is not present, or if the CMM fails its power-up diagnostics. 7. Repeat this procedure for each CMM.
Troubleshooting
After completing the above steps to install the CMM, the MODULE OK (BD OK) LED should be on continuously. If it is not, the problem may be either that the LED is burned out, or the board has not passed diagnostics. Follow this procedure to determine the cause of the problem: 1. 2. Make sure that power to the rack is on, the PLC is okay, and that the CMM is seated properly. Check the PLC fault table using the programming software. If there is a bad or missing module fault, the board may be defective; otherwise, contact the GE Fanuc Technical Support Hotline for assistance. The GE Fanuc PLC Technical Support Hotline can be reached at 1-800-GE FANUC (1-800-433-2682), or International direct dial 804-978-6036. Change the CMM config to SNP (RS-232 is needed), and run the programming software through the CMM using either the IC690CBL702 (9-pin AT) or IC690CBL705 (25-pin PS-2) cable.
3.
GFK-0582D
29
CCM Modules
D D D D D D
RTU ONLY - RTU protocol on both ports SNP ONLY - SNP and SNP-X protocols on both ports SNP/CCM - SNP and SNP-X protocols on port 1, CCM protocol on port 2 CCM/SNP - CCM protocol on port 1, SNP and SNP-X protocols on port 2 SNP/RTU - SNP and SNP-X protocols on port 1, RTU protocol on port 2 RTU/SNP - RTU protocol on port 1, SNP and SNP-X protocols on port 2
A different Soft Switch Data Screen is displayed for each configuration mode. The factory default is CCM protocol on both ports. Make sure that the proper protocol is selected. If you are using SNP multidrop, make sure that the proper SNP ID has been stored to the PLC CPU. Note: If you change the CMMs SNP ID via the programming software, it is necessary to reset the CMM in order for the new SNP ID to take effect. Resetting the CMM can be done by either pressing the CMMs Restart pushbutton, or by powercycling the PLC rack that contains the CMM.
GFK-0582D
211
2
Description of Communications Parameters
The tables below describe the communications parameters available for each serial protocol on the CMM module:
Table 2-1. CCM Communications Parameters
Field
CCM Enable CCM Mode Interface1 Data Rate Flow Control Parity Retry Count Timeout Modem Turnaround Delay CCM CPU ID
Range
Default
YES, NO SLAVE, MASTER, PEER RS232, RS485 300, 600, 1200, 2400, 4800, 9600, 19200 NONE, HARDWARE ODD, NONE NORMAL, SHORT LONG, MEDIUM, SHORT, NONE NONE, 10 ms, 100 ms, 500 ms 1-254
Range
Default
YES, NO RS232, RS485 300, 600, 1200, 2400, 4800, 9600, 19200 NONE, HARDWARE ODD, EVEN, NONE 1 - 247
Table 2-3. SNP Communications Parameters
Field
SNP Enable SNP Mode Interface1 Data Rate Flow Control Parity Stop Bits Timeout Modem Turnaround Delay
Range
Default
YES, NO SLAVE, MASTER RS485, RS232 300, 600, 1200, 2400, 4800, 9600, 19200 NONE, HARDWARE ODD, EVEN, NONE 1, 2 LONG, MEDIUM, SHORT, NONE NONE, 10 ms, 100 ms, 500 ms
212
GFK-0582D
CCM Modules
TD (from CMM)
100 ms
TD (from CMM)
Max. of 2 sec.
TD (from CMM)
Note
Timeout values used by Logicmaster 90 software and the Series 90-70 and 90-30 CPUs are also listed for comparison. 214
Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
CCM Modules
Table 2-4. SNP Timer Values for Timeout Selections
SNP Timer None Short Medium Long LM90 90-30 90-70
T1 T2 T3 T4 T5 Transmission Delay1 COMMREQ timeout2 T3 T3 T5 T5 5 ms 5 ms 5 ms 5 ms 10 ms 5 ms 2 sec 500 ms 1 sec 2 sec 3 sec 1 sec Disabled 5 sec 10 sec 10 sec 10 sec 10 sec 50 ms 50 ms 50 ms 50 ms 100 ms N/A Disabled 2 sec 5 sec Disabled 10 sec 10 sec 0 sec 0 sec 0 sec 0 sec 0 sec 0 sec 30 sec 30 sec 30 sec 30 sec N/A N/A T3 - 80 character times T3 + 65 seconds T5 + 80 character times T5 + Transmission Delay + twice next message transmission time. 5 ms 500 ms 10 sec N/A 10 sec 0 sec N/A
1 The Transmission Delay specifies the length of time required for the data to transfer from the initiating
device to the responding device. This duration is also referred to as the wire time. Examples where this value may be changed to a non-zero value include instances where satellite links are used to transfer data.
2 The COMMREQ Timeout specifies the maximum length of time that a COMMREQ can remain in process.
If the COMMREQ command cannot be completed before this time interval, the COMMREQ processing is terminated, and an error code is returned in the COMMREQ Status Word indicating that a COMMREQ timeout has occurred.
See the SNP Timers section of Chapter 7, Protocol Definition, for a complete description of the SNP timers.
GFK-0582D
215
Chapter
3
Overview
This chapter describes the serial communications ports on the Series 9030 and Series 9070 CPU models. This chapter is divided into the following main topics: H H H H
Series 9030 CPU Serial Ports Series 9070 Serial Ports General Series 90 CPU Serial Communication Information Configuring Serial Ports 1 and 2 with a COMMREQ
GFK-0582D
31
CPU 351
P1 P2
SNP P1 P2
CPU 363
ON OFF
ON/RUN
PORT 1 RS-232
OFF/ STOP
PIN 1
PORT 1 RS-232
PIN 1
PORT 2 RS-485
PIN 1
PORT 2 RS-485
FRAME
CPU363
CPU351/352
Figure 3-1. CPU Features (CPUs 351 and 352 look identical except for labeling)
32 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
These ports can be used for serial interfaces to Operator Interface terminals (OIs), Human to Machine Interface terminals (HMIs), pagers, programmers, modems, and other serial communications devices. Also, CPU352 and CPU363 support the Serial I/O Read function that enables them to read input from devices such as bar code readers. This function is not supported on the CPU351. H Port 1, the top port on these CPUs, is a nonisolated RS-232 compatible port. Port 1 is accessed through a 6-pin RJ-11 connector on the front of the module. This connector has female contacts and is similar to modular jacks commonly used for telephones and modems. GE Fanucs serial cable, part number IC693CBL316, is a convenient way to connect to this port. Chapter 8 of this manual contains a data sheet on this cable. Port 2, the bottom port, is an isolated, RS-485 compatible port. It is accessed through a female, 15-pin, Dshell connector on the front of the module. Standard SNP Port, accessed through the female, 15-pin, Dshell connector on the PLC power supply, is a nonisolated RS485 compatible port.
H H
LED Indicators
The CPUs 351, 352, and 363 have three LED indicators which enable you to determine the status of the serial port activity on the CPU 351/352 without having a terminal connected. H H H The SNP or PS LED (top LED) is ON when data is being transferred through the Standard SNP serial port, whose connector (RS422/485) is located on the PLC power supply. The P1 LED (middle LED), will be ON when data is being transferred through Port 1, the RS-232 port. The P2 LED (bottom LED), will be ON when data is being transferred through Port 2, the RS-422/485 port.
GFK-0582D
33
3
Table 3-1. Features of CPU351 Serial Ports 1 and 2
Feature SNP Master/Slave SNPX Master/ Slave RTU Slave BreakFree SNP Serial I/O Write Serial I/O Read Firmware Release 6.52 Yes* Yes* No No No No Firmware Release 8.00 Yes Yes Yes* No Yes* No Firmware Release 9.00 Yes Yes Yes Yes* Yes* No Firmware Release 10.00 Not Available** Not Available** Not Available** Not Available** Not Available** Not Available**
* Indicates CPU firmware release in which the feature was first available. When CPU351 was initially released, it was equipped with firmware release 6.00. ** The latest firmware available for CPU351 is release 9.11. It is not planned to upgrade the CPU351 beyond that release.
* Indicates CPU firmware release in which the feature was first available. When CPU352 was initially released, it was equipped with firmware release 7.00.
* Indicates CPU firmware release in which the feature was first available. ** When CPU363 was initially released, it was equipped with firmware release 9.00.
34
GFK-0582D
CPU Serial Ports Standard SNP Port (Accessed Through Power Supply Connector)
All Series 9030 CPUs have a standard SNP serial port that is accessed through a connector on the PLC power supply. This serial port only supports the SNP Slave and SNPX Slave protocols. BreakFree SNP became the default protocol on this port, starting with firmware release 8.20 for CPUs 311 341 and 9.00 for CPUs 350 364. For CPUs equipped with firmware earlier than those two releases, the default protocol is standard (BreakEnabled) SNP. BreakFree SNP protocol is discussed in a later section of this chapter. The most common use for this port is communicating with a personal computer running the PLC programming software; however, it is capable of other uses, such as communicating with an operator interface device. In either case, the personal computer or operator interface device would act as the master and the PLC as the slave because this port only supports the slave versions of the SNP and SNPX protocols.
GFK-0582D
35
LED P1 LED P2
LED P3
SERIAL PORT 2
PIN 1
SERIAL PORT 3
PIN 1
CPX 935
TOP
OFF
B A T T E R Y
OK
P1 P3
RUN EN
P2
MEM PROTECT ON = OK, ENABLED, PROTECTED RUN WITH OUTPUTS ENABLED RUN WITH OUTPUTS DISABLED STOP BATTERY CONNECTORS
MODULE FUNCTION
FACTORY TEST
Figure 3-2. Example of a Series 9070 CPU with Three Serial Ports
36 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
Port 1, the top port on these CPUs, is RS-232 compatible. It has a 6-pin, female RJ-11 connector. This connector looks similar to the smaller modular jacks commonly used for telephones and modems. GE Fanucs serial cable, part number IC693CBL316, is a convenient way to connect to this port. Chapter 8 of this manual contains a data sheet for cable IC693CBL316. Port 2, the middle port, is RS-485 compatible, and is isolated through an optocoupler. It is has a 15-pin, female Dshell connector. Port 3 (Standard SNP Port), the bottom port, is also RS485 compatible, but is not isolated. It has a 15pin, female Dshell connector.
H H
GFK-0582D
37
3
Table 3-5. Serial Port Features for CGR CPUs
Serial Port Features Supported on CPUs CGR772 and CGR935 Feature SNP (slave) protocol SNP (master) protocol BreakFree SNP protocol SNPX protocol (slave or master) RTU protocol CCM protocol Serial I/O Program Load/Store Datagrams MSG Mode for C programmer printf support CDebugger support RS232 RS422/485 Configurable with COMMREQ Electrical Isolation Ports 1 and 2 Yes, starting with Firmware Release 7.85 No No No No No No No No No No Port 1 only Port 2 only Yes Port 2 only Port 3 Yes No No No No No No Yes Yes Yes Yes No Yes No No
38
GFK-0582D
Signal Name
CTS TXD 0V 0V RXD RTS
Description
Clear To Send Transmit Data Signal Ground Signal Ground Receive Data Request to Send
Signal Name
Shield NC NC NC +5VDC RTS(A) SG CTS(B) RT RD(A) RD(B) SD(A) SD(B) RTS(B) CTS(A)
Description
Cable Shield No Connection No Connection No Connection Logic Power ** Differential Request to Send Signal Ground Differential Clear To Send Resistor Termination Differential Receive Data Differential Receive Data Differential Send Data Differential Send Data Differential Request To Send Differential Clear To Send
* See the previous figures for location of pin 1. ** Note that Pin 5 provides Isolated +5 VDC power (100 mA maximum) for powering external options.
GFK-0582D
39
3
Series 90 PLC Standard, (NonIsolated) SNP Serial Port
The standard Series 90 PLC serial port has a 15pin Dtype female connector and is RS-422/485 compatible. An RS-232 to RS-422 converter is required to interface to systems that provide RS-232 compatible interfaces. It is found an all Series 90 PLCs: H Series 90-70 PLC Found on all Series 9070 CPUs. This is the only port on most CPUs. On CPUs with three ports, this port is called Serial Port 3. H Series 90-30 PLC Found on all Series 9030 CPUs. Accessed through connector on PLC power supply on all CPUs (see next figure).
a43832
Pin 1
RS-485 COMPATIBLE SERIAL PORT
Figure 3-3. Series 9030 CPU Serial Port Connector on Power Supply
H This serial port is RS-485 compatible, and uses the GE Fanuc SNP (Series Ninety Protocol) protocol (slave only). The IC690ACC901 Miniconverter is usually used to connect this port to a personal computers RS232 serial port. Break-Free SNP became the default protocol on all serial ports on the Series 90-30 CPUs, starting with Firmware Release 9.00 for CPUs 350 - 364, and Firmware Release 8.20 for CPUs 311 - 341. BreakFree SNP is discussed in a later section of this chapter. The serial port connector is only functional in a power supply that is installed in a baseplate that also contains the CPU. It is not functional on a power supply that is installed in an expansion or remote baseplate. Any device connected to the serial port that uses +5 VDC power from the Series 90-30 power supply must be included in the calculation for maximum power consumption (see the heading Power Supply Loading Calculations in Chapter 12 of GFK0356 for details).
Caution
Care must be taken that common mode voltage specifications are met for connections to this nonisolated serial port. Common mode conditions that exceed those specified will result in errors in transmission and/or damage to Series 90 PLC components. Common mode specifications are discussed in Appendix C. When the common mode voltage specification is exceeded, a port isolator such as the GE Fanuc IC690ACC903 must be used. See Appendix G for details on this port isolator.
310 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
The figure below shows the serial port orientation and connector layout for the Series 90 CPUs, and the following table shows the pin numbering and signal assignment for these connectors.
SERIES 9070 PLC SERIES 9030 PLC PIN 1
a44521
15
PIN 1
15
* Signals available at the Connector but are not included in the RS-422 specification. SD (Send Data) and RD (Receive Data) are the same as TXD and RXD (used in the Series Six PLC). (A) and (B) are the same as - and + . A and B denote outputs, and A and B denote inputs. ** Termination resistance for the Receive Data (RD) signal needs to be connected only on units at the end of the lines. This termination is made on the Series 90 PLC products by connecting a jumper between pins 9 and 10 inside the 15-pin D-shell with the following exception. For Series 90-70 PLCs with Catalog Numbers IC697CPU731J, and IC697CPU771G and earlier the termination for RD at the PLC is implemented by a jumper between pins 9 and 11.
GFK-0582D
311
3
Break-Free SNP Protocol
Break-Free SNP has become the default protocol on some of the Series 90 CPUs. The table below identifies which products support this feature. The purpose of this feature is to improve serial communications when modems are used. BreakFree SNP simplifies modem communications with Series 90 PLCs by eliminating the requirement for a serial break at the start of each SNP and SNPX session. Consequently, modem pairs that alter the timing or characteristics of breaks from SNP/SNPX masters may be used successfully. BreakFree operation is completely transparent to the user. When normal breaks are received, SNP/SNPX communications operate identical to standard SNP communications. When Attach and XAttach messages are received, these are also recognized without a preceding break. Modified breaks (for example, breaks transformed to a single ASCII NUL character, with or without a framing error) are ignored. The BreakFree feature requires data rates of 1200 baud and higher. Breaks are required at 300 and 600 baud rates. The PLCs autobaud feature also requires breaks. Autobaud permits Series 9030 CPUs with no stored configuration to communicate at either 9600 or 19,200 baud, odd parity, and one stop bit. Note that autobaud is incompatible with modem communications because a stored configuration is required to set the serial port for NO PARITY. BreakFree SNP is compatible with existing SNP master units such as computers running PLC programming software, or PCM modules. In a few applications, primarily where a combination of multi-drop SNP communications and very short PLC sweep times are used, users may desire, for performance reasons, to disable Break-Free SNP. Break-Free SNP can be disabled and re-enabled via Communications Request (COMMREQ) instructions 7004 and 7005, which are detailed in Chapter 6 of this manual. This feature can be added to older versions of the applicable CPUs through a firmware upgrade contact your GE Fanuc distributor for information.
312
GFK-0582D
The Serial I/O protocol allows users to write a custom protocol for communicating with various serial devices such as bar code readers or pagers (not all CPUs support both Serial I/O modes see table below). Serial I/O has two modes: Read and Write. Support for Serial I/O is detailed in the table below. Chapter 9 of this manual explains how to use this protocol. Serial I/O can be added to older versions of CPU351, 352, and 363 through a firmware upgrade contact your GE Fanuc distributor for information.
CPU351, CPU352, CPU363, Not supported Standard SNP port (via power supply connector) Series 9030 CPUs: 311341 Series 9070 CPUs: All Not supported
Not supported
* Firmware 10.00, required for Serial I/O Read, will not be made available for CPU351. ** The Serial I/O Read feature requires the use of VersaPro 1.1 (or later version) PLC programming software. It is currently not supported by other programming software.
3
swers to Frequently Asked Questions (FAQs), product revision histories, online versions of recently revised publications, an online version of InfoLink, and downloadable files and upgrades.
Error Description
Bad Processor Flags Bad Processor Register Bad Stack Area DMA Channel 0 not working DMA Channel 1 not working DMA Channel 2 not working DMA Channel 3 not working Address Lines not working H8 Timers not working Bad Interrupt Vector Table Bad Diagnostic RAM Area Bad H8 Cache RAM Unexpected Interrupt Bad System RAM Bad CRC Checksum Bad Dualport RAM Serial Port 1 Loopback failed Watchdog Timer Expired Unspecified Diagnostic Error
314
GFK-0582D
Caution
Both serial ports will be returned to their configuration values (set by default or with configuration software) when power is cycled to the PLC. If power is cycled and you have previously initiated a COMMREQ to change any serial port settings, you will need to again initiate the COMMREQ upon powerup if you wish to reinstate the settings commanded by the COMMREQ.
IN: Address of Data Block First Word SYSID: Rack and Slot Number of CPU (Always 0001 hex) TASK: 19 (13hex) = Serial Port 1 20 (14hex) = Serial Port 2 FT: Fault output. Goes High for COMMREQ Fault. OK: (Only available on the Series 9070.) Goes high if the COMMREQ passes power flow.
GFK-0582D
315
3
COMMREQ Data Block
Table 3-12. Serial Port Setup COMMREQ Data Block
Word
Start address +0 Start Address +1 Start Address +2 Start Address +3 Start Address +4 Start Address +5 Start Address +6 Start Address +7
Parameter*
Command = FFF0 (hex) Protocol Port Mode Data Rate Parity Flow Control Turnaround Delay Timeout
Word
Start address +8 Start Address +9 Start Address +10 Start Address +11 Start Address +12 Start Address +13 Start Address +14 Start Address +15
Parameter*
Bits per Character Stop Bits Interface Duplex Mode Device Identifier bytes 1 and 2 Device Identifier bytes 3 and 4 Device Identifier bytes 5 and 6 Device Identifier bytes 7 and 8
*The values for these parameters can be selected from the choices in the following table. Note: The SNP ID can also be changed by sending an SNP COMMREQ with the Change SNP ID command (7002).
316
GFK-0582D
Values
1 = SNP 4 = Reserved 2 = Reserved 5 = Serial I/O 2 = PEER 2 = 1200 5 = 9600 2 = EVEN
Default
SNP SLAVE 19200
ODD NONE
0 = HARDWARE 1 = NONE 2 = SOFTWARE 0 = NONE 3 = 500ms 0 = LONG 3 = NONE 1 = 10 ms 1 = MEDIUM 2 = 100ms 2 = SHORT
Turnaround Delay Timeout Bits per Character Stop Bits Interface Duplex Mode Device Identifier (8 bytes in length)
0 = RS232 (default for Port 1) 1 = RS485 (default for Port 2) 0 = 2-wire 1 = 4-wire
This is an identifier that distinguishes this device from others on the same network (for example: SNP ID, STA ADDR). Note that for devices that use an SNP ID of 1, enter 49 decimal (31 hexadecimal).
GFK-0582D
317
Chapter
This chapter describes how to initiate communications in ladder programs created with Logicmaster software. The chapter is divided into 3 sections: D D D Section 1: The Communications Request Section 2: The COMMREQ Ladder Instruction Section 3: The COMMREQ Command Block
Section 1 describes the structure and operation of the Communications Request. Section 2 describes the format and content of the COMMREQ Ladder Instruction. Section 3 describes the format and content of the COMMREQ Command Block.
Note
This chapter pertains only to the CCM, SNP, and SNP-X Protocols, which protocols can be used to initiate communications. The RTU Protocol as implemented on the CMM is slave only and cannot initiate communications. The Serial I/O Protocol COMMREQs are discussed in detail in Chapter 9.
GFK-0582D
41
The Communications Request can be used for a wide variety of PLC communications tasks. This publication primarily describes its use for serial communications. The Communications Request is initiated by a COMMREQ Ladder Instruction, which has an associated Command Block to define the characteristics of the request. An associated Status Word reports the progress and results of each request. This section describes the structure and operation of the Communications Request.
COMMREQ INSTRUCTION
a44916
COMMAND BLOCK
STATUS WORD
ERROR CODES
42
GFK-0582D
The Command Block: The Command Block is a block of PLC memory that contains additional information about the communications request. This information includes timing parameters, a pointer to the Status Word, and a Data Block. The Data Block describes the direction of the data transfer and location and type of data being transferred. The Status Word: The Status Word reports on the results of the communications request. For more information on the CCM Status Word, refer to Chapter 5, CCM Service. For more information on the SNP Status Word, refer to Chapter 6, SNP Service.
PLC CPU
BACKPLANE LADDER PROGRAM COMMREQ COMMAND BLOCK
CMM
DATA
STATUS WORD
At the conclusion of every request, the status of the request is reported to a particular memory location indicated by the Status Word Pointer in the Command Block.
GFK-0582D
43
4
Timing for Processing CMM Communications Requests
If the CMM receives Communications Requests from the PLC faster than they can be processed by the CMM, the CMM may eventually log a QUEUE FULL application fault in the PLC fault table: MOD: Other S/W error COMMREQ MB FULL START This fault can also occur if the CMM has stopped functioning Additionally, COMMREQs can be issued so quickly that the PLC CPU cannot send them fast enough. This results in the application fault Com Request not processed due to PLC memory limitation. This will occur in a Series 9030 system if the COMMREQ is issued every scan. Using a contact from a transition coil to enable the COMMREQ will help avoid this problem, and a timer instruction can be used to produce a delay between COMMREQ executions. The first Communications Request sent to a CMM after a power cycle or ACFAIL must be delayed until the CMM has finished power-up initialization. A general rule of thumb is to wait five seconds after the first scan before trying to initiate a Communications Request.
44
GFK-0582D
The Communications Request begins when the COMMREQ Ladder Instruction is activated. The COMMREQ Ladder Instruction has four inputs and one (Series 9030) or two (Series 9070) outputs:
(Enable Logic)
COMM REQ
IN FT SYSID TASK
Each of the inputs and outputs are discussed in detail below. It is important to understand that the Command Block Pointer input points to another location in memory where you must enter additional information about the Communications Request. Enable Logic: This is a discrete contact input used to enable the COMMREQ. As a general rule we recommend using a contact from a transition (oneshot) coil to enable a COMMREQ. This is to avoid sending the COMMREQ every scan (sending the COMMREQ every scan could cause a fault). IN: The location of the Command Block. It can be any valid address within a word-oriented area of memory: %P, %L, %R, %AI, or %AQ ( only Series 9070 supports %P and %L) SYSID: A hexadecimal value that gives the rack and slot location of the module associated with this COMMREQ Instruction. For the Series 9070, if the SYSID is incorrectly programmed for a rack and slot that does not contain a CMM or applicable CPU, the function OK output is not activated. The Series 9030 COMMREQ instruction does not have an OK output. SYSID Examples: Rack Slot
0
3 2 7
4
4 9 2
For a Series 90 CPU, the SYSID is always 0001h for rack 0, slot 1.
GFK-0582D
45
4
TASK: For a serial communications COMMREQ, the TASK parameter specifies the serial port on the CMM module or CPU to be used by this COMMREQ. The following table lists the valid task numbers for the CMM modules:
The next table lists the valid task numbers for the CPU serial ports: Task Number
19 20
Task Number
1 2
Description
If the task number programmed for the CMM or the CPU serial ports is not valid, an application fault will be logged in the fault table: COMMREQ BAD TASK ID. This can occur if the task on the COMMREQ Instruction is misprogrammed or if a CMM has been configured without a communications protocol enabled on the targeted serial port. OK and FT Outputs: The functions OK (Series 9070 only) and FT outputs can provide power flow to optional logic which can verify successful completion of the Communications Request. The OK and FT outputs can have these states:
ENable Error? OK output true false false (Series 9070 Only) FT output false true false active active not active no yes no execution
Power Flow: The COMMREQ Instruction passes power flow without delay to the OK output (only the Series 9070 has an OK output) in NOWAIT mode. In WAIT mode, the function passes power flow to the OK output unless the timeout period is exceeded, or if a 0 timeout period has been specified. Then, the OK output is set to false and the FT output is set to true. WAIT/NOWAIT modes are discussed in detail in Section 3: The COMMREQ Command Block. The FT output can also be set true and OK set to false if: D D D The specified target address is not present. The specified task is not valid for the device. Data length is 0.
In addition to the FT output, which is a discrete bit, the COMMREQ instruction also has a Status Word that reports fault information codes if a problem occurs.
46
GFK-0582D
The Command Block contains the details of a Communications Request. The address of the Command Block is specified by the IN input of the COMMREQ Ladder Instruction. This address can be in any word-oriented area of memory (%P, %L, %R, %AI, or %AQ). The Command Block structure can be placed in the designated memory area using an appropriate programming instruction (the BLOCK MOVE instruction is recommended). The Command Block has the following structure: Data Block Length
When entering information for the Command Block, refer to these definitions:
Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 WAIT/NOWAIT Flag Status Pointer Offset Idle Timeout Value Data Block Status Pointer Memory Type Maximum Communication Time Words 7 up to 134
Data Block Length (Word 1): This is the length of the Data Block portion of the Command Block (1 to 128 words). The Data Block portion starts at Word 7 of the Command Block. The length is measured from the beginning of the Data Block at Word 7, not from the beginning of the Command Block. WAIT/NOWAIT Flag (Word 2): This flag determines whether the Series 90 PLC will wait until the CMM, or CPU 351 or CPU 352 serial ports receive the intended data before continuing. Valid values are: 0 = NOWAIT 1 = WAIT for reply The request can either send a message and wait for a reply, or send a message and continue without waiting for a reply. If the Command Block specifies that the program will not wait for a reply, the Command Block contents are sent to the CMM and ladder program execution resumes immediately. This is referred to as NOWAIT mode. If the Command Block specifies that the program will wait for a reply, the Command Block contents are sent to the targeted device and the CPU waits for a reply. The maximum length of time the PLC will wait for the device to respond is specified in the Command Block. If the device does not respond in that time, ladder program execution resumes. This is referred to as WAIT mode.
GFK-0582D
47
Caution
When using the CCM Protocol, it is recommended that this flag be set to NOWAIT. Otherwise, the time spent by the CCM Protocol could negatively impact the CPU sweep. When using the SNP Protocol, this flag must be set to NOWAIT. Any SNP COMMREQ with the WAIT flag set will be immediately returned with an error. Status Word Pointer Memory Type (Word 3): The Status Word is written into PLC CPU memory at the location specified by Command Block Word 3 and Word 4. The format of this location includes memory type (Word 3) and offset (Word 4).
Abbreviation Memory Type Value to Enter
70 72 8 10 12
Decimal
Hexadecimal
46h 48h 08h 0Ah 0Ch
%I %Q %R %AI %AQ
Discrete input table Discrete output table Register memory Analog input table Analog output table
Status Word Pointer Offset (Word 4): This word contains the offset within the memory type selected. The status word pointer offset is a zero-based number. For example, if you want %R1 as the location of the Status Word, you must specify a zero for the offset. The offset for %R100 would be 99. For information on the contents of the CCM Status Word, see Chapter 5, CCM Service. For information on the contents of the SNP Status Word, see Chapter 6, SNP Service. Idle Timeout Value (Word 5): The idle timeout value is the maximum time the PLC waits for the CMM to acknowledge receipt of the request. For NOWAIT, this value is not used. (Any timeout value is ignored; it can be zero.) If WAIT is selected, this word specifies the idle timeout period, in 100-microsecond increments. Maximum Communication Time (Word 6): This word contains the maximum amount of time the program should hold the window open when the CMM is busy. For NOWAIT, this value is not used. (Any timeout value is ignored; it can be zero.) If WAIT is selected, this word specifies the maximum time in 100 microsecond increments. Data Block (Words 7 - 134): The Data Block contains information about the request in a format that depends on the communication protocol being used. For Data Block information on the CCM protocol, see Chapter 5, CCM Service. The CCM Data Block is a maximum of 6 words long. For Data Block information on the SNP protocol, see Chapter 6, SNP Service. The SNP Data Block length depends upon the particular SNP command.
48
GFK-0582D
Chapter
5 CCM Service
section level 1 1 figure bi level 1 table_big level 1
This chapter describes the CCM serial communications service. Before proceeding with this chapter, it is important to be familiar with the information presented in Chapter 4, Initiating Communications - The COMMREQ. This chapter contains the following sections: D D D Section 1: The CCM COMMREQ Data Block Section 2: The CCM COMMREQ Status Word Section 3: CCM COMMREQ Programming Examples
Comparisons among the Series 90, Series Six, Series Five, and Series One PLC CCM implementations are provided in Appendix C to assist those experienced in the operation of CCM on GE Fanuc programmable controllers. The CCM serial communications service is not supported on any Series 90 CPU serial port. You must use CMM or PCM modules for CCM support.
GFK-0582D
51
Description
CCM Command Word Target ID Target Memory Type Target Memory Address Data Length Source Memory Address
Each of the elements of the CCM Data Block are explained below: CCM Command Number (Word 7): This word identifies which CCM Command is to be executed. There are two categories of CCM Commands, local commands and remote commands. The local commands take place between the initiating CPU and its associated CMM only. They are not sent over the serial line. The remote commands, Read/Write commands, are sent over the serial line. A complete list of CCM Commands is provided later in this section under the heading, Data Block Summary for CCM Commands. Target ID (Word 8): To execute a transfer of data between CCM devices, one CCM device must request the transfer and the other must comply with the request. The device requesting or initiating the transfer is the source; the device complying with, but not initiating, the request is the target . Data can flow from source to target, as well as from target to source. The Target ID is the identification number of the target device; for Series 90 CCM, it is the CPU ID number. Each CMM port can be configured with the same or a different CPU ID number. This number is assigned using GE Fanuc configuration software. If not familiar with how to do set this number, consult your softwares users manual or online help system for details. On the Series 9030, if you are using a CPU331 or higher, a default CPU ID is assigned by the
52 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
CCM Service
PLCs CPU. This default CPU ID is a value of 1 on both CMM ports. CPU ID of value 1 is also the initial Logicmaster 90 default configuration value. The value of the target ID number can be from 1 to 255 in peer-to-peer mode or from 1 to 90 in master-slave mode. Target ID 0 is reserved. Any peer CCM device, regardless of its ID, will respond to target ID 255. Target Memory Type (Word 9): This is the type of memory being accessed in the CCM target device. There are nine accessible Series 90 target memory types (1, 2, 3, 6, 9, 13, 14, 17, and 18). The memory types are discussed later in this section under the heading, CCM Memory Types. Other CCM devices support different types ranges, see Appendix D. Target Memory Address (Word 10): The Target Memory Address specifies the address within the CCM target device where the data transfer is to begin. The address range for each Series 90 memory type and addressing examples are provided later in this section under the heading, CCM Memory Addressing and Data Lengths.
Note
For both target memory type and target memory address, the error checking is done by the responding device, and not by the initiating CMM. Target memory types and target memory addresses, which may be invalid for the initiating CPU, may be valid for the responding CCM device.
Data Length (Word 11): This is the length of the data transfer. The units are determined by the source memory type, which is specified by the command number. The unit length and accessible increment for each memory type is described with examples under the heading, CCM Memory Addressing and Data Lengths, later in this section. Source Memory Address (Word 12): The source memory address specifies the address within the Series 90 CPU where the data transfer is to begin. The address range for each Series 90 memory type and addressing examples are provided later in this section under the heading, CCM Memory Addressing and Data Lengths.
GFK-0582D
53
5
The following table lists the command words and the required parameters for each. For more detailed information and examples of each command, refer to Section 3 of this chapter.
Target ID Word 8
X3a
Set Q Response1,2 (Slave mode only) Clear CCM Diagnostic1 Status Words Read CCM Diagnostic1
Status Words to Source Registers
Software Configuration1 15 words Read from Target to Source Register Table Read from Target to Source Input Table Read from Target to Source Output Table Read QResponse to Source Register Table Single Bit Write 4 words Write to Target from Source Register Table Write to Target from Source Input Table Write to Target from Source Output Table
1 2
X X X X X X X
X X X X X X
X X X X4 X X X
Internal Command (no communications across the serial port). The Q Response can be set via command 6001, and the CCM slave will respond to a Q Sequence Enquiry received from an external device on the serial port. For a description of the Q Sequence, refer to Section 3 of this chapter. 3a Data bytes 1 and 2. 3b Data bytes 3 and 4. 4 Source Register Memory (%R) address.
54
GFK-0582D
CCM Service
Operation
Read/Write Read/Write Read/Write Read Read Bit Set Bit Set Bit Clear Bit Clear
GFK-0582D
55
5
The CCM Scratch Pad (Memory Type 6)
The entire scratch pad is updated every time an external READ request is received by CCM. All scratch pad locations are read only. The scratch pad is a byte-oriented memory type.
Bit pattern same as SP(00) Major2a (in hexadecimal) Minor2b (in hexadecimal) 7 ASCII characters + termination character = (00h) Major (in BCD) Minor (in BCD) Major (in BCD) Minor (in BCD) (00h) (90-70: 0Ch; 90-30/35: 0Dh) (00h) Master/Slave: 1-90 (Decimal) Peer-to-Peer: 1-254 (00h) See Note (4) %R size %AI size %AQ size %I size %Q size %M size See Note (5) (00h)
56
GFK-0582D
CCM Service
2a PLC CPU Major Type Codes: S9070_PLC_CPU 12 (0Ch) Series 90-70 PLC CPU S9030_PLC_CPU 16 (10h) Series 90-30 PLC CPU 2b Minor CPU Type Codes:
Minor Type Codes for Series 9030 CPUs 35 (23h) for CPU331 38 (26h) for CPU340 36 (24h) for CPU341 44 (2Ch) for CPU350 37 (25h) for CPU351 39 (27h) for CPU352 40 (28h) for CPU360 41 (29h) for CPU363 42 (2Ah) for CPU364
Minor Type Codes for Series 9070 CPUs 84 (54h) for CFR782 29 (1Dh) for CFR928 74 (4Ah) for CGR772 36 (24h) for CGR935 31 (1Fh) for CPU731 32 (20h) for CPU732 71 (47h) for CPU771 72 (48h) for CPU772 80 (50h) for CPU780 81 (51h) for CPU781 82 (52h) for CPU782 88 (58h) for CPU788 89 (59h) for CPU789 90 (5Ah) for CPU790 92 (5Ch) for CPU914 15 (0Fh) for CPU915 24 (18h) for CPU924 25 (19h) for CPU925 73 (49h) for CPX772 83 (53h) for CPX782 28 (1Ch) for CPX928 35 (23h) for CPX935
3 Located in the same position as in the Series Six scratch pad. Series One, Three, and Five PLC users who need to determine the node type, should note this location and make drive modifications where necessary. 4 Scratch Pad Bytes 18h33h Bytes 18-1B 1C-1F 20-23 24-27 28-2B 2C-2F 30-33 Note: %R %AI %AQ %I %Q %M Length of Memory Register Memory Analog Input Table Analog Output Table Input Table Output Table Internal Discrete Memory User Program Code Size Returned In Words Words Words Points (Bits) Points (Bits) Points (Bits) Bytes
Four bytes hold the hexadecimal length of each memory type with the most significant word reserved for future expansion. For example, the 731 default register memory size of 1024 words (0400h) would be returned in the following format:
Least Significant 18 00 19 04 1A 00
Most Significant 1B 00
The amount of program memory occupied by the logic program. Also appears on the Logicmaster 90 PLC Memory Usage screen in the User Program field.
GFK-0582D
57
5
Diagnostic Status Words
In addition to the CCM Status Word which is automatically transferred from the CMM to the CPU, there are 20 Diagnostic Status Words which are maintained and updated within the CMM. The Diagnostic Status Words are not automatically transferred to the CPU; the internal COMMREQ command 6003 (Read Diagnostic Status Words to Source Registers) is used to transfer these status words to the CPU. An external device can access these status words using a READ command with target memory type 9. The table below explains the purpose of each Diagnostic Status Word. When two CCM ports are running concurrently, each has its own copy of Diagnostic Status Words. Neither can report on the status of the other. The Series Six Diagnostic Status Words contained data referring to both ports. The Series 90 maintains two separate sets of Diagnostic Status Words as outlined in the following table. The software version number remains in the same location as it was in the Series Six PLC.
Number of Successful Conversations2 Number of Aborted Conversations2 Number of Header Retries Number of Data Block Retries Number of Q-Sequence Successes Number of Peer-to-Peer Collisions Reserved (00h) PCM/CMM Software Version Number 3 COMMREQ Status Word4 Reserved (00h) COMMREQ Data Block Contents
Refer to Section 2 of this chapter for a list of the possible error codes and their definitions. Internal commands will not modify this count. The term conversation refers to serial communications across the serial port. Same as the PCM/CMM Firmware Revision Number in the scratch pad (0E-0F). This value will always remain in word 12 of the diagnostic status words, even when the diagnostic status words are cleared by issuing internal command 6002 or by an external device request. Refer to Section 2 of this chapter for a description of the returned Status Word for a CCM COMMREQ.
58
GFK-0582D
CCM Service
Memory Type
1 2 3 6 9 13 14 17 18 Register Input Table Output Table CCM Scratch Pad Memory3 CCM Diagnostic Status Words3 Bit Set Input Bit Set Output Bit Clear Input Bit Clear Output
Description
Specified the register with which the data transfer is to begin. Specifies the input or output point with which the data transfer is to begin. Source memory address must be on a byte boundary (that is, 1, 9, 17 ...).2 Specifies the scratch pad byte with which the data transfer is to begin. Specifies the diagnostic status word with which the data transfer is to begin. Specifies the input or output point to be set. Specifies the input or output point to be cleared.
Address Ranges1
1-Maximum Units 1-Maximum Units
1 2
The maximum addressable ranges for each memory type depends on the model of CPU and memory configuration. For I/O references, the Series 90 and Series Six CCM implementations use point-oriented addressing, rather than the byte-oriented addressing of the Series One, Three and Five PLCs. The starting address is interpreted by the Series 90 PLC as the bit number at which the transfer is to begin. Series 90 source memory addresses must be on a byte boundary. (See the examples that follow.) Software packages which use the byte-oriented addressing method to interface with a Series One, Three, or Five PLC may need to be modified for the Series 90 PLC. Scratch pad and diagnostic status words are resident in PCM/CMM memory.
GFK-0582D
59
5
Examples:
Example 1: To read target Series 90 inputs 9 through 16 into source Series 90 inputs 17 through 24, the source address is 17, the target address is 9, and the data length is 8. Example 2: To read target Series One inputs 9 through 16 into source Series 90 inputs 17 through 24, the source address is 17, the target address is 2 (Series One I/O addressing is byteoriented), and the data length is 8. Example 3: To read target Series 90 input 27 into source Series 90 input 3, you must specify a source address of 1, a target address of 25, and a data length of 8. Inputs 1 through 8 of the source input table will be overwritten with the values of inputs 25 through 32 of the target input table. Example 4: To read target Series One input 27 into source Series 90 input 3, you must specify a source address of 1, a target address of 4, and a data length of 8. Inputs 1 through 8 of the source input table will be overwritten with the values of inputs 25 through 32 of the target input table.
Unit Length
1 Register=16 bits 1 Point = 1 bit 1 Byte = 8 bits 1 Word = 16 bits 1 Point = 1 bit
Length Accessible
Register(s) Multiple(s) of 8 Points Byte(s) Word(s) Point
Examples:
Example 1: To read 12 bytes of the target Series 90 scratch pad into Series 90 (or Series Six) registers, the data length is 6 since the unit length for the source memory type (registers) is a register. To read 12 diagnostic status words into the registers, the data length would be 12 because both registers and diagnostic status words have equivalent unit lengths (register = word = 2 bytes). Example 2: To read 8 target Series 90 inputs into Series 90 (or Series Six) inputs, the data length is 8 points since the unit length is the same for each. CCM memory types 2 and 3 (inputs and outputs) can only be accessed in multiples of 8. Example 3: To read 8 target Series 90 registers into Series 90 (or Series Six) inputs, the data length is 8 registers times 16 points per register = 128 points.
510
GFK-0582D
CCM Service
The CCM COMMREQ Status Word reports on the progress and results of a CCM request. The memory address to which the Status Word is written by the CMM is specified in Words 3 and 4 of the Command Block. The contents of the CCM Status Word are defined as:
Hex Format 00 00
(see Table 15) Secondary Error Codes (high byte) Completion and Primary Error Codes (low byte)
There are several points to remember when interpreting the contents of the CCM COMMREQ Status Word: 1. CCM will never send a zero for the CCM Status Word to the PLC CPU. If the user program needs to know if the command is complete, it can zero the CCM Status Word before issuing the COMMREQ and then check it for being non-zero. A status code of 1 in the low byte indicates that the request was completed without errors. Refer to the table below for a complete listing of secondary error codes for CCM. Display the CCM Status Word in hexadecimal format to read the two bytes of data. When an error occurs, the low byte will be greater than 1.
2. 3.
The following table lists the CCM error codes that are reported (as secondary error codes) in the high byte of the CCM Status Word after the execution of a CCM COMMREQ. These codes also appear in the low byte of CCM Diagnostic Status Word (DSW) 1.
GFK-0582D
511
5
Table 5-7. CCM Secondary Error Codes (High Byte of COMMREQ Status Word, Low Byte of DSW)
Error Code
Decimal 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 20
Hexadecimal 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 14
Description
Successful transfer. A timeout occurred on the serial link. A COMMREQ attempted to write data to a section of the CCM scratch pad that is permanently write-protected by CCM. A COMMREQ attempted to read or write a non-existent I/O point. A COMMREQ attempted to access more data than is available in a particular memory type. A COMMREQ attempted to read or write an odd number of bytes to register memory or the diagnostic status words. A COMMREQ attempted to read or write one or more non-existent registers. A COMMREQ specified the transfer of zero data bytes. A COMMREQ attempted to write to protected memory. A COMMREQ attempted to transfer data to or from an invalid memory type or absolute source address. A COMMREQ attempted to read or write one or more non-existent diagnostic status words. A COMMREQ attempted to transfer data beginning at an invalid scratch pad address or an input/output table address not on a byte boundary (that is, 1, 9, 17 ...). Serial communication was aborted after a data block transfer was retried three times, or a number specified by the configuration. Serial communication was aborted after a header transfer was retried three times, or a number specified by the configuration. Serial communication was aborted after a Q-Request was retried three times, or a number specified by the configuration. An attempt was made to set the Q-Response data on a device not configured as a slave. One or more of the following errors occurred during a data block transfer: a. An invalid STX character was received. b. An invalid ETB character was received. c. An invalid ETX character was received. d. An invalid LRC character was received. e. A parity, framing, or overrun error occurred.
512
GFK-0582D
CCM Service
Table 57 (Continued)
Error Code
Decimal 21 22 23 24 25 26 29 30 31 34 48 65 66 68 69 70 71 72 127
Hexadecimal 15 16 17 18 19 1A 1D 1E 1F 22 30 41 42 44 45 46 47 48 7F
Description
CCM expected to receive an EOT character from an external device and did not receive it. CCM expected to receive an ACK or NAK character and did not receive either one. Communication was aborted when CCM did not receive a valid acknowledge to a master enquire sequence after 32 attempts, or a number specified by the configuration. Communication was aborted after a peer enquire was NAKed 32 times by the external device, or a number specified by the configuration. Communication was aborted when CCM did not receive a valid response to a peer enquire after 32 attempts, or a number specified by the configuration. A timeout occurred during an attempt to transmit on a port due to CTS being in an inactive state too long. An error occurred when data was being transferred between CCM and the Series 90 CPU. A parity, framing, or overrun error occurred during a serial header transfer. A parity, framing, or overrun error occurred during a serial data block transfer. Bad Q-Response received. A COMMREQ attempted to initiate a conversation on a port in use. The COMMREQ command number is invalid. An invalid COMMREQ data block length was specified. The COMMREQ is invalid on a peer port. The COMMREQ is invalid on a slave port. The COMMREQ is valid only on a master port. The COMMREQ target ID is invalid. The COMMREQ data block values are out of range. Generic miscellaneous error.
GFK-0582D
513
This section provides an explanation and example of each CCM Command. Each example includes values for the Command Block. A ladder program example is also presented here for your convenience. Before attempting to execute the CCM Command examples make sure you have first done the following: D D D D D Installed the CMM in the desired rack (see Chapter 2), and connected a cable between the Logicmaster 90 or Hand Held Programmer and the PLC. Performed Rack Configuration and selected the desired communications parameters for the CMM. (See Chapter 2). Verified that configuration is valid. Stored the configuration to the PLC. (See Chapter 2). Installed the serial communications cable, if you are executing a remote command. (See Chapter 8 for cable diagrams). Written and Stored the ladder program below or a similar program.
514
GFK-0582D
CCM Service
GFK-0582D
515
Word 8: Word 9:
Example:
Set Q response with the numbers 1, 2, 3, 4. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: 00003 00000 00008 00009 00000 00000 06001 (0003) (0000) (0008) (0009) (0000) (0000) (1771) Data Block Length NOWAIT Mode Status Word Memory Type (Register) Status Word Address minus 1 (Register 10) Not used in NOWAIT Mode Not used in NOWAIT Mode Command Number Data Bytes 1 and 2 Data Bytes 3 and 4
516
GFK-0582D
CCM Service
Example:
Clear CCM Diagnostic Status Words Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00001 00000 00008 00009 00000 00000 06002 (0001) (0000) (0008) (0009) (0000) (0000) (1772) Data Block Length NOWAIT Mode Status Word Memory Type (Register) Status Word Address minus 1 (Register 10) Not used in NOWAIT Mode Not used in NOWAIT Mode Command Number
Example
Read the first five Diagnostic Status Words to source registers %R00050-%R00054. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: Word 10: Word 11: Word 12: 00006 00000 00008 00009 00000 00000 06003 00000 00000 00001 00005 00050 (0006) (0000) (0008) (0009) (0000) (0000) (1773) (0000) (0000) (0001) (0005) (0032) Data Block Length NOWAIT Mode Status Word Memory Type (Register) Status Word Address minus 1 (Register 10) Not used in NOWAIT Mode Not used in NOWAIT Mode Command Number Not used Not used Target Memory Address Data Length (words) Source Register
GFK-0582D
517
5
Software Configuration Command: 06004 (1774)
Description:
Local command. This command allows the PLC Ladder application program to reconfigure a CCM port with specific settings for timers and retry counters. This command, when issued, will override the configuration specified by Logicmaster 90. Specifying the value 65535 (FFFFh) for any parameter will indicate that the current setting for that parameter should remain in effect. The initial parameter settings are configured with Logicmaster 90.
Example:
Change the turnaround delay to 1000ms and the ENQ retry count to 16. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: Word 16: Word 17: Word 18: Word 19: Word 20: Word 21: 00015 (000F) 00000 (0000) 00008 (0008) 00009 (0009) 00000 (0000) 00000 (0000) 06004 (1774) 01000 (03E8) 65535 (FFFF) 65535 (FFFF) 65535 (FFFF) 65535 (FFFF) 65535 (FFFF) 65535 (FFFF) 65535 (FFFF) 65535 (FFFF) 00016 (0010) 65535 (FFFF) 65535 (FFFF) 65535 (FFFF) 65535 (FFFF) CCM Data Block Length NOWAIT Mode Status Word Memory (%R) Status Word Address minus 1 (Register 10) Not used Not used Command Number Turnaround Delay (0-65534ms) ENQ_ACK_TIMER (0-65534ms) SOH_TIMER (0-65534ms) HEADER_TIMER (0-65534ms) HEADER_ACK_TIMER (0-65534ms) STX_TIMER (0-65534ms) DATA_TIMER (0-65534ms) DATA_ACK_TIMER (0-65534ms) EOT_TIMER (0-65534ms) ENQ_COUNT (0-50) HEADER_COUNT (0-50) DATA_BLK COUNT (0-50) RS-485 operating mode (2, 4, or FFFF) Re-enable RS-485 receiver delay (0-65534 ms)
See Chapter 7, CCM Protocol, for a description of the use and value of each CCM timer and counter. The RS-485 operating mode parameter allows the RS-485 driver to be configured to operate either as a 2-wire or 4-wire transmittter. 4-wire is the default operating mode. Specifying 2-wire operation disables the RS-485 receiver while the RS-485 driver is transmitting. The RS-485 receiver is re-enabled once the transmitter completes and any re-enable receiver delay has expired. The Re-enable receiver delay parameter allows the RS-485 driver to delay the re-enabling of the RS-485 receivers once the transmitter completes a transmission. The delay is specified in units of milliseconds in the range 0-65534 ms.
518 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
CCM Service
The target memory types which can be accessed are: Target Memory Type
Register Table Input Table Output Table CCM Scratch Pad Diagnostic Status Words
Type Number
1 2 3 6 9
Example
Read from target CCM Diagnostic Status Words 1-9 to source registers %R00936-%R00944. The target CPU ID is 36. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: Word 10: Word 11: Word 12: 00006 (0006) 00000 (0000) 00008 (0008) 00009 (0009) 00000 (0000) 00000 (0000) 06101 (17D5) 00036 00009 00001 00009 00936 (0024) (0009) (0001) (0009) (03A8) Data Block Length NOWAIT Mode Status Word Memory Type (Register) Status Word Address minus 1 (Register 10) Not used in NOWAIT Mode Not used in NOWAIT Mode Command Number Target CPU ID Target Memory Type Target Memory Address Data Length Source Memory Address
Note
When using the Input and Output tables, the memory address must begin on a byte boundary and the data length must be a multiple of 8.
GFK-0582D Chapter 5 CCM Service 519
5
Read Q-Response to Source Register Table: 06109 (17DD)
Description
Remote command. This command allows the PLC programmer to read the Q-Response buffer of a remote device and store the data into a specific location of the Register Table. A Q-Response buffer contains exactly 2 registers of data.
Example
Read the Q-Response from CCM slave device 5 into registers %R00100-%R00101. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: Word 10: Word 11: Word 12: 00006 (0006) 00000 (0000) 00008 (0008) 00009 (0009) 00000 (0000) 00000 (0000) 06109 (17DD) 00005 00000 00000 00000 00100 (0005) (0000) (0000) (0000) (0064) CCM Data Block Length NOWAIT Mode Status Word Memory (%R) Status Word Address minus 1 (Register 10) Not used in NOWAIT mode Not used in NOWAIT mode Command Number Target CPU ID (Slave ID=5) Not used Not used Not used Source Memory Address (Register 100)
520
GFK-0582D
CCM Service
Example
Clear Output %Q00713 in the target Series 90 PLC. The target CPU ID is 25. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: Word 10: 00004 (0004) 00000 (0000) 00008 (0008) 00009 (0009) 00000 (0000) 00000 (0000) 06110 (17DE) 00025 (0019) 00018 (0012) 00713 (02C9) Data Block Length NOWAIT Mode Status Word Memory Type (Register) Status Word Address minus 1 (Register 10) Not used in NOWAIT Mode Not used in NOWAIT Mode Command Number Target CPU ID Target Memory Type/Function Target Memory Address
GFK-0582D
521
5
Write to Target from Source: 06111-06113 (17DF-17E1)
Description
Remote Command. This set of commands is used to write information to the target device from one of the three source memory types listed below:
Source Memory Type Register Table Input Table Output Table Command Number 06111 06112 06113
Example
Write to target registers %R00200-%R00249 from source registers %R00001-%R0050. The target CPU ID is 10. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: Word 10: Word 11: Word 12: 00006 (0006) 00000 (0000) 00008 (0008) 00009 (0009) 00000 (0000) 00000 (0000) 06111 (17DF) 00010 00001 00200 00050 00001 (000A) (0001) (00C8) (0032) (0001) Data Block Length NOWAIT Mode Status Word Memory Type (Register) Status Word Address minus 1 (Register 10) Not used in NOWAIT Mode Not used in NOWAIT Mode Command Number Target CPU ID
Target Memory Type
Note
When using the Input, and Output tables, the memory address must begin on a byte boundary and the data length must be a multiple of 8.
522
GFK-0582D
Chapter
6 SNP Service
section level 1 1 figure bi level 1 table_big level 1
This chapter describes the SNP serial communications service. Before proceeding with this chapter, it is important to be familiar with the information presented in Chapter 4, Initiating Communications - The COMMREQ. This chapter contains the following sections: D D D Section 1: The SNP COMMREQ Data Block Section 2: The SNP COMMREQ Status Word Section 3: SNP COMMREQ Programming Examples
GFK-0582D
61
Section 1:
The SNP COMMREQ Data Block is the part of the COMMREQ Command Block that identifies which SNP Command is to be executed and provides specific parameters for that SNP Command. In describing the SNP COMMREQ Data Block, the following topics are discussed: D D Structure of the SNP Data Block SNP Memory Types And Addressing
62
GFK-0582D
SNP Service
Unit
Valid Range1
Dec
Hex
Length
08 10 12 70 16 72 18 74 20 76 22 78 24 80 26 82 28 84 30 86 56
08h 0Ah 0Ch 46h 10h 48h 12h 4Ah 14h 4Ch 16h 4Eh 18h 50h 1Ah 52h 1Ch 54h 1Eh 56h 38h
word word word bit byte bit byte bit byte bit byte bit byte bit byte bit byte bit byte bit byte
Discrete Temporaries (%T) Discrete Internals (%M) Discretes (%SA) Discretes (%SB) Discretes (%SC)
1-maximum units 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2
The maximum addressable ranges for each memory type depends on the model of CPU and memory configuration. When using a byte-oriented memory type, the corresponding memory address offsets and number of elements are expressed in bytes, not bits.
Note
There is no difference between bit and byte-oriented memory types in terms of processing speed, message length or message transfer time. Special memory type restrictions apply in Datagram Point Formats.
GFK-0582D
63
The SNP COMMREQ Status Word reports on the progress and results of an SNP communications request. The memory address to which the Status Word is written by the CMM is specified in Words 3 and 4 of the Command Block. The contents of the SNP Status Word are defined as:
Hex Format High 00 Low 00
Minor Error Codes (high byte) Completion and Major Error Codes (low byte)
There are several points to remember when interpreting the contents of the SNP COMMREQ Status Word: 1. The CMM will never send a zero for the SNP Status Word to the PLC CPU. If the user program needs to know if the command is complete, it can zero the SNP Status Word before issuing the COMMREQ and then check it for being non-zero. A status code of 1 in the low byte and 0 in the high byte indicates that the request was completed without errors. All other non-zero values indicate errors. Refer to the tables below for a complete listing of major and minor error codes for SNP. Display the SNP Status Word in hexadecimal form to read the two bytes of data. When an error occurs, the low byte (major error code) will be greater than 1. The high byte will contain any applicable minor error code.
2.
3. 4. 5.
The following tables list the SNP error codes that are reported in the SNP Status Word after the execution of an SNP COMMREQ. When an error occurs, these codes also appear in the first word of the SNP Diagnostic Status Words (DSW 1).
64
GFK-0582D
SNP Service
Table 6-2. Major Error Codes for SNP
Error Status Hexadecimal Major Error Description Decimal
1 2 4 5 6 7 01h 02h 04h 05h 06h 07h Successful Completion. (This is the expected completion value in the COMMREQ Status Word.) Insufficient Privilege. For Series 90-70 PLC, the minor error code contains the privilege level required for the service request. Protocol Sequence Error. The CPU has received a message that is out of order. Service Request Error. The minor error code contains the specific error code. See table of Minor Error Codes below. Illegal Mailbox Type. Service request mailbox type is either undefined or unexpected. The PLC CPUs Service Request Queue is full. The master should retry later. It is recommended that the master wait a minimum of 10 msec before sending another service request. 10 11 0Ah 0Bh SNP DOS Driver Error. The minor error code contains the specific error code. See table of Minor Error Codes below. Illegal Service Request. The requested service is either not defined or not supported. (This value is returned in lieu of the actual 01h value passed in the SNP error message, to avoid confusion with the normal successful COMMREQ completion.) Local SNP/SNP-X Error. An error occurred within the SNP task in the CMM module in this PLC. This error may occur in either an SNP master or an SNP slave. The minor error code contains the specific error code. See table of Minor Error Codes below. 12 0Ch 13 0Dh Remote SNP Error. An error occurred within the SNP slave task in the CMM module in the remote PLC. The minor error code contains the specific error code. See table of Minor Error Codes below. Autodial Error. An error occurred while attempting to send a command string to an attached external modem. The minor error code contains the specific error code. See table of Minor Error Codes below. SNP-X slave error. An error occurred within the SNPX task in the remote slave device. The minor error code contains the specific error code. See the table of Minor Error Codes below. Port configurator error. Problem with sending mail to the slave Service Request task. (Series 90-70 PLC CPUs only). 14 0Eh 15 0Fh 19 80 81 85 86 87 88 13h 50h 51h 55h 56h 57h 58h Problem with getting mail from the slave Service Request task. (Series 90-70 PLC CPUs only). Slave SNP task timed out before receiving an SRP response. (Series 90-70 PLC CPUs only). Slave SNP task could not find the requested datagram connection. (Series 90-70 PLC CPUs only). Slave SNP task encountered an error in trying to write the datagram. (Series 90-70 PLC CPUs only). Slave SNP task encountered an error in trying to update the datagram. (Series 90-70 PLC CPUs only).
GFK-0582D
65
Table 6-3. Minor Error Codes for Major Error Code 5
Error Status Decimal Hexadecimal
FFh FEh FDh FCh FBh FAh F9h F8h F7h F6h F5h F4h F3h F2h F1h F0h EFh EEh EDh ECh EBh EAh E9h E8h E7h E6h E5h E4h E3h E2h E1h E0h DFh DEh DDh DCh
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
Service request has been aborted. No privilege for attempted operation. Unable to perform auto configuration. I/O configuration is invalid. Cannot clear I/O configuration. Cannot replace I/O module. Task address out of range. Invalid task name referenced. Required to log in to a task for service. Invalid sweep state to set. Invalid password. Invalid input parameter in request. I/O configuration mismatch. Invalid program cannot log in. Request only valid from programmer. Request only valid in stop mode. Programmer is already attached. Could not return block sizes. VME bus error encountered. Task unable to be created. Task unable to be deleted. Not logged in to process service request. Memory Type selector not valid in context. No user memory is available to allocate. Configuration is not valid. CPU model number does not match. DOS file area not formatted. Memory Type for this selector does not exist. CPU revision number does not match. IOS could not delete configuration or bad type. No I/O configuration to read or delete. Service in process cannot login. Invalid datagram connection address. Size of datagram connection invalid. Unable to locate given datagram connection ID. Unable to find connection address.
66
GFK-0582D
SNP Service
Table 63. Minor Error Codes for Major Error Code 5 (Continued)
Service Request Error Description Error Status Decimal Hexadecimal
DBh DAh D9h D8h D7h D6h D5h D4h D3h D2h D1h D0h CFh CEh CDh CCh CBh CAh C9h C8h C7h C6h C5h C4h C3h C2h C1h 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 Invalid Memory Type selector in datagram. Null pointer to data in Memory Type selector. Transfer type invalid for this Memory Type selector. Point length not allowed. Invalid datagram type specified. Total datagram connection memory exceeded. Invalid block name specified in datagram. Mismatch of configuration checksum. User Program Module (UPM) read or write exceeded block end. Invalid write mode parameter. Packet size or total program size does not match input. One or more PLC modules configured have unsupported revision. Specified device is not available in the system (not present). Specified device has insufficient memory to handle request. Attempt was made to read a device but no data has been stored on it. Data stored on device has been corrupted and is no longer reliable. A comm or write verify error occurred during save or restore. Device is writeprotected. Login using nonzero buffer size required for block commands. Password(s) already enabled and cannot be forced inactive. Passwords are set to inactive and cannot be enabled or disabled. Control Program (CP) tasks exist but requestor not logged into main CP. No tasklevel Rack/Slot configuration to read or delete. Verify with FA Card or EEPROM failed. Text length does not match traffic type. The OEM key is NULL (inactive). Invalid block state transition.
Table 6-4. Minor Error Codes for Major Error Code 10 (0Ah)
110 111
No SNP communication. Either communication has been lost or a communication session has not been established. Bad SNP communication. Transmission was aborted after maximum retries due to serial errors (that is, parity, overrun, or framing errors).
8Fh 8Eh
8Dh
Bad SNP BCC encountered. Transmission was aborted after maximum retries due to a bad Block Check Code. OutofSequence SNP message. SNP message type received was not the type expected. PC Serial port configured for SNP Master driver is not open; no communication can take place. Bad DOS Version. Must have DOS 2.0, or later, to support the SNP DOS Driver.
GFK-0582D
67
6
Note
Minor Error Codes 1-31 indicate non-fatal errors; SNP or SNP-X communication is not terminated.
Table 6-5. Minor Error Codes for Major Error Code 12 (0Ch)
Error Status Decimal Hexadecimal
01h 02h 03h 04h 05h 06h 07h 08h
1 2 3 4 5 6 7 8
WAIT-type COMMREQ is not permitted. Must use NOWAIT-type. COMMREQ command is not supported. SNP communication is not active. Must initiate a new SNP communication by sending an Attach or Long Attach COMMREQ. SNP slave did not respond to Attach message from master. Unable to write SNP Status Word to local PLC memory. May be due to invalid Status Word memory type or address.
Master device memory type is not valid in this PLC. Master device memory address or length is zero. Unable to read or write master device memory locations specified in COMMREQ. Usually caused by invalid memory address for this PLC. SNP message exchange may have taken place.
09h
Master device memory data length exceeds maximum data size of CMM module (2048 bytes). Must use a smaller data length. Use multiple COMMREQs if total data length exceeds this maximum value. Slave device memory type is missing or not valid. Slave device memory address is missing or zero. COMMREQ Data Block Length is too small. (When expected COMMREQ length is 6 words or less, an improper length may cause other minor error codes 6-11.) Invalid Diagnostic Status Word (DSW) starting word or length. Invalid maximum SNP message data size. Must be an even value from 42 to 2048 bytes.
10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
0Ah 0Bh 0Ch 0Dh 0Eh 0Fh 10h 11h 12h 13h 14h 15h 16h 17h
Invalid Privilege Level. Must be 0 through 4 or -1. Invalid Fault Table selector. Must be 1 for I/O Fault Table or 2 for PLC Fault Table. Invalid Fault Table starting index. Must be 1-32 for I/O Fault Table or 1-16 for PLC Fault Table. Invalid fault count. Must be 1-32 for I/O Fault Table or 1-16 for PLC Fault Table. Invalid Set PLC Date/Time mode. Must be 1-4. Invalid Set PLC Date/Time date, time, or day-of-week value. Unable to retrieve master device PLC time/date from PLC CPU. Invalid slave PLC type. Must be 0 for Series 90-70 or 1 for Series 90-30 or Series 90-20.
Invalid datagram type. Must be 01h for normal datagram or 81h (129) for permanent datagram. Missing or too many datagram point formats. Must be 1-32. Invalid datagram point format data. Datagram area size is too small to include data for all specified point formats.
27
1Bh
68
GFK-0582D
SNP Service
Table 65. Minor Error Codes for Major Error Code 12 (0Ch) (Continued)
Local SNP/SNP-X Error Description Error Status Decimal Hexadecimal
1Ch 28 29 30 1Dh 1Eh 31 1Fh SNP-X Request exceeds maximum data size (1000 bytes). Must use a smaller data length. Use multiple COMMREQs if necessary. Invalid SNP-X communication session type. Must be 0 for a single slave device, or 1 for multiple slave devices. Illegal destination SNP ID specified for SNP-X slave. Must be 0-7 ASCII characters, plus a terminating null character (00h). The Null SNP ID (eight bytes of 00h) may be used to specify any single device. The Broadcast SNP ID (eight bytes of FFh) may be used to specify all slave devices on the serial link. Destination SNP ID does not match SNP-X session type. The Broadcast SNP ID is not permitted in a single-slave SNP-X session. The Null SNP ID is not permitted in a multiple-slave SNP-X session.
Note
Minor Error Codes 32-118 indicate fatal errors; subsequent communication must be initiated with an Attach or Long Attach COMMREQ, or any remote SNP-X COMMREQ.
Table 65. Minor Error Codes for Major Error Code 12 (0Ch) (Continued)
Error Status
20h 21h 22h
Decimal
Hexadecimal
32 33 34
Inactivity timeout (T3). The SNP slave has not received any new SNP messages within the configured T3 time interval.
A Parity error has occurred on an Attach, Attach Response, or Update Realtime Datagram message. Communications have not been established. A BCC (Block Check Code) error has occurred on an Attach, Attach Response, or Update Realtime Datagram message. Communications have not been established.
35 36
23h 24h
A Framing or Overrun serial error has occurred on an Attach, Attach Response, or Update Realtime Datagram message. Communications have not been established.
An invalid SNP message type was received when an Attach, Attach Response, or Update Realtime Datagram message was required. Communications have not been established. An invalid next message length value was specified in an Attach, Attach Response, or Update Realtime Datagram message. Communications have not been established. An unexpected SNP message type was received when an Attach, Attach Response, or Update Realtime Datagram was required. Communications have not been established.
37 38
25h 26h
39 40
27h 28h
Another Break was received while SNP slave was waiting for an Attach or Update Realtime Datagram message.
An SNP message has been sent and retried the maximum number of times. A maximum of two retries are permitted. A retry is caused by a NAK from from the remote SNP device.
GFK-0582D
69
Table 65. Minor Error Codes for Major Error Code 12 (0Ch) (Continued)
Error Status
29h
Decimal
Hexadecimal
41 42 43 44 45
A received SNP message has been NAKed the maximum number of two times. The NAKed message may be retransmitted a maximum of two times.
An unknown message was received when an acknowledge (ACK or NAK) was required. Sequence Error. An unexpected SNP message type was received. A received SNP message contains bad next message length value. Acknowledge timeout. An acknowledge (ACK or NAK) was not received within the configured T2 time interval. A slave device may generate this error if the master device has aborted after maximum response NAKs and does not NAK the next response retry.
46 47 48
Response timeout. The SNP Master did not receive an SNP Response message within the configured T5 time interval. Buffer message timeout. An expected Text Buffer or Connection Data message was not received within the configured T5 time interval.
Serial output timeout. The CMM module was unable to transmit a Break, an SNP message, or SNP acknowledge (ACK or NAK) from the serial port. (May be due to missing CTS signal when the CMM module is configured to use hardware flow control.) SNP slave did not receive a response from the Service Request Processor in the PLC CPU.
49 50 51 52 53 54
COMMREQ timeout. The COMMREQ did not complete within the configured time interval. An SNP Request or Response was aborted prior to completion due to reception of a Break. PLC backplane communications error. Invalid Piggyback Status data memory type or address. Communications have not been established.
Invalid SNP Slave SNP ID. Must be a 0-7 ASCII characters, plus a terminating null character (00h). The Null SNP ID (eight bytes of 00h) may be used to specify any single slave device.
55
37h
The SNP master has received an response message containing an unexpected data length. Usually indicates a problem with the remote SNP slave device. May occur when Series 90-70 commands (Task Memory or Program Block Memory Read/Write) are issued to a Series 90-30 slave device.
56 57
38h 39h
Response code in received SNP-X response message does not match expected value. (Response code must equal the request code +80h.) SNP-X Response message exceeds maximum data size (decimal 1000 bytes). Data in the Response is ignored.
610
GFK-0582D
SNP Service
Table 65. Minor Error Codes for Major Error Code 12 (0Ch) (Continued)
Error Status
40h
Decimal
64
Hexadecimal
65
41h
66
42h
67
43h
68
44h
69
45h
70
46h
80
50h
81
51h
82
52h
83
53h
84
54h
85
55h
86
56h
A parity error has occurred on an X-Attach Response message when establishing a new SNP-X communication session. Communications have not been established. A framing or overrun error has occurred on an X-Attach Response message when establishing a new SNP-X communication session. Communications have not been established. A BCC (Block Check Code) error has occurred on an X-Attach Response message when establishing a new SNP-X communication session. Communications have not been established. An invalid message type was received when an X-Attach Response was required when establishing a new SNP-X communication session. Communications have not been established. An invalid next message type value was detected in an X-Attach Response message when establishing a new SNP-X communication session. Communications have not been established. An invalid response code was detected in an X-Attach Response message when establishing a new SNP-X communication session. Communications have not been established. An expected X-Attach Response message was not received within the response timeout interval when establishing a new SNP-X communication session. The master has retried the X-Attach message twice without receiving a response. Communications have not been established. A parity error has occurred on an X-Attach Response message when reestablishing an existing SNP-X communication session. Communications have not been established. A framing or overrun error has occurred on an X-Attach Response message when reestablishing an existing SNP-X communication session. Communications have not been established. A BCC (Block Check Code) error has occurred on an X-Attach Response message when reestablishing an existing SNP-X communication session. Communications have not been established. An invalid message type was received when an X-Attach Response was required when reestablishing an existing SNP-X communication session. Communications have not been established. An invalid next message type value was detected in an X-Attach Response message when reestablishing an existing SNP-X communication session. Communications have not been established. An invalid response code was detected in an X-Attach Response message when reestablishing an existing SNP-X communication session. Communications have not been established. An expected X-Attach Response message was not received within the response timeout interval when reestablishing an existing SNP-X communication session. The master has retried the X-Attach message twice without receiving a response. Communications have not been established.
GFK-0582D
611
Table 65. Minor Error Codes for Major Error Code 12 (0Ch) (Continued)
Error Status
60h 61h 62h 63h 64h 65h 66h 70h 71h 72h 73h 74h 75h 76h
Decimal
96 97 98 99
Hexadecimal
100 101 102 112 113 114 115 116 117 118
A parity error has occurred on an X-Response message. A framing or overrun error has occurred on an X-Response message. A BCC (Block Check Code) error has occurred on an X-Response message. An invalid message type was received when an X-Response message was required. An invalid next message type value was detected in an X-Response message. An invalid response code was detected in an X-Response message. An expected X-Response message was not received within the response timeout interval. A parity error has occurred on an Intermediate Response message. A framing or overrun error has occurred on an Intermediate Response message. A BCC (Block Check Code) error has occurred on an Intermediate Response message. An invalid message type was received when an Intermediate Response message was required. An invalid next message type value was detected in an Intermediate Response message. An invalid response code was detected in an Intermediate Response message. An expected Intermediate Response message was not received within the response timeout interval.
Table 6-6. Minor Error Codes for Major Error Code 13 (0Dh)
Error Status
40h 41h
Decimal
Hexadecimal
64 65
The requested service is not supported by the SNP slave. SNP slave on CMM module requires PLC CPU privilege level 2 to operate. The SNP slave has rejected a request to change to a higher or lower privilege level. SNP Request or Response message exceeds maximum data length of the CMM module. (Total data length for Mailbox and all following Buffer messages is 2048 bytes.) The master must use a smaller data length. Use multiple requests if total data length exceeds the maximum value.
66
42h
67
43h
Improper Write Datagram message format. Series 90-70 slave devices use a different format for this message than Series 90-30 or Series 90-20 slave devices. The master must use the proper message format for this SNP slave device. (The SNP master in the CMM module sends this message as part of the Establish Datagram COMMREQ command. The datagram has been partially established, but is not usable; the datagram should be cancelled by using the Datagram ID returned by the COMMREQ.)
A datagram error occurred in a Series 90-70 slave device (dual-port error).
68
44
612
GFK-0582D
SNP Service
Table 6-7. Minor Error Codes for Major Error Code 14 (0Eh)
Error Status
01h 02h 03h 04h
Decimal
Hexadecimal
1 2 3 4
Not used. The modem command string length exceeds 250 characters. COMMREQ Data Block Length is too small. Output command string data is missing or incomplete.
Serial output timeout. The CMM module was unable to transmit the modem autodial output from the serial port. (May be due to missing CTS signal when the CMM is configured to use hardware flow control.)
5 6
05h 06h
Response was not received from modem. Check modem and cable. Modem responded with BUSY. Modem is unable to complete the requested connection. The remote modem is already in use; retry the connection request at a later time. Modem responded with NO CARRIER. Modem is unable to complete the requested connection. Check the local and remote modems and the telephone line.
7 8 9
Modem responded with NO DIALTONE. Modem is unable to complete the requested connection. Check the modem connections and the telephone line. Modem responded with ERROR. Modem is unable to complete the requested command. Check the modem command string and modem.
10
0Ah
Modem responded with RING, indicating that the modem is being called by another modem. Modem is unable to complete the requested command. Retry the modem command at a later time. An unknown response was received from the modem. Modem is unable to complete the requested command. Check the modem command string and modem. The modem response is expected to be either CONNECT or OK.
11
0Bh
Note
Minor Error Codes 1-21 indicate non-fatal errors; the SNP-X communication session is not terminated.
GFK-0582D
613
Table 6-8. Minor Error Codes for Major Error Code 15 (0Fh)
Error Status
01h
Decimal
Hexadecimal
The service request code in an X-Request message is unsupported or invalid at this time. This error may occur if an SNP-X communication session has not been successfully established at the slave device.
2 3 4 5 6
07h
08h
16
10h
21
15h
Insufficient privilege level in the slave PLC CPU for the requested SNP-X service. Password protection at PLC CPU may be preventing the requested service. Invalid slave memory type in X-Request message. Invalid slave memory address or range in X-Request message. Invalid data length in X-Request message. Data length must be non-zero and may not exceed decimal 1000 bytes. X-Buffer data length does not match the service request in X-Request message. The X-Buffer message length is obtained from the Next Message Length field in the X-Request message; the length of the data within the buffer message is always the message length minus 8 bytes. Queue Full indication from Service Request Processor in slave PLC CPU. The slave is temporarily unable to complete the service request; the master should try again later. It is recommended that the master wait at least 10 msec before repeating the X-Request. (This error applies to CMM module only.) Service Request Processor response exceeds 1000 bytes; the SNP-X slave device cannot return the data in an X-Response message. (This error applies to CMM module only.) Unexpected Service Request Processor error. (This error applies to CMM module only; the unexpected SRP error code is saved in the Diagnostic Status Words in the CMM module.) Requested service is not permitted in a Broadcast request. The master must direct the X-Request message to a specific SNP-X slave device.
Note
Minor Error Codes 32-35 indicate fatal errors; subsequent SNP-X communication must be initiated with an X-Attach message. The SNP-X slave device returns these error codes in an X-Response message.
Table 68. Minor Error Codes for Major Error Code 15 (0Fh) (Continued)
Error Status
20h 21h
Decimal
32 33
Hexadecimal
34 35
22h 23h
Invalid Message Type field in a received X-Request message. The message type of an X-Request message must be 58h = X. Invalid Next Message Type or Next Message Length field in a received X Request message. If this request does not use a buffer (0-2 bytes of data), the Next Message Type must be zero. If this request will be followed with a buffer message (more than 2 bytes of data), the Next Message Type must be 54h = T, and the Next Message Length must specify the length of the X-Buffer message. Valid X-Buffer message lengths are 9-1008 bytes (data length plus 8 bytes). Invalid Message Type field in a received X-Buffer message. The message type of an X-Buffer message must be 54h = T. Invalid Next Message Type field in a received X-Buffer message. Since an X-Buffer message is never followed by another message, the Next Message Type must always be zero.
614
GFK-0582D
SNP Service
Note
Minor Error Codes 64-115 indicate fatal errors; subsequent SNP-X communication must be initiated with an X-Attach message. The SNP-X slave device is unable to return an X-Response message; these error codes are available only in the Diagnostic Status Words maintained for each serial port on the CMM module.
Table 68. Minor Error Codes for Major Error Code 15 (0Fh) (Continued)
Error Status
40h
Decimal
64
Hexadecimal
65 66 67 68 80 81 82 83 84
85 96 97 98
Serial output timeout. The slave was unable to transmit an SNP-X message from the serial port. (May be due to missing CTS signal when the CMM module is configured to use hardware flow control.) An SNP-X request was aborted prior to completion due to reception of a Break. An X-Buffer message was received containing greater than 1000 bytes of data. The data is ignored. The SNP-X slave did not receive a response from the Service Request Processor in the PLC CPU. PLC backplane communications error. A parity error has occurred in a received X-Attach message. A framing or overrun error has occurred in a received X-Attach message. A BCC (Block Check Code) error has occurred in a received X-Attach message. An invalid Message Type was received when an X-Attach message was required. (For an X-Attach message, the message type must be 58h = T.) An invalid Next Message Type value was detected in a received X-Attach message. (For an X-Attach message, the Next Message Length must be zero.) An invalid request code was detected in a received X-Attach message. A parity error has occurred in a received X-Request message. A framing or overrun error has occurred in a received X-Request message. A BCC (Block Check Code) error has occurred in a received X-Request message. A parity error has occurred in a received X-Buffer message. A framing or overrun error has occurred in a received X-Buffer message. A BCC (Block Check Code) error has occurred in a received X-Buffer message. An expected X-Buffer message was not received.
Table 6-9. Minor Error Codes for Major Error Code 19 (13h)
Error Status
02h
Decimal
2
Hexadecimal
3 4 5
Unsupported COMMREQ. These errors are only generated when there is no protocol currently being run on a port and the port receives a COMMREQ. (The port may be disabled or an error has occurred in processing a new configuration). Invalid COMMREQ length. Invalid COMMREQ status word location. Invalid COMMREQ data.
GFK-0582D
615
This section provides an explanation and example of each SNP command. Each example includes values for the Command Block. A ladder program example is also presented here for convenience. Before attempting to execute the SNP command examples, make sure that the following steps have been performed: D D The CMM module has been installed in the desired PLC rack (see Chapter 2). The rack configuration has been performed and the desired communications parameters have been selected for the CMM module, using the Logicmaster 90 configuration software or the Hand Held Programmer (see Chapter 2). The rack configuration has been verified and is valid. The rack configuration has been stored into the PLC (see Chapter 2). If using Logicmaster 90, the configuration in the PLC has been verified equal to the Logicmaster 90 configuration. The serial communications cable has been installed between the master and slave devices for operation of any remote commands. (See Chapter 8 for cable diagrams). The ladder application program below or a similar program has been written and stored into the PLC.
D D
D D
Note
In the examples below, the CMM module has been installed in and configured for Rack 0, Slot 2 with SNP operation on Port 1. If your configuration is different than this, you will need to change the COMMREQ fields for Rack/Slot (SYSID field) and /or Port Number (TASK field) to match your configuration.
616
GFK-0582D
SNP Service
Make sure that the SYSID and TASK values match the system configuration and that the specified CMM port is properly configured for operation as an SNP master.
GFK-0582D
617
6
Ladder Program Example
| << RUNG 4 STEP #0001>> | |FST_SCN ++ %T0001 +] [+MOVE +(S) | | INT | | | | | CONST +IN Q+%R0001 | +00000 | LEN | | |00001| | ++ | | << RUNG 5 STEP #0004 >> | |%T0001 ++ %T0002 +] [+ TMR +(^) | |0.10s| | | | | CONST +PV | | +00020 | | | ++ | %R0002 | | << RUNG 6 STEP #0007 >> | |%T0002 ++ ++ %T0001 +] [+BLKMV++BLKMV+(R) | | INT | | INT | | | | | | | CONST +IN1 Q+%R0005 CONST +IN1 Q+%R0012 | +00007 | | +00000 | | | | | | | | CONST +IN2 | CONST +IN2 | | +00000 | | +00000 | | | | | | | | CONST +IN3 | CONST +IN3 | | +00008 | | +00000 | | | | | | | | CONST +IN4 | CONST +IN4 | | +00000 | | +00000 | | | | | | | | CONST +IN5 | CONST +IN5 | | +00000 | | +00000 | | | | | | | | CONST +IN6 | CONST +IN6 | | +00000 | | +00000 | | | | | | | | CONST +IN7 | CONST +IN7 | | +07200 ++ +00000 ++ | | << RUNG 7 STEP #0011 >> | |%T0002 ++ ++ %T0003 +] [++MOVE_++COMM_|+(S) | | | INT | | REQ || |%T0005 | | | | || +] [+ CONST +IN Q+%R0001 %R0005 +IN FT++ | +00000 | | | | | |00001| | | | ++ CONST +SYSID| | 0002 | | | | | | CONST +TASK | | 00000001 ++ |
618
GFK-0582D
SNP Service
| << RUNG 8 STEP #0016 >> | |ALW_ON ++ %T0004 +] [+ EQ_ |+(^) | | INT || | | || |%R0001 +I1 Q++ | | | | CONST +I2 | | +00001++ | | << RUNG 9 STEP #0019 >> | |%T0004 ++ ++ %T0005 +] [+BLKMV++BLKMV+(^) | | INT | | INT | | | | | | | CONST +IN1 Q+%R0005 CONST +IN1 Q+%R0012 | +00006 | | +00008 | | | | | | | | CONST +IN2 | CONST +IN2 | | +00000 | | +00101 | | | | | | | | CONST +IN3 | CONST +IN3 | | +00008 | | +00001 | | | | | | | | CONST +IN4 | CONST +IN4 | | +00000 | | +00008 | | | | | | | | CONST +IN5 | CONST +IN5 | | +00000 | | +00102 | | | | | | | | CONST +IN6 | CONST +IN6 | | +00000 | | +00000 | | | | | | | | CONST +IN7 | CONST +IN7 | | +07202 ++ +00000 ++ | | [ END OF PROGRAM LOGIC ] |
GFK-0582D
619
SNP Commands
The following table lists the SNP commands that can be initiated by a COMMREQ. Most can be issued only to a serial port configured as an SNP master. Remote commands provide communication between a master and slave. Unless otherwise indicated, the master may send any remote command to any Series 90 slave; certain remote commands are valid only when communicating with a Series 90-70 slave. Local commands are executed without communication to a remote device.
Note
The first COMMREQ issued to a CMM module after PLC powerup must be delayed; the CMM cannot accept COMMREQs when the PLC application is started. A delay of 2 seconds past first scan is recommended.
Table 6-10. SNP Commands SNP Command Command Number Decimal Hexadecimal
(1B58) (1B59) (1B5A) (1B5B) (1B5C) (1B5D)
Master
Slave
Local Commands Clear Diagnostic Status Words Read Diagnostic Status Words Change SNP ID Set X-Status Bits Address
X X
X X X X X X
Disable BreakFree SNP Slave Operation Enable BreakFree SNP Slave Operation Remote SNP-X Commands X-Read X-Write
7004 7005
7101 7102
(1BBD) (1BBE)
X X
Remote SNP Commands Attach Change Privilege Level Read System Memory Write System Memory Read Task Memory Write Task Memory Read Program Block Memory Write Program Block Memory PLC Short Status Return Control Program Name Return Controller Type and ID Return PLC Time/Date Return Fault Table Set PLC Time/Date Toggle Force System Memory Establish Datagram Update Datagram Cancel Datagram Update Real-Time Datagram Long Attach Special Purpose Commands Autodial
1
7200 7201 7202 7203 7204 7205 7206 7207 7208 7209 7210 7211 7212 7213 7214 7215 7216 7217 7218 7300
(1C20) (1C21) (1C22) (1C23) (1C24) (1C25) (1C26) (1C27) (1C28) (1C29) (1C2A) (1C2B) (1C2C) (1C2D) (1C2E) (1C2F) (1C30) (1C31) (1C32) (1C84)
7400
(1CE8)
This Command is valid only when communicating with a Series 90-70 slave device. All SNP command examples in this section return the COMMREQ Status Word to Register %R00001.
620
GFK-0582D
SNP Service
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00001 (0001) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07000 (1B58) SNP Data Block Length NOWAIT Mode COMMREQ Status Word Memory Type (%R) COMMREQ Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number
GFK-0582D
621
6
Read Diagnostic Status Words: 07001 (1B59)
Available Modes: Master and Slave (CPU 351 and CPU 352 serial ports only support the Master mode). Description: Local command. This command returns the SNP Diagnostic Status Words maintained within the CMM module into the PLC memory area specified by the COMMREQ. A complete set of Diagnostic Status Words is maintained for each serial port of the CMM module. Example Command Block: Read all 20 local Diagnostic Status Words from the CMM and place them into Register Memory (%R), Registers 181-200. The desired serial port is specified by the TASK field of the issuing COMMREQ. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00005 (0005) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07001 (1B59) 00001 (0001) 00020 (0014) 00008 (0008) 00181 (00B5) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number
Word 8: Word 9: Word 10: Word 11: First Diagnostic Status Word to read (DSW 1) Number of Diagnostic Status Words to read (20 DSWs) Memory Type to store Diagnostic Status Words (%R) Address to store Diagnostic Status Words (Register 181) The Memory Type and Address to store Diagnostic Status Words fields must be selected to accommodate the requested number of Diagnostic Status Words. See Table 61, Memory Types, Unit Lengths, and Valid Ranges, for valid memory types and addresses.
SNP Diagnostic Status Words: The following table specifies the contents of the SNP Diagnostic Status Words:
Contents
Error SNP Status Word Number of Successful Requests/Responses Number of Error Requests Number of Aborts Number of Retries sent Number of NAKs sent Number of Break Sequences Received Reserved (00h) SNP Software Version Number First 6 words of error COMMREQ Data Block
622
GFK-0582D
SNP Service
Error SNP Status Word. This word indicates the major and minor error code values of the most recent COMMREQ error or internal SNP error. This word follows the format and contents of the SNP Status Word. (See Section 2, SNP Status Word, for complete details.) Number of Successful Requests/Responses. This word indicates the number of successful COMMREQ completions or SNP responses. For a master device, this value indicates the number of successful COMMREQ completions; this value also includes any additional messages exchanged to keep the SNP communications alive. For a slave device, this value indicates the number of SNP responses successfully sent to the remote master; this value also includes any messages sent to keep the SNP communication alive, as well as successful local COMMREQ completions. Number of Error Requests. This word indicates the number of COMMREQs that have failed at this SNP device. This value counts non-fatal errors only; the SNP communication is maintained. For an SNP slave device, this value also counts error responses returned to the master. Number of Aborts. This word indicates the number of fatal errors at this SNP device; the SNP communication is terminated. An abort may occur at either a master or slave device. After an abort, the master device must establish new SNP communications. Aborts may be caused by failure to receive an expected message or acknowledgement, certain protocol errors, failure to read or write to the serial port, or a communication failure to the local PLC. Inactivity timeouts, which do terminate SNP communication, are not counted as aborts; an inactivity timeout occurs at the slave device when the slave receives no further messages from the master. Number of Retries Sent. This word indicates the number of message retries performed by this SNP device. A master or slave device retries a message when the acknowledgement to that message indicates a recoverable transmission error. A maximum of two retries are permitted to any SNP message; if the message is still not correctly acknowledged, a fatal error occurs and the SNP communication is aborted. For SNP-X operation, this word indicates the number of X-Attach retries to establish the SNP-X session, as well as any repeated SNP-X request after a session has been reestablished. Number of NAKs Sent. This word indicates the number of negative acknowledgements (NAKs) returned by this SNP device. A NAK is sent when an error (recoverable or fatal) is detected in a received SNP message. If the error is recoverable, a retry is expected; if the error is fatal, the SNP communication is aborted. Number of Break Sequences Received. This word indicates the number of Break sequences received by this SNP device. Used by slave devices only. When a Break sequence is received, any existing SNP communication is aborted. The Break sequence immediately precedes each new SNP communication. SNP Software Version Number. This word indicates the version number of the communication firmware in this CMM module. The version number consists of two hexadecimal numbers (high byte, low byte). Error COMMREQ Data Block. These 6 words contain the first 6 words of the COMMREQ Data Block from the most recent COMMREQ failure. Used by both master and slave devices (slave devices perform local COMMREQ commands only). This data can help to identify the COMMREQ which has failed.
GFK-0582D
623
6
Change SNP ID: 07002 (1B5A)
Available Modes: Slave Description: Local command. The slave device in the CMM module defaults to the same SNP ID as the built-in slave device in the PLC CPU. This command changes the SNP ID of the CMM slave device to a specified value. Different SNP IDs are required to differentiate between multiple SNP slave devices in a multi-drop arrangement. The SNP slave in the CMM module reverts to the default SNP ID (that is, the SNP ID of the PLC CPU) whenever the PLC is powered up or the CMM is manually restarted. Example Command Block: Change the SNP ID of the SNP slave device in the CMM module to NEWID1 . Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00005 (0005) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07002 (1B5A) 17742 (454E) 18775 (4957) 12612 (3144) 00000 (0000)
SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number Word 8: Word 9: Word 10: Word 11: Characters 1 and 2 of Slave SNP ID: Characters 3 and 4 of Slave SNP ID: Characters 5 and 6 of Slave SNP ID: Characters 7 and 8 of Slave SNP ID: N (4Eh), E (45h) W (57h), I (49h) D (44h), 1 (31h) null, null
The Slave SNP ID field specifies the new SNP ID of this slave device. The SNP ID field is 8 bytes long. For the Series 9030 and Series 90-70 PLCs, the SNP ID can be a maximum of 7 bytes followed by a null character (0) and can include any ASCII character. A null SNP ID (Character 1 = 0) is not permitted.
624
GFK-0582D
SNP Service
The Slave Memory Type and Address of X-Status Bits fields must be selected to allow enough room for the three X-Status Bits. Only the %I, %Q, %M, or %T bit-oriented memory types are permitted; see the Memory Type table, Table 61. If the X-Status Bits location is not specified (both the memory type and address values are 0), the X-Status Bits information is not written to the PLC. The layout of the X-Status Bits is specified below: (bit n+2) (bit n+1) (bit n)
00076 (004C) Slave Memory Type of X-Status Bits (%M, bit mode) 00101 (0065) Slave Address of X-Status bits (%M101)
X_WRITE X_READ X_ACTIVE
The X_ACTIVE bit indicates that an SNP-X communication session is active; this slave device is able to receive data transmission X-requests while this bit is set. This bit is set when a new SNP-X communication session is established; this bit is cleared whenever a Break is received, or a fatal error occurs. The X_READ and X_WRITE bits indicate that a remote X-request has been successfully completed by this slave device. The appropriate bit is set after completion of each successful reGFK-0582D Chapter 6 SNP Service 625
6
mote read or write X-request. The PLC application ladder must detect the X_READ and X_WRITE bits in every sweep. Upon detection, each bit must be immediately cleared in order to correctly detect the next remote X-request completion.
Note
The X-Status Bits operate slightly differently for slave devices on CMM modules, the Series 90 CPU Serial Ports 1 and 2, and on the Series 90 CPU standard SNP serial port. For the Series 90 CPU standard SNP port, the X-Status Bits are located at predefined memory locations and are always updated after SNP-X slave operation. The X_READ and X_WRITE bits remain set for exactly one sweep and may not be cleared by the PLC ladder application.
626
GFK-0582D
SNP Service
If the COMM_REQ status word location specified in words 3 and 4 of the command block is not a valid %R, %AI or %AQ reference, the fault output (FT) will be energized when the COMM_REQ attempts to execute. Otherwise, the status word is updated, based to indicate if the COMM_REQ was successful, as listed below: 0001 Command successful. 010Ch WAIT-mode COMMREQ is not permitted; must use NOWAIT. 020Ch Command not supported; the port is either not configured as an SNP slave or does not support break-free operation. Sending this command when break-free SNP is already disabled has no effect; however, the COMMREQ status location will be set to 1, indicating success. Sending this command to a PLC CPU built-in serial port that does not support break-free SNP will set the fault output of the COMMREQ.
Note
Break-free SNP on built-in slave ports in PLC CPUs uses a small fraction of the CPU processing bandwidth. For most applications the impact on CPU performance is negligible. However, applications that use multi-drop SNP or SNP-X communication can incur noticeable increases in PLC sweep times because all slave units must examine every received message. If your application requires a very small or predictable sweep time and you have a multi-drop SNP network, you may need to disable break-free SNP on the port.
GFK-0582D
627
6
COMMREQ Parameters SYSID and Task are set based on the active CPU and Serial Port SYSID: CPU311, CPU313, CPU323: 0000 CPU331 CPU364 : 0001 Task: Power Supply Port (all CPUs) 00031 (001F hex) Port 1 (CPUs 351/352/363 only) 00019 (0013 hex) Port 2 (CPUs 351/352/363 only) 00020 (0014 hex) Example Command Block: Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00001 00000 00008 00000 00000 00000 07004 (0001) (0000) (0008) (0000) (0000) (0000) (1B5C) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number: Disable break-free SNP
628
GFK-0582D
SNP Service
COMMREQ Parameters SYSID and Task are set based on the active CPU and Serial Port SYSID: CPU311, CPU313, CPU323: 0000 CPU331 CPU364 : 0001 Task: Power Supply Port (all CPUs) 00031 (001F hex) Port 1 (CPUs 351/352/363 only) 00019 (0013 hex) Port 2 (CPUs 351/352/363 only) 00020 (0014 hex) Example Command Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Block: 00001 00000 00008 00000 00000 00000 07005
SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number: Enable breakfree SNP
GFK-0582D
629
6
X-Read: 07101 (1BBD)
Available Modes: Master Description: Remote command. The master establishes a new SNP-X communication session with the slave device if the proper session is not already active. The master then sends an X-Read request to the slave device; the slave responds with data. This service is provided to permit quick read access to various reference tables within the slave PLC. This command reads enough data from the slave reference table to fill the specified number of elements in the master reference table. When the memory types of the slave and master reference tables differ, the data will be transferred from the slave reference table beginning with the least significant bit. The X-Read command may not use the broadcast SNP ID. This X-command requires at least 11 words in the COMMREQ Data Block. From 2 to 6 additional words may be supplied containing optional parameters. The following example establishes a direct single-session communication session to the slave device via the null SNP ID, then reads slave device Register Memory (%R), register 201, and deposits the 10 least significant bits into master device Input Memory (%I), Inputs 1-10. The PLC Status Word returned from the slave device is updated into master device Register Memory (%R), Register 32. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00017 (0011) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07101 (1BBD) 00000 (0000) 00000 (0000) 00000 (0000) 00000 (0000) 00000 (0000) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP-X Command Number
Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: Word 16: Word 17: Word 18: Word 19: Word 20: Word 21: Word 22: Word 23: Characters 1 and 2 of Slave SNP ID: null, null Characters 3 and 4 of Slave SNP ID: null, null Characters 5 and 6 of Slave SNP ID: null, null Characters 7 and 8 of Slave SNP ID: null, null Communication Session type (0 = single-session; 1 = multi-session) 00008 (0008) Slave Memory Type from which to read data (%R) 00201 (00C9) Slave Address from which to read data (Register 201) 00010 (000A) 00070 (0046) 00001 (0001) 00008 (0008) Number of Master Memory Type elements to read Master Memory Type to store data (%I) Master Address to store data (Input 1) Master Memory Type to store Slave PLC Status Word (%R) 00032 (0020) Master Address to store Slave PLC Status Word (Register 32) 00000 (0000) Response Timeout (in msec; 0 = use default) 00000 (0000) Broadcast Delay (in msec; 0 = use default) 00000 (0000) Modem Turnaround Time (in msec) 00000 (0000) Transmission Delay (in msec)
GFK-0582D
630
SNP Service
The SNP ID field specifies the slave device from which data will be retrieved. The null SNP ID (all bytes 00h) may be used only when the single-session Communication Session type is selected. The broadcast SNP ID (all bytes FFh) may not be used by this command. The Communication Session type field specifies whether the communication session is singlesession or multi-session. The master uses this value, together with the SNP ID value, to determine whether the proper communication session is already active, or if a new session must be established prior to the actual data transfer. For single-session operation, the communication session is established with only the slave device specified by the SNP ID. For multi-session operation, the communication session is established with all slave devices on the serial link. In either case, once the proper communication session exists, the master sends the data transfer command to the slave specified by the SNP ID. When communicating with a single slave device, single-session provides the fastest performance. When communicating with multiple slave devices on a multidrop serial link, multi-session provides the fastest performance. The Number of Master Memory Type elements to read field is specified in units consistent with the access mode of the Master Memory Type. A maximum of 1000 bytes of data may be transferred in one X-Read command; use multiple commands to transfer more data.
Note
The following command parameters are optional. The COMMREQ Data Block length (Word 1) must include all parameters in use. The optional Master Memory Type and Address to store Slave PLC Status Word fields specify a location in the master PLC memory that is updated with the PLC Status Word from the slave device upon successful completion of this command. If both fields are not programmed, or are set to zero, the slave PLC Status Word is not updated into master PLC memory. The optional Response Timeout field specifies a new value for the Response Timeout timer. This time is the maximum time that the master will wait for an X-response from the slave. The new value is specified in milliseconds and is in effect for this COMMREQ only. If not programmed or set to zero, the master uses the T2 timer value, as selected by the Timeouts configuration parameter. The optional Broadcast Delay field specifies a new value for the Broadcast Delay timer. This time is the interval that the master must wait for all slave devices to establish an SNP-X communication session, or to process a broadcast X-command, since the slave devices do not return a response to any broadcast message. The new value is specified in milliseconds and is in effect for this COMMREQ only. If not programmed or set to zero, the master uses the T2 timer value, as selected by the Timeouts configuration parameter. The optional Modem Turnaround Time field specifies a new Modem Turnaround Time value. This is the time interval required by a connected modem to turn the link around. The new value is specified in milliseconds and is in effect for this COMMREQ only. If not programmed, the master uses the value selected by the Modem Turnaround Delay configuration parameter. The optional Transmission Delay field specifies a new Transmission Delay value. This time interval accounts for unusually long time delays in transmission between the master and slave devices. Such unusually long delays are typical of communications via satellite. The new value is specified in milliseconds and is in effect for this COMMREQ only. If not programmed, the master uses the value selected by the Timeouts configuration parameter.
GFK-0582D Chapter 6 SNP Service 631
6
X-Write: 07102 (1BBE)
Available Modes: Master Description: Remote command. The master establishes a new SNP-X communication session with the slave device if the proper session is not already active. The master then sends an X-Write request with data to the slave device. This service is provided to permit quick write access to various reference tables within the slave PLC. This command writes the specified number of elements from the master reference table into the slave reference table. When the memory types of the slave and master reference tables differ, the data will be padded with the value 0 as necessary. In multi-session operation, the broadcast SNP ID may be used to write data to all slave devices on the serial link. This X-command requires at least 11 words in the COMMREQ Data Block. From 2 to 6 additional words may be supplied containing optional parameters. The following example establishes a direct single-session communication session to the slave device via the null SNP ID, and then writes master device Input Memory (%I), Inputs 1-10, into slave device Register Memory (%R), register 201. The PLC Status Word returned from the slave device is updated into master device Register Memory (%R), Register 32. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00017 (0011) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07102 (1BBE) 00000 (0000) 00000 (0000) 00000 (0000) 00000 (0000) 00000 (0000) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP-X Command Number
The SNP ID field specifies the slave device(s) to which data will be written. The null SNP ID (all bytes 00h) may be used only when the single-session Communication Session type is se632 Series 90 PLC Serial Communications Users Manual November 2000
Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: Word 16: Word 17: Word 18: Word 19: Word 20: Word 21: Word 22: Word 23: Characters 1 and 2 of Slave SNP ID: null, null Characters 3 and 4 of Slave SNP ID: null, null Characters 5 and 6 of Slave SNP ID: null, null Characters 7 and 8 of Slave SNP ID: null, null Communication Session type (0 = single-session; 1 = multi-session) 00008 (0008) Slave Memory Type to store data (%R) 00201 (00C9) Slave Address to store data (Register 201) 00010 (000A) 00070 (0046) 00001 (0001) 00008 (0008) Number of Master Memory Type elements to write Master Memory Type from which to write data (%I) Master Address from which to write data (Input 1) Master Memory Type to store Slave PLC Status Word (%R) 00032 (0020) Master Address to store Slave PLC Status Word (Register 32) 00000 (0000) Response Timeout (in msec; 0 = use default) 00000 (0000) Broadcast Delay (in msec; 0 = use default) 00000 (0000) Modem Turnaround Time (in msec) 00000 (0000) Transmission Delay (in msec)
GFK-0582D
SNP Service
lected. The broadcast SNP ID (all bytes FFh) may be used only when the multi-session Communication Session type is selected. The Communication Session type field specifies whether the communication session is single-session or multi-session. The master uses this value, together with the SNP ID value, to determine whether the proper communication session is already active, or if a new session must be established prior to the actual data transfer. For single-session operation, the communication session is established with only the slave device specified by the SNP ID. For multi-session operation, the communication session is established with all slave devices on the serial link. In either case, once the proper communication session exists, the master sends the data transfer command to the slave specified by the SNP ID. When communicating with a single slave device, single-session provides the fastest performance. When communicating with many slave devices on a multidrop serial link, multi-session provides the fastest performance. The Number of Master Memory Type elements to write field is specified in units consistent with the access mode of the Master Memory Type. A maximum of 1000 bytes of data may be transferred in one X-Write command; use multiple commands to transfer more data.
Note
Where data types do not match, zero fill will take place. The remaining COMMREQ parameters are optional. The COMMREQ Data Block length (Word 1) must include all parameters in use. The optional Master Memory Type and Address to store Slave PLC Status Word fields specify a location in the master PLC memory that is updated with the PLC Status Word from the slave device upon successful completion of this command. If both fields are not programmed, or are set to zero, the slave PLC Status Word is not updated into master PLC memory. The optional Response Timeout field specifies a new value for the Response Timeout timer. This time is the maximum time that the master will wait for an X-response from the slave. The new value is specified in milliseconds and is in effect for this COMMREQ only. If not programmed or set to zero, the master uses the T2 timer value, as selected by the Timeouts configuration parameter. The optional Broadcast Delay field specifies a new value for the Broadcast Delay timer. This time is the interval that the master must wait for all slave devices to establish an SNP-X communication session, or to process a broadcast X-command, since the slave devices do not return a response to any broadcast message. The new value is specified in milliseconds and is in effect for this COMMREQ only. If not programmed or set to zero, the master uses the T2 timer value, as selected by the Timeouts configuration parameter. The optional Modem Turnaround Time field specifies a new Modem Turnaround Time value. This is the time interval required by a connected modem to turn the link around. The new value is specified in milliseconds and is in effect for this COMMREQ only. If not programmed, the master uses the value selected by the Modem Turnaround Delay configuration parameter. The optional Transmission Delay field specifies a new Transmission Delay value. This time interval accounts for unusually long time delays in transmission between the master and slave devices. Such unusually long delays are typical of communications via satellite. The new value is specified in milliseconds and is in effect for this COMMREQ only. If not programmed, the master uses the value selected by the Timeouts configuration parameter.
GFK-0582D Chapter 6 SNP Service 633
6
Attach: 07200 (1C20)
Available Modes: Master Description: Remote command. The Attach command establishes a communication session with a slave device. The Attach command can be issued at any time. The master sends a Break sequence, followed by an Attach request; the specified slave responds with an Attach response. The Break sequence is initiated to all slave devices sharing the same communication link. The detection of the Break sequence by a slave device immediately aborts any communication session currently in process and places all slave devices into a state waiting for a valid Attach request. The master device waits the length of the T4 timer before sending the Attach request to the slave devices. Only the slave device with the matching SNP ID responds with an Attach response. The non-matching slaves return to a state waiting for a Break sequence. The master, upon receiving a valid Attach response, completes the COMMREQ with a successful status. No response or an invalid response completes the COMMREQ with an error status. Having negotiated a successful Attach to a slave PLC, the master device is accorded the default privilege level at the slave device. For the built-in CPU port in a Series 90-70 PLC, the default slave privilege level is Level 0; Level 0 prevents any read or write of the PLC memory. For the standard SNP port in a Series 90-30 or Series 90-20 PLC, the default slave privilege level is Level 1; Level 1 permits read but not write of the PLC memory. For an SNP slave device on a CMM module in any Series 90 PLC, the slave privilege is always Level 2 and cannot be changed; Level 2 permits read and write of the PLC memory. If the master device requires additional privileges, see the Change Privilege Level command for further information. The Attach command also enables or disables Piggyback Status reporting for the duration of the SNP communication. When enabled, Piggyback Status data is updated after each successful command. If a particular installation requires configuration parameter values different from those specified with the programming software or the Hand Held Programmer, the Long Attach command must be used. The Long Attach command adds some overhead to the communications process and should only be used if necessary. Examples of cases which may require the Long Attach include: D D D D Satellite communications Modem communications with setup times > 500ms Communications in high noise environments Specific error detection/recovery requirements
634
GFK-0582D
SNP Service
Example Command Block: Attach to a slave device whose SNP ID is SNPID1. Enable Piggyback Status update on this and all following commands; store the 6 bytes of Piggyback Status data into master device Register Memory (%R), Registers 171-173. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00007 (0007) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07200 (1C20) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number
The Slave SNP ID field specifies the SNP ID of the desired slave device. The SNP ID field is 8 bytes long. For Series 9030 and Series 90-70 PLCs, the SNP ID can be a maximum of 7 bytes followed by a null character (0) and can include any ASCII character.
Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: 20051 (4E53) 18768 (4950) 12612 (3144) 00000 (0000) 00008 (0008) 00171 (00AB) Characters 1 and 2 of Slave SNP ID: S (53h), N (4Eh) Characters 3 and 4 of Slave SNP ID: P (50h), I (49h) Characters 5 and 6 of Slave SNP ID: D (44h), 1 (31h) Characters 7 and 8 of Slave SNP ID: null, null Master Memory Type to store Piggyback Status (%R) Master Address to store Piggyback Status (Register 171)
A null SNP ID (Character 1 = 0) can be used to Attach to any slave SNP device regardless of its assigned SNP ID. It should be noted that a null SNP ID can only be successful in a point-topoint wiring configuration. In a multidrop wiring configuration, all SNP slave devices would respond to any Attach specifying a null SNP ID. This procedure will produce unpredictable results and should not be attempted. The Master Memory Type and Address for Piggyback Status fields are optional. If the Piggyback Status memory type and address values are 0 (that is, a Piggyback area is not specified), the Piggyback Status information is ignored and is not provided to the PLC ladder application program. If a Piggyback Status location is specified, an area must be provided which can accommodate the 6 bytes of Piggyback Status information described below. The Piggyback Status information is returned with every SNP response message sent by the slave device. Once the Piggyback Status area is specified, the Piggyback Status information is written there as each successful SNP response message is received, for as long as the connection remains established. See Table 61 for valid memory types and addresses.
GFK-0582D
635
6
Piggyback Status: The table below describes the Piggyback Status information:
Piggyback Status Storage Area
Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6
Description
Byte Location
Word 1 (low byte) Word 1 (high byte) Word 2 (low byte) Word 2 (high byte) Word 3 (low byte) Word 3 (high byte)
Control Program Number Current Privilege Level Last sweep time Last sweep time Slave PLC Status Word Slave PLC Status Word
Control Program Number. This value represents the number of the control program task the SNP master is currently logged into. The valid values in todays implementations are -1 and 0 as follows:
1 0 SNP master is not logged into a control program task. SNP master is logged into control program task 0.
Privilege Level. Current privilege level of the SNP master device. Valid values are 0 through 4 for Series 90-70 PLCs, and 1 through 4 for Series 90-30 PLCs. Last Sweep Time. This value is equal to the time taken by the last complete sweep for the main control program task. The value is in 100 microsecond increments and is measured from Start of Sweep (X1) to Start of Sweep (X). PLC Status Word. The bits in this word are defined in the following table, where bit 0 is the least significant bit, and bit 15 is the most significant bit. Recalling the convention of byte ordering within a word, byte 5 is the least significant byte (containing bits 0 through 7) and byte 6 is the most significant byte (containing bits 8 through 15), as shown below:
Byte 6 Byte 5 Bits 15-8 Bits 7-0
The PLC Status Word bit assignments are described in the following table:
636
GFK-0582D
SNP Service
Description
Bit 1 Bit 2 Bit 3 Bit 4 Oversweep flag; meaningful only when constant sweep mode is active. 1 = Constant Sweep value exceeded. 0 = No oversweep condition exists. Constant Sweep Mode. 1 = Constant Sweep Mode active. 0 = Constant Sweep Mode is not active. PLC Fault Entry since last read. 1 = PLC fault table has changed since last read by this device. 0 = PLC fault table unchanged since last read. I/O Fault Entry since last read. 1 = I/O fault table has changed since last read by this device. 0 = I/O fault table unchanged since last read. PLC Fault Entry Present. 1 = One or more fault entries in PLC fault table. 0 = PLC fault table is empty. I/O Fault Entry Present. 1 = One or more fault entries in I/O fault table. 0 = I/O fault table is empty. Programmer attachment flag. 1 = Programmer attachment found. 0 = No programmer attachment found. Front panel ENABLE/DISABLE switch setting. 1 = Outputs disabled. 0 = Outputs enabled. Front panel RUN/STOP switch setting. 1 = RUN, 0 = STOP OEM protected bit. 1 = OEM protection in effect. 0 = No OEM protection. CP Changed Not used. PLC State: 0 = Run I/O enabled. 1 = Run I/O disabled. 2 = Stop I/O disabled. 3 = CPU stop faulted. 4 = CPU halted. 5 = CPU suspended. 6 = Stop I/O enabled. Bit 5 Bit 6 Bit 7 Bit 8 Bit 9 Bit 10 Bit 11 Bits 12-15
GFK-0582D
637
6
Change Privilege Level: 07201 (1C21)
Available Modes: Master Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a Change Privilege Level request; the slave responds. This service provides the master with the capability of changing its access privilege level at the slave PLC if the proper password is provided. This command is only necessary if the master is not accorded sufficient privileges as a result of the Attach command. Example Command Block: Request privilege level change at attached slave device to level 2. The Slave device password is PASS1.
The Requested Privilege Level field is a value between 0 and 4 for Series 90-70 PLCs, and between 1 and 4 for Series 90-30 or Series 90-20 PLCs. In addition, the privilege level can be set to a value of 1. When the value of 1 is specified, the highest privilege level with the provided password is accorded the requestor. The Password field specifies the password required for access to the desired privilege level. If a password is not entered, set all bytes in this field to null (0).
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00006 (0006) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07201 (1C21) 00002 (0002) 16720 (4150) 21331 (5353) 00049 (0031) 00000 (0000) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number Word 8: Word 9: Word 10: Word 11: Word 12: Requested Privilege Level Password (bytes 1 and 2): P (50h), A (41h) Password (bytes 3 and 4): S (53h), S (53h) Password (bytes 5 and 6): 1 (31h) Password (bytes 7 and 8): null, null
Note
The CMM module requires privilege level 2 at the PLC CPU for correct operation. To avoid incompatibility with existing SNP master implementations, an SNP slave in the CMM module will accept any privilege level and password in a Change Privilege Level request; the CMM slave device will always remain at privilege level 2.
638
GFK-0582D
SNP Service
Meaning
Write to all configuration or logic. Configuration may only be written in STOP mode; logic may be written in STOP or RUN mode. Display, set, or delete passwords for any level. Level 3 Write to any configuration or logic, including word-for-word changes, the addition/deletion of program logic, and the overriding discrete I/O. Level 2 Level 1 Level 0 Write to any data memory, except overriding discrete I/O. The PLC can be started or stopped. PLC and I/O fault tables can be cleared. Read any data memory. Write to memory is prohibited. The PLC cannot be started or stopped. (Series 90-70 PLC only.) Read and Write of PLC system memory is prohibited.
The following table indicates the minimum privilege level required at the slave device to perform each request from the SNP master:
Minimum Privilege Level Series 90-20, Series 90-30, or Series 90 Micro PLCs
1 1 n/a n/a 2 n/a n/a 2 1 1 1 1 1 21 1 1 1 1
Change Privilege Level Read System Memory Read Task Memory Read Program Block Memory Write System Memory Write Task Memory Write Program Block Memory Toggle Force System Memory Return Fault Table
0 1 1 1 2 2 2 2 1 0 1 1 0 2 1 1 1 0
Return Control Program Name Return Controller Type and ID Return PLC Time/Date PLC Short Status Set PLC Time/Date Establish Datagram Update Datagram Cancel Datagram Update Real-Time Datagram
1 For Series 90-30 PLCs with Release 1.x CPU firmware, privilege level 3 is required.
GFK-0582D
639
6
Read System Memory: 07202 (1C22)
Available Modes: Master Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a Read request; the slave responds with the data. This service is provided to permit the access to various reference tables within the slave PLC. (See Table 61 for the slave memory types supported.) This command reads enough data from the slave reference table to fill the specified number of elements in the master reference table. When the access modes of the slave and master reference tables differ, the data will be transferred from the slave reference table beginning with the least significant bit. Example Command Block: Read attached slave device Register Memory (%R), Register 1, and place the 10 least significant bits into master device Input Memory (%I), Inputs 1-10. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00006 (0006) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07202 (1C22) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1(Register 1) Not Used Not Used SNP Command Number
Word 8: Word 9: Word 10: Word 11: Word 12: 00008 (0008) 00001 (0001) 00010 (000A) 00070 (0046) 00001 (0001) Slave Memory Type from which to read data (%R) Slave Memory Address from which to read data (Register 1) Number of Master Memory Type elements to read Master Memory Type to store data (%I) Master Address to store data (Input 1)
The Number of Master Memory Type elements to read field is specified in units consistent with the unit length of the Masters Memory Type. See Table 61 for valid memory types and addresses.
Note
The SNP master on the CMM module, and CPU 351, CPU 352, and CPU363 serial ports limit this command to a total data length of 2048 bytes (1024 words).
640
GFK-0582D
SNP Service
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00006 (0006) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07203 (1C23) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number Word 8: Word 9: Word 10: Word 11: Word 12: 00008 (0008) 00201 (00C9) 00010 (000A) 00070 (0046) 00001 (0001) Slave Memory Type to store data (%R) Slave Address to store data (Register 201) Number of Master Memory Type elements to write Master Memory Type from which to write data (%I) Master Address from which to write data (Input 1) The Number of Master Memory Type elements to write field is specified in units consistent with the unit length of the Master Memory Type. See Table 61 for valid memory types and addresses.
Note
The SNP master on the CMM module, and CPU 351 and CPU 352 serial ports limit this command to a total data length of 2048 bytes (1024 words).
Note
When master and slave memory types do not match, zero fill will take place.
GFK-0582D
641
6
Read Task Memory: 07204 (1C24)
Available Modes: Master (for communication with Series 90-70 slave device only) Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a Read request; the slave responds with the data. This service provides the master with the capability to read the Main Data segment (%P reference table) of the slaves main control program task. Only a Series 90-70 PLC slave device supports this service; a Series 90-20 or Series 90-30 slave device will produce unpredictable results. Example Command Block: Read attached slave device Main Control Program Task Memory (%P), Word 1, and store in master device Input Memory (%I), Inputs 1-10. Slave device Main Program name = _MAIN . Words 12-15 contain the Main Program name of the slave device.
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00009 (0009) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07204 (1C24) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: 00001 (0001) 00010 (000A) 00070 (0046) 00001 (0001) 16717 (414D) 20041 (4E49) 00049 (0031) Slave Task Memory Address (%P1) Number of Master Memory Type elements to read Master Memory Type to store data (%I) Master Address to store data (Input 1) Characters 1 and 2: M (4Dh, A (41h) Characters 3 and 4: I (49h), N (4Eh) Characters 5 and 6: 1 (31h), null 00000 (0000) Characters 7 and 8: null, null
The Number of Master Memory Type elements to read field is specified in units consistent with the unit length of the Master Memory Type. See Table 61 for valid memory types and addresses.
Note
The SNP master on the CMM module, and CPU 351 and CPU 352 serial ports limit this command to a total data length of 2048 bytes (1024 words).
642
GFK-0582D
SNP Service
The Number of Master Memory Type elements to write field is specified in units consistent with the unit length of the Master Memory Type. See Table 61 for valid memory types and addresses.
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00009 (0009) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07205 (1C25) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: 00001 (0001) 00010 (000A) 00070 (0046) 00001 (0001) 16717 (414D) 20041 (4E49) 00049 (0031) Slave Task Memory Address (%P1) Number of Master Memory Type elements to write Master Memory Type to write data from(%I) Master Address to write data from (Input 1) Characters 1 and 2: M (4Dh, A (41h) Characters 3 and 4: I (49h), N (4Eh) Characters 5 and 6: 1 (31h), null 00000 (0000) Characters 7 and 8: null, null
Note
The SNP master on the CMM module, and CPU 351 and CPU 352 serial ports limit this command to a total data length of 2048 bytes (1024 words).
GFK-0582D
643
6
Read Program Block Memory: 07206 (1C26)
Available Modes: Master (for communication with Series 90-70 slave device only) Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a Read request; the slave responds with the data. This service provides the master with the capability to read the Local Subblock Data segment (%L reference table) of a specified Program Block in the slave. Only a Series 90-70 PLC slave device supports this service; a Series 90-20 or Series 90-30 slave device will produce unpredictable results. Example Command Block: Read attached slave device Program Block Memory (%L), Words 1-10, and store to master device Register Memory (%R), Registers 201-210. Slave device Main Program name = _MAIN ; slave device Program Block name = PBLOCK1 . Words 12-15 contain the slave device Main Program name; words 16-19 contain the slave device Program Block name. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00013 (000D) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07206 (1C26) 00001 (0001) 00010 (000A) 00008 (0008) 00201 (00C9) 16717 (414D) 20041 (4E49) 00049 (0031) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number
Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: Word 16: Word 17: Word 18: Word 19: Slave Program Block Address (%L1) Number of Master Memory Type elements to read Master Memory Type to store data (%R) Master Address to store data (Register 201) Characters 1 and 2: M (4Dh, A (41h) Characters 3 and 4: I (49h), N (4Eh) Characters 5 and 6: 1 (31h), null Characters 7 and 8: Characters 1 and 2: Characters 3 and 4: Characters 5 and 6: Characters 7 and 8: null, null P (50h, B (42h) L (4Ch), O (4Fh) C (43h), K (4Bh) 1 (31h), null 00000 (0000) 16976 (4250) 20300 (4F4C) 19267 (4B43) 00049 (0031)
The Number of Master Memory Type elements to read field is specified in units consistent with the unit length of the Master Memory Type. See Table 61 for valid memory types and addresses.
Note
The SNP master on the CMM module, and CPU 351 and CPU 352 serial ports limit this command to a total data length of 2048 bytes (1024 words).
644
GFK-0582D
SNP Service
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00013 (000D) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07207 (1C27) 00001 (0001) 00010 (000A) 00008 (0008) 00201 (00C9) 16717 (414D) 20041 (4E49) 00049 (0031) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: Word 16: Word 17: Word 18: Word 19: Slave Program Block Memory Address (%L1) Number of Master elements to write Master Memory Type to write data from (%R) Master Address to write data from (Register 201) Characters 1 and 2: M (4Dh, A (41h) Characters 3 and 4: I (49h), N (4Eh) Characters 5 and 6: 1 (31h), null Characters 7 and 8: Characters 1 and 2: Characters 3 and 4: Characters 5 and 6: Characters 7 and 8: null, null P (50h, B (42h) L (4Ch), O (4Fh) C (43h), K (4Bh) 1 (31h), null 00000 (0000) 16976 (4250) 20300 (4F4C) 19267 (4B43) 00049 (0031)
The Number of Master Memory Type elements to write field is specified in units consistent with the Unit Length of the Master Memory Type. See Table 61 for valid memory types and addresses.
Note
The SNP master on the CMM module, and CPU 351 and CPU 352 serial ports limit this command to a total data length of 2048 bytes (1024 words).
GFK-0582D Chapter 6 SNP Service 645
6
PLC Short Status: 07208 (1C28)
Available Modes: Master Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a PLC Short Status request; the slave responds with data. This service provides the master with the capability to read the status of the slave PLC. Example Command Block: Read the attached slave device short status and store in master device Register Memory (%R), Register 201.
The Master Memory Type and Address fields must be selected to allow enough room to accommodate the 12 bytes of short status information returned from the slave PLC. The following table describes most of the PLC Short Status information. The short status information includes the 6 bytes of Piggyback Status information carried on each response from the slave device. See Table 61 for valid memory types and addresses. See Table 613 for a detailed description of the Slave PLC Status Word.
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: 00003 (0003) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07208 (1C28) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number 00008 (0008) Master Memory Type to store Status (%R) 00201 (00C9) Master Address to store Status (Register 201)
646
GFK-0582D
SNP Service
Status Storage Area Word Location Byte Location
(low byte) Byte 1
Description
Word 1
Number of Control Programs. 0 = No program tasks currently defined. 1 = One program task defined for the PLC CPU.
(high byte)
Byte 2
Word 2
Byte 3 Byte 4
Programmer Flags. Set of boolean flags indicating which control program tasks have programmers currently attached to them. Each bit position corresponds to a control program task (0 = no programmer attached; 1 = programmer attached), where bit 0 corresponds to control program 0. Since at most one control program is currently allowed, this byte is either zero or one. Login Types. 2-bit codes indicating the type of login associated with each control program. The 2-bit field beginning at bit 0 corresponds to control program 0. Since there can be at most one control program in the current implementation, only bit 0 and bit 1 have meaning. The codes below are for Series 90-70 PLCs Only. 03h = Parallel Work Station Interface (WSI) attached 02h = Serial device attached at PLC CPU 01h = Non-dedicated programmer attached 00h = No programmer attached. Auxiliary Status. Only the highest bit is defined, and only for the Series 90-70. Bit 7 indicates Programmer window status: 0 = Programmer window closed 1 = Programmer window open Not used (00h) Control Program Number Current Privilege Level Last sweep time (in 0.1 msec units) Last sweep time (in 0.1 msec units) PLC Status Word (bits 0-7) PLC Status Word (bits 8-15)
Word 3
(low byte)
Byte 5
Word 4 Word 5
Word 6
(high byte) (low byte) (high byte) (low byte) (high byte) (low byte) (high byte)
GFK-0582D
647
6
Return Control Program Name: 07209 (1C29)
Available Modes: Master Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a Return Control Program Name request; the slave responds with data. Example Command Block: Read the Control Program name from the attached slave device and store in master Register Memory (%R), Registers 201-205. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00004 (0004) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07209 (1C29) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number
The Master Memory Type and Address fields must be selected to allow enough room to accommodate the data returned in the Control Program Area. See Table 61, Memory Types, Unit Lengths, and Valid Ranges, for valid memory types and addresses. The Number of Control Program Names field should always be set to one. When this field is set to one, the size of the Control Program area is equal to five words.
Word 8: Word 9: Word 10: 00008 (0008) Master Memory Type to store Control Program data (%R) 00201 (00C9) Master Address to store Control Program data (Register 201) 00001 (0001) Number of Control Program Names to retrieve (always set to 1)
648
GFK-0582D
SNP Service
The following table describes the format of the Control Program Area returned by the Return Control Program command:
Control Program Area Description
Word 1 Word 2 Word 3 Word 4 Word 5 Number of Control Programs Characters 1 and 2 of Control Program Name 1 Characters 3 and 4 of Control Program Name 1 Characters 5 and 6 of Control Program Name 1 Characters 7 and 8 of Control Program Name 1
The Control Program Name words contain the ASCII name (limited to eight characters) of the control program.
GFK-0582D
649
6
Return Controller Type and ID Information: 07210 (1C2A)
Available Modes: Master Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a Return Controller Type and ID request; the slave responds with data. This service provides the master with the capability to retrieve the SNP ID, PLC Controller Type, number of control programs, program name, etc., from the slave device PLC CPU. Example Command Block: Read the attached slave device Controller Type and ID information and store in master device Register Memory (%R), Registers (201-220).
The Master Memory Type and Address fields must be selected to allow enough room to accommodate the 40-byte Control Information Area. See Table 61, Memory Types, Unit Lengths, and Valid Ranges, for valid memory types and addresses.
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: 00003 (0003) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07210 (1C2A) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number 00008 (0008) Master Memory Type to store Control Information (%R) 00201 (00C9) Master Address to store Control Information (Register 201)
650
GFK-0582D
SNP Service
Control Information Area Description
Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Word 15 Word 16 Word 17 Word 18 Word 19 Word 20 Characters 1 and 2 of SNP ID of PLC CPU Characters 3 and 4 of SNP ID of PLC CPU Characters 5 and 6 of SNP ID of PLC CPU Characters 7 and 8 of SNP ID of PLC CPU Series 90 PLC Major/Minor Type (High byte/Low byte) Number of Control Programs (Low byte only) Characters 1 and 2 of Main Control Program Name Characters 3 and 4 of Main Control Program Name Characters 5 and 6 of Main Control Program Name Characters 7 and 8 of Main Control Program Name Number of Control Program Blocks Total Length of Program Blocks (LSW) Total Length of Program Blocks (MSW) Sum of Program Block Additive Checksums Sum of Program Block CRC Checksums (LSW) Sum of Program Block CRC Checksums (MSW) Length of Configuration Records Sum of Configuration Records Additive Checksums Sum of Configuration Records CRC Checksums (LSW) Sum of Configuration Records CRC Checksums (MSW)
The following table describes the format of the Control Information Area returned by the Return Controller Type and ID command:
Minor Type Codes for Series 9070 CPUs 84 (54h) for CFR782 29 (1Dh) for CFR928 74 (4Ah) for CGR772 36 (24h) for CGR935 31 (1Fh) for CPU731 32 (20h) for CPU732 71 (47h) for CPU771 72 (48h) for CPU772 80 (50h) for CPU780 81 (51h) for CPU781 82 (52h) for CPU782 88 (58h) for CPU788 89 (59h) for CPU789 90 (5Ah) for CPU790 92 (5Ch) for CPU914 15 (0Fh) for CPU915 24 (18h) for CPU924 25 (19h) for CPU925 73 (49h) for CPX772 83 (53h) for CPX782 28 (1Ch) for CPX928 35 (23h) for CPX935
GFK-0582D
651
6
Return PLC Time/Date: 07211 (1C2B)
Available Modes: Master Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a Return PLC Time/Date request; the slave responds with data. This service provides the master with the capability to retrieve the current time and date from the slave device. The Series 90-70 PLC and Series 90-30 PLC Models 331, 340, 341, 351, and 352 support time, date, and day of week. The Series 90-30 PLC Models 311, 313, 323 and Series 90-20 PLC do not support time, date, or day of week. Unsupported return values are meaningless and should not be used. Example Command Block: Read attached slave device PLC Time/Date and store in master device Register Memory (%R), Registers 201-204. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: 00003 (0003) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07211 (1C2B) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used Command Number
PLC Time/Date Area Word Location Byte Location
Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8
The Master Memory Type and Address fields must be selected to allow enough room to accommodate the 8 bytes of data necessary to represent the PLC Time/Date returned from the slave PLC. See Table 61 for valid memory types and addresses. All data are returned in a packed BCD format. The Day of Week field indicates the day of the week, where Sunday = 1 and Saturday = 7. The Time/Date data is returned in the following format:
00008 (0008) Master Memory Type to store PLC Time/Date (%R) 00201 (00C9) Master Address to store PLC Time/Date (Register 201)
Description
Word 1 (low byte) Word 1 (high byte Word 2 (low byte) Word 2 (high byte) Word 3 (low byte) Word 3 (high byte) Word 4 (low byte) Word 4 (high byte)
Year (in BCD) Month (in BCD) Day (in BCD) Hour (in BCD) Minutes (in BCD) Seconds (in BCD) Day of Week (Sunday=1, Saturday=7) Unused
652
GFK-0582D
SNP Service
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00006 (0006) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07212 (1C2C) 00001 (0001) 00001 (0001) 00001 (0001) 00008 (0008) 00201 (0001) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used Command Number Word 8: Word 9: Word 10: Word 11: Word 12: Selected Fault Table (I/O = 1, PLC = 2) Beginning Fault Table Entry (I/O = 1-32, PLC = 1-16) Number of faults entries requested (I/O = 1-32, PLC = 1-16) Master Memory Type to store Fault Table (%R) Master Address to store Fault Table (Register 201) The Master Memory Type and Address fields must be selected to allow enough room to accommodate the 12 bytes of data necessary to represent the table header plus 42 bytes for each fault requested from the slave PLC. This size requirement applies to both I/O and PLC Fault Table retrieval. See Table 61 for valid memory types and addresses. The Fault Table area is returned in the following format:
Read the attached slave device I/O Fault Table, Entry 1 only, and store in master device Register Memory (%R), Registers 201-227.
Fault Table Area Description
Timestamp of last clear
Word 1 (low byte) Word 1 (high byte) Word 2 (low byte) Word 2 (high byte) Word 3 (low byte) Word 3 (high byte)
Word 4 Word 5 Word 6 Word 7-27 ... Word 322-342 ... Word 658-678
(in BCD) (in BCD) (in BCD) (in BCD) (in BCD) (in BCD)
Faults since last clear Faults in the table Faults in this response Fault table entry #1 Fault table entry #16 Fault table entry #32
GFK-0582D
653
6
The format of each I/O Fault Table entry is described in the following table:
I/O Fault Table Area Description
Byte 1 Byte 2-4 Byte 5 Byte 6 Byte 7 Byte 8 Byte 9-10 Byte 11 Byte 12 Byte 13 Byte 14 Byte 15 Spare (unused) Reference address Rack number Slot number I/O Bus number Bus address Point address Fault group Fault action Fault category Fault type Fault description Spare (unused) Byte 16-36
(in BCD) (in BCD) (in BCD) (in BCD) (in BCD) (in BCD)
The format of each PLC Fault Table entry is described in the following table:
PLC Fault Table Area Description
Byte 1-4 Byte 5 Byte 6 Byte 7 Byte 8 Byte 9 Byte 10 Byte 11-12 Byte 13-36 Spare (unused) Rack number Slot number Unit number Spare (unused) Fault group Fault action Fault error code Spare (unused)
(in BCD) (in BCD) (in BCD) (in BCD) (in BCD) (in BCD)
654
GFK-0582D
SNP Service
The Set mode field specifies what parts of the date and time are to be set in the slave device. If time only is selected, the values for date and day of week are not used. If date only is selected, the values for time are not used. If synchronize is selected, the master PLCs system time and date is used in lieu of the time and date fields in the COMMREQ Command Block. The Year, Month, Day of month, Hours, Minutes, Seconds, and Day of week are specified in a packed BCD format. The Hours value is entered in 24-hour format (0-23). The Day of week value specifies day of the week, where Sunday = 1 and Saturday = 7.
Word 9: Word 10: Word 11: Word 12: 00003 (0003) Set mode (time/date=1, time only=2, date only=3, synchronize=4) 00402 (0192) Year (low byte)/month (high byte) 00025 (0019) Day of month (low byte)/hours (high byte) 00000 (0000) Minutes (low byte)/seconds (high byte) 00001 (0001) Day of week (low byte)/0 (high byte)
GFK-0582D
655
6
Toggle Force System Memory: 07214 (1C2E)
Available Modes: Master Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends a Toggle Force System Memory request with data; the slave responds. This service provides the master with the capability to toggle a single status, override, or transition bit in the slave device to the opposite state (that is, from set to reset, or from reset to set). Example Command Block: Toggle the attached slave device Input Memory (%I), Input 1, to the opposite state.
The Slave Memory Type and Address fields specify the reference table bit in the slave device to be toggled. Only bit-oriented memory types are allowed. (See the following table for the memory types supported by this command.)
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: 00003 (0003) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07214 (1C2E) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number 00070 (0046) Slave Memory Type to toggle (%I) 00001 (0001) Slave Address to toggle (Input 1)
656
GFK-0582D
SNP Service
The following table lists the valid slave device Memory Types for the Toggle Force System Memory command:
Description Decimal
70 72 74 76 78 80 82 84
Hexadecimal
%I memory in bit mode, %Q memory in bit mode. %T memory in bit mode. %M memory in bit mode. %SA memory in bit mode. %SB memory in bit mode. %SC memory in bit mode. %S memory in bit mode.
86 150 152 154 156 166 168 170 172 174 176 178 180 182 184
56h 96h 98h 9Ah 9Ch A6h A8h AAh ACh AEh B0h B2h B4h B6h B8h
%G memory in bit mode. %I override table in bit mode.1 %Q override table in bit mode.1 %T override table in bit mode.1 %M override table in bit mode.1 %G override table in bit mode.1 %I transition table in bit mode. %Q transition table in bit mode. %T transition table in bit mode. %M transition table in bit mode. %SA transition table in bit mode. %SB transition table in bit mode. %SC transition table in bit mode. %S transition table in bit mode. %G transition table in bit mode.
Since privilege level 3 cannot be attained in the Series 90 CMM modules, these reference tables cannot be accessed via the CMM.
GFK-0582D
657
6
Establish Datagram: 07215 (1C2F)
Available Modes: Master Description: Remote command. The slave device must be attached before executing this command; see Attach command. The master sends an Establish Datagram request with data; the slave responds with a unique Datagram ID. The master then sends a Write Datagram request with additional data; the slave again responds. This service provides the master with the capability to define a datagram - an area within the slave device to be used to gather a mixed set of reference table data. Once established, the datagram area may be retrieved via the Datagram ID by using an Update Datagram or Update Real-Time Datagram command. Example Command Block: Establish a permanent datagram in the attached Series 90-70 slave device. Place the Datagram ID returned from the slave device into master device Register Memory (%R), Register 161. The slave device Main Program name is not required. Set up the datagram for 2 point formats. Point format 1 contains slave (%R) Registers 201-210, and point format 2 contains slave (%I) Inputs 1-16. Note that the Input memory is accessed in byte-mode to overcome bit-mode restrictions in Series 90-70 PLCs. The total datagram data size for all point formats is thus 10 registers (20 bytes) plus 16 inputs (2 bytes), or 22 bytes. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00017 (0011) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07215 (1C2F) 00000 (0000) 00129 (0081) 00022 (0016) 00008 (0008) 00161 (00A1) 00000 (0000) 00000 (0000) 00000 (0000) 00000 (0000) 00002 (0002) 00008 (0008) 00201 (00C9) 00010 (000A) 00016 (0010) SNP Data Block Length (must include all Point Formats) NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number
Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: Word 16: Word 17: Word 18: Word 19: Word 20: Word 21: Word 22: Word 23: Slave Device Type (90-70=0, 90-30/90-20=1) Datagram Type (Normal=1, Permanent=81H) Size of Datagram area in bytes (22 bytes) Master Memory Type for Datagram ID (%R) Master Address for Datagram ID (Register 161) Characters 1 and 2 of Local Subblk or Main Pgm name: null Characters 3 and 4 of Local Subblk or Main Pgm name: null Characters 5 and 6 of Local Subblk or Main Pgm name: null Characters 7 and 8 of Local Subblk or Main Pgm name: null Number of Point Formats to follow Slave Point format (1) Memory Type (%R) Slave Point format (1) Address (%R201) Slave Point format (1) count (10 registers: %R201-%R210) Slave Point format (2) Memory Type (%I in byte mode) 00001 (0001) Slave Point format (2) Address (byte 1 = %I1) 00002 (0002) Slave Point format (2) count (2 bytes = 16 Inputs: %I1-%I16)
GFK-0582D
658
SNP Service
The Slave Device Type field specifies whether the slave device is in a Series 90-70 or in a Series 90-30/90-20 PLC. Unpredictable operation will result if this value specifies the wrong slave device type. The Datagram Type field designates the datagram to be established as either a normal or permanent datagram. A normal datagram remains established in the slave PLC for the life of the communication (that is, until another SNP Attach or Update Real-Time Datagram service is performed). A permanent datagram remains established in the slave PLC for the life of the PLC (that is, until the datagram is cancelled, power is cycled to the PLC, or the datagrams control program is deleted). The Size of the Datagram area field specifies in bytes the size of the datagram data area. This area represents the combined sizes of all of the data areas specified by the point formats. Each point format defines data whose size depends upon the memory type and element count for that format. For example, a point format specifying 19 bits of the Input Table requires 3 bytes to represent it. Two registers require 4 bytes. The Master Memory Type and Address for Datagram ID fields specify the location in the master PLC memory where this COMMREQ returns the 1-byte Datagram ID. The Datagram ID is obtained from the slave device when the datagram is successfully established. The Datagram ID must be used by the master to identify this datagram in all subsequent commands. See 61 for valid memory types and addresses. If the datagram is designed to access Local Subblock Memory (%L) or Main Program Memory (%P) in a Series 90-70 slave device, the Local Subblk or Main Pgm name field must contain the Main Program name (for %P) or Local Subblock name (for %L) as an ASCII string. Otherwise, this field is set to null (0). Each datagram consists of one or more Point Formats. A Point Format defines a memory range within the slave device. The Number of Point Formats field contains the number of Point Formats being defined. Each Point Format consists of 3 words; the memory type, the memory address, and the count of memory elements to be read. See Table 61, and the Notes below, for memory types and address. The memory element count may range from 1 to 256 only. Examples of Point Formats are shown above in Words 18-20 and in Words 21-23. A 3-word Point Format is required for each Point Format counted in Word 17. A maximum of 32 point formats is allowed in a datagram.
GFK-0582D
659
6
Note
It is strongly recommended that byte-oriented memory types be used in Point Formats instead of bit-oriented memory types.
A Series 90-70 slave device does not permit bit-oriented memory types in a datagram Point Format under any circumstances. Bit-oriented memory types are permitted in datagram Point Formats for a Series 90-30 slave device, with the following restriction: The entire bit-type Point Format must fit within a single aligned byte of memory. A permissible byte of bitoriented memory contains only 8 memory elements (#1 to #8, #9 to #16, ..., #(N*8)+1 to #(N*8)+8, etc.). The Point Format may begin with any element, but it length must not extend beyond the same memory byte as the starting element. For example, a Series 90-30 datagram can contain a 6-bit Point Format containing Inputs %I33 to %I38, but not Inputs %I37 to %I42. The latter Point Format exceeds a single aligned memory byte (%I33 to %I40).
Note
The length of the SNP COMMREQ Data Block varies with the number of Point Formats defined in the Establish Datagram command. The COMMREQ Data Block Length (Word 1 of the COMMREQ) must be equal to (3 * Word 17) + 11.
660
GFK-0582D
SNP Service
The Datagram ID field specifies the particular datagram to retrieve. This value was previously returned to the PLC application program upon successful completion of the Establish Datagram command. The Datagram Type field designates a normal or permanent datagram. This value must match the type specified when the datagram was established. The Master Memory Type and Address fields must be selected to allow enough room to accommodate the datagram area returned from the slave. This area is of the size specified in the Establish Datagram command which defined the size and format of the datagram. See Table 61 for valid memory types and addresses.
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00005 (0005) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07216 (1C30) 00001 (0001) 00129 (0081) 00008 (0008) 00201 (00C9) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number Word 8: Word 9: Word 10: Word 11: Datagram ID Datagram Type (Normal=1, Permanent=81h) Master Memory Type to store Datagram (%R) Master Address to store Datagram (Register 201)
GFK-0582D
661
6
Cancel Datagram: 07217 (1C31)
Available Modes: Master Description: Remote command. The slave device must be attached and a datagram established before executing this command; see Attach and Establish Datagram commands. This service provides the master with the capability to cancel a previously established normal or permanent datagram in the slave device. Example Command Block: Cancel the permanent datagram with Datagram ID=1 in the attached slave device. Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: Word 8: Word 9: 00003 (0003) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07217 (1C31) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number
The Datagram ID field specifies the particular datagram to cancel. This value was returned to the PLC application program upon successful completion of the Establish Datagram command. The special value of -1 specifies that all datagrams of the selected datagram type be cancelled. The Datagram Type field designates a normal or permanent datagram. This value must match the type specified when the datagram was established.
00001 (0001) Datagram ID 00129 (0081) Datagram Type (Normal=1, Permanent=81h)
Note
If the slave device is a CMM311 module (Series 90-30) with both ports configured as SNP slaves, a Cancel Datagram command with the special Datagram ID of 1 will cancel all datagrams of the specified Datagram Type established on both ports. This note does not apply to the CMM711.
662
GFK-0582D
SNP Service
The Datagram ID field specifies the particular permanent datagram to retrieve. This value was previously returned to the PLC application program upon successful completion of the Establish Datagram command. The Slave SNP ID field specifies the SNP ID of the desired slave device. The SNP ID field is 8 bytes long. For a Series 9030 or Series 90-70 PLC slave device, the SNP ID can be a maximum of 7 bytes followed by a null character (0) and can include any ASCII character. (Note that Logicmaster only supports a 6byte SNP ID for a Series 9030.) For a Series 90-20 PLC slave device, the SNP ID is restricted to a maximum of 6 bytes followed by a null character (0).
GFK-0582D Chapter 6 SNP Service
Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: Word 16; Datagram ID Characters 1 and 2 of Slave SNP ID: S (53h), N (4Eh) Characters 3 and 4 of Slave SNP ID: P (50h), I (49h) Characters 5 and 6 of Slave SNP ID: D (44h), 1 (31h) Characters 7 and 8 of Slave SNP ID: null, null Master Memory Type to store Datagram (%R) Master Address to store Datagram (Register 201) 00008 (0008) Master Memory Type to store Piggyback Status (%R) 00171 (00AB) Master Address to store Piggyback Status (Register 171)
663
6
A null SNP ID (Character 1 = 0) can be used to select to any slave SNP device regardless of its assigned SNP ID. It should be noted that a null SNP ID can only be successful in a point-topoint wiring configuration. In a multidrop wiring configuration, all SNP slave devices would respond to any Long Attach specifying a null SNP ID. This procedure will produce unpredictable results and should not be attempted. The Master Memory Type and Address fields must be selected to allow enough room to accommodate the datagram area returned from the slave. This area is of the size specified in the Establish Datagram command which defined the size and format of the datagram. See Table 61, Memory Types, Unit Lengths, and Valid Ranges, for valid memory types and addresses. The Master Memory Type and Address for Piggyback Status fields are optional. If specified, an area must be provided which can accommodate the 6 bytes of Piggyback Status information. The Piggyback Status information is returned with every SNP response message sent by the slave device. Once the Piggyback Status area is specified, the Piggyback Status information is written there as each successful SNP response message is received, for as long as the connection remains established. If the Piggyback Status memory type and address values are 0 (that is, a Piggyback area is not specified), the Piggyback Status information is ignored and is not provided to the PLC ladder application program. (See Table 611 for a description of the Piggyback Status Data area.) See Table 61, Memory Types, Unit Lengths, and Valid Ranges, for valid memory types and addresses.
Note
The Update Real-Time Datagram command may be sent to any slave device, as specified by the slave SNP ID. This command issues a Break sequence, which will cancel any previous Attach or Long Attach command and abort any existing SNP communication. A new Attach or Long Attach command must be issued to re-establish normal SNP communication after all Update Real-Time Datagram commands have been completed.
664
GFK-0582D
SNP Service
GFK-0582D
665
6
Example Command Block: Issue a Long Attach command to a slave device whose SNP ID is SNP ID1. Store the 6 bytes of Piggyback Status data in master device Register memory (%R), Registers 171-173. Disable the T3 timer to eliminate keep alive message traffic. Change the T4 timer to 100 msec. Set all other SNP timers to the default configured values. Set the modem turnaround delay to 10 milliseconds for modem communication, and reduce the maximum SNP message size to 256 bytes for communication in a noisy environment.
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00015 (000F) 00000 (0000) 00008 (0008) 00000 (0000) 00000 (0000) 00000 (0000) 07300 (1C84) SNP Data Block Length NOWAIT Mode Status Word Memory Type (%R) Status Word Address minus 1 (Register 1) Not Used Not Used SNP Command Number
Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: Word 16: Word 17: Word 18: Word 19: Word 20: Word 21: 20051 (4E53) 18768 (4950) 12612 (3144) 00000 (0000) 00008 (0008) 00171 (00AB) 00005 (0005) 02000 (07D0) 00000 (0000) 00100 (0064) 00000 (0000) 00010 (000A) 00000 (0000) 00256 (0100) Characters 1 and 2 of Slave SNP ID: S (53h), N (4Eh) Characters 3 and 4 of Slave SNP ID: P (50h), I (49h) Characters 5 and 6 of Slave SNP ID: D (44h), 1 (31h) Characters 7 and 8 of Slave SNP ID: null, null Master Memory Type to store Piggyback Status (%R) Master Address to store Piggyback Status (Register 171) T1 (5 msec; default = 5 msec) T2 (0 = disabled) (2 sec; default = 2 sec) T3 (0 = disabled; default = 10 sec) T4 (100 msec; default = 50 msec) T5 (0 = disabled; default = disabled) Modem Turnaround Delay (10 msec; default = 0 msec) Transmission Time Delay (0 msec; default = 0 msec) Maximum SNP Data Size (256 bytes; default = 1000 bytes)
The Slave SNP ID field specifies the SNP ID of the desired slave device. The SNP ID field is 8 bytes long. For a Series 9030 or Series 90-70 PLC slave device, the SNP ID can be a maximum of 7 bytes followed by a null character (0) and can include any ASCII character. For a Series 90-20 PLC slave device, the SNP ID is restricted to a maximum of 6 bytes followed by a null character (0); the 6 bytes must be the ASCII characters 0 through 9 inclusive and upper case A through F inclusive. A null SNP ID (Character 1 = 0) can be used to Attach to any slave SNP device regardless of its assigned SNP ID. It should be noted that a null SNP ID can only be successful in a point-topoint wiring configuration. In a multidrop wiring configuration, all SNP slave devices would respond to any Long Attach specifying a null SNP ID. This procedure will produce unpredictable results and should not be attempted.
666
GFK-0582D
SNP Service
The Master Memory Type and Address for Piggyback Status fields are optional. If specified, an area must be provided which can accommodate the 6 bytes of Piggyback Status information. The Piggyback Status information is returned with every SNP response message sent by the slave device. Once the Piggyback Status area is specified, the Piggyback Status information is written there as each successful SNP response message is received, for as long as the connection remains established. If the Piggyback Status memory type and address values are 0 (that is, a Piggyback area is not specified), the Piggyback Status information is ignored and is not provided to the PLC ladder application program. (See Table 611 for a description of the Piggyback Status Data area.) See Table 61 for valid memory types and addresses. The T1, T2, T3 , T4, and T5 fields specify the new values of the various SNP timers. All SNP timer values are specified in milliseconds. The T1, T2, and T3 timer values will be negotiated between the master and slave devices. (See Chapter 7, Protocol Definition, Section 3, SNP Protocol for an explanation of the SNP timers and their usage.) In this COMMREQ, specifying the value of 0 for any timer disables the timer. When a modem is being used, the T4 timer should be set to 600 msec or greater to allow the Break to be transmitted correctly. The Modem Turnaround Delay field specifies the duration of time required by the modem to turn the communication link around. The duration is specified in milliseconds and the default value is 0. The Transmission Delay Time field specifies a time period in seconds to account for unusually long delays in transmission between SNP devices. Unusually long delays are typical of communications via satellite. This value is specified in seconds and the default value is 0. The Maximum SNP Data Size field provides the ability to reduce the size of SNP data messages transmitted over the wire. Communications in noisy environments may require a smaller message size to minimize transmission errors. This value must fall in the range of 42 to 1000 bytes and be an even number of bytes. The default value is 1000.
GFK-0582D
667
6
Autodial Command: 07400 (1CE8)
Available Modes: Master Description: Local command. This command allows a string of data to be output to an external telephone modem attached to the serial port; this provides the ability to autodial the attached modem by issuing modem commands. The modem command strings follow the Hayes convention. Modem command strings are not part of the SNP protocol. Upon issuing the Autodial command, an Escape sequence is transmitted to the attached modem. The Escape sequence assures that the modem is returned to the command state. The Escape sequence consists of 2 seconds of silence followed by 3 plus (+) characters followed by another 2 seconds of silence. The modem command string specified in the Autodial COMMREQ will then be transmitted immediately following the Escape sequence. The format of the modem command string is dependent on the attached modem and the desired operation. Once the phone connection has been established, it is the responsibility of the PLC application program to hang up the phone connection. This is accomplished by reissuing the Autodial command and sending the appropriate hang up command string. Each modem command string must end with the ASCII carriage return character (0Dh) for proper recognition by the modem. This character must be included in the command string data and length. The SNP Data Block Length must include the entire modem command string. The Data Block Length will vary with the size of the modem command string. The COMMREQ Data Block Length (Word 1 of the COMMREQ) must be equal to ((Word 9 + 1) / 2) + 3. Command Block Example: Dial the number 234-5678. The modem command string used is ATDT2345678<CR> . The maximum modem response time is 30 seconds. (The modem response will be checked.) The modem command string data begins at Word 10.
Word 1: Word 2: Word 3: Word 4: Word 5: Word 6: Word 7: 00009 (0009) SNP Data Block Length (includes command string) 00000 (0000) NOWAIT Mode 00008 (0008) Status Word Memory Type (%R) 00000 (0000) Status Word Address minus 1 (Register 1) 00000 (0000) Not Used 00000 (0000) Not Used 07400 (1CE8) SNP Command Number 00030 (001E) 00012 (000C) 21569 (5441) 21572 (5444) 13106 (3332) 13620 (3534) 14134 (3736) Modem Response Timeout (30 seconds) Number of bytes in command string A (41h), T (54h) D (44h), T (54h) 2 (32h), 3 (33h) 4 (34h), 5 (35h) 6 (36h), 7 (37h) Word 8: Word 9: Word 10: Word 11: Word 12: Word 13: Word 14: Word 15: 03384 (0D38) 8 (38h), <CR>(0Dh)
668
GFK-0582D
SNP Service
The Modem Response Timeout field specifies the maximum time interval that the COMMREQ will wait for the entire response string from the modem after the modem command has been sent. The time interval is specified in seconds. If the modem response timeout value is zero, modem response checking is disabled; the COMMREQ completes as soon as the command string is sent to the modem. If the modem response timeout value is non-zero, modem response checking is enabled; the COMMREQ waits for the modem response. When the modem response is received, it is checked for successful completion of the modem command; if the response is not received within this time interval, an error code is generated. The Number of bytes in command string field specifies the length of the command string to send to the modem. This length includes all characters, including any spaces, and must include the terminating ASCII carriage return character <CR>. The modem command string can be from 1 to 250 bytes in length. Examples of commonly used modem command strings issued to a Hayes-compatible modem are provided below: Command String Length
(10h) (10h) (12h) (05h) (04h)
Function
ATDP15035559999<CR> ATDT15035559999<CR> ATDT9,15035559999<CR> ATH0<CR> ATZ<CR> 16 16 18 5 4 Pulse dial the number 1-(503) 555-9999 Tone dial the number 1-(503) 555-9999 Tone dial using outside line with pause Hang up the phone Restore modem configuration to internally-saved values.
GFK-0582D
669
Chapter
This chapter is divided into the following sections: D D D D Section 1: CCM Protocol Section 2: RTU Protocol Section 3: SNP Protocol Section 4: SNP-X Protocol
GFK-0582D
71
This section contains a complete description of the CCM protocol for users writing a CCM serial communications driver. Topics covered include protocol flow for peer-to-peer and masterslave mode and protocol timing and retry specifications. State tables are provided at the end of the section to clearly define what occurs throughout the protocol exchange for peer and masterslave modes. Separate tables are provided for the CCM Peer, CCM Master and CCM Slave. The CCM Protocol transfers data using the asynchronous serial data format. For background information on serial data transmission and the asynchronous format, refer to Appendix E. The Serial Line Interface. The following topics are covered in this section: D D D D D Overview of CCM Protocol CCM Peer-to-Peer Mode Description CCM Master-Slave Mode Description Protocol Timing and Retry Specifications CCM Protocol State Tables
Modes of Operation
The CCM Protocol has two modes of operation: Peer-to-Peer and Master-Slave. Peer-to-peer mode is a point-to-point configuration where only two devices share a single communication line. Either device on the line may initiate communications. The initiating device is called the source and the responding device is called the target. Master-slave mode is used in a multidrop configuration with one master and one or more slaves. Only the master can initiate communications.
72
GFK-0582D
Meaning
ENQ ACK NAK SOH ETB STX ETX EOT 05 06 15 01 17 02 03 04 Enquire Acknowledge Negative Acknowledge Start of Header End of Block Start of Text End of Text End of Transmission
This section provides an overview of the message exchange that takes place using the CCM Protocol. The message flow is the same for both master-slave and peer-to-peer mode; however, the characters transferred during the ENQ sequence are slightly different. These differences will be detailed later in this section. Enquiry Sequence. The enquiry sequence is a request to initiate communications, and is sent from a master or peer device. If the target device is not busy, it sends a positive acknowledge (ACK). If it is busy, it sends a negative acknowledge (NAK). Header Transfer. After receiving a positive acknowledge to the enquire sequence, the initiating device sends a 17-character message called the header. The header block specifies direction, memory type and address, and length of data transfer. All bytes in the header, except for the CCM control characters, are in ASCII-coded hexadecimal format. If the header is correct, the target station will respond with a positive acknowledge (ACK). If the header is incorrect, the target will respond with a negative acknowledge (NAK). The header format and descriptions of the fields within the header are shown below:
S O H 1 Target ID Data Flow Dir & Tgt Mem 4 Target Memory Type 5 Target Memory Address MSB 6 7 Target Memory Address LSB 8 9 No. of Complete Data Blocks 10 11 No of Bytes in Last Block 12 13 Source ID E T B 16 L R C 17
2 3
14 15
GFK-0582D
73
7
Table 7-2. Header Block Description
Field Byte
Description Valid Range
SOH Target ID 1 2,3 Data Flow Direction/ Target Memory Type 4,5 Target Memory Address 6-9 Complete Data Block Count 10,11 Last Block Byte Count 12,13 Source ID ETB LRC 14,15 16 17 Start of Header control character Identification number of the target device. Value is represented as ASCII coded hexadecimal. In peer-to-peer mode, a value of FFh (255 decimal) is recognized accepted by any device. Bytes 4 and 5 supply target memory type. Byte 4 also specifies data direction (read or write). Value is represented as ASCII coded hexadecimal. This field specifies the starting address for the data transfer. Value is represented as ASCII coded hexadecimal. The number of complete (256 byte) data blocks to be transferred. Value is represented as ASCII coded hexadecimal. The number of bytes (less than 256 bytes) in the final or only data block. Value is represented as ASCII coded hexadecimal. Identification number of source device. Value is represented as ASCII coded hexadecimal. 01h 1-255 decimal (peer-peer) 1-90 decimal (master-slave) Will vary depending on target device. See Table 33. Will vary depending on target device. See Table 13. 0-255 decimal 0-255 decimal 1-255 decimal (peer-peer) 1-90 decimal (master-slave) End of Block control character 17h Longitudinal Redundancy Check. This is an n/a Exclusive Or (XOR) of bytes 2 through 15.
33
44
41
74
GFK-0582D
(ASCII) Rd/Wr
0/8 0/8 0/8 0/8 0/8 0/8 0/8 0/8 0/8 0/8 8 8 8 9 9 9 9 9 9 9
(ASCII) Rd/Wr
0 1 2 3 4 5 6 7 8 9 D E F 0 1 2 3 4 5 6 CPU Absolute Memory Address CPU Register Table 1 CPU Input Table 1 CPU Output Table 1 CPU Input Override Table CPU Output Override Table CPU Scratchpad 1 CPU User Logic CCM Quick Access Buffer CCM Diagnostic Status Words 1 Input Table Bit Set 1 Output Table Bit Set 1 Input Override Table Bit Set Output Override Table Bit Set Input Table Bit Clear 1 Output Table Bit Clear 1 Input Override Table Bit Clear Output Override Table Bit Clear Input Table Bit Toggle Output Table Bit Toggle
Valid memory types when referencing Series 90 PLCs. Bit functions can only be write requests.
GFK-0582D
75
7
CCM Header Example. In the following example, the source device (ID = 02) reads 10 registers beginning at Register %R00986 from the target device ID = 01.
Field
Binary
0000 0001 0011 0000 0011 0001 0011 0000 0011 0001 0000 0000 0011 0011 0100 0100 0100 0001 0011 0000 0011 0000 0011 0001 0011 0100 0011 0000 0011 0010 0001 0111 0000 0001 01 30 31 30 31 30 33 44 41 30 30 31 34 30 32 17 01
Hex
0 1 0 1 0 3 D A 0 0 1 4 0 2
ASCII
SOH
ETB -
* The LRC value is the vertical XOR (Exclusive OR) result of bytes 2 - 15. Any like numbers cancel each other to zero. Data Transfer. After receiving a positive acknowledge (ACK) to the header sequence, data transfer will start. Data will be written to or read from the responder, depending on the data direction bit specified in the header. If data byte size is less than or equal to 256 bytes, data transfer will require only one data block. If the data byte size is greater than 256 bytes, the transfer will require multiple blocks. The data block format and a description of the fields are shown below:
S T X 256 Data Bytes E T B L R C
S T X
E T X
L R C
Table 7-5. Data Block Description
Field
STX Data ETB/ ETX LRC
Description
Valid Range
Start of Text control character 1-256 data characters. End of Block control character used if data block is not last block. End of Text Block control character used if final data block. Longitudinal Redundancy Check on all data characters in block.
Protocol Termination. After the final data block is transferred successfully, an EOT control character is used to terminate the connection between peer devices or between master and slave. In both peer-to-peer and master-slave modes, the station transmitting the final data block sends the EOT after receiving the ACK to the final data block. In addition, in master-slave mode, the master always sends an EOT to terminate a transaction. The EOT control character is also used to abort a connection if any portion of the CCM Protocol cannot be completed successfully.
E N Q
S O Header H
E L T R B C
S T X
E L T R B C
S T X
E L T R X C
E O T
A C K
A C K
A C K
A C K
E N Q
S O Header H
E L T R B C
A C K S T X E L T R X C E O T
A C K
A C K
S T X
E L T R B C
The illustration below shows the sequence for setting the back-off time by comparing the bits of the device IDs:
Device 1 (ID=7) 8 ID Bits 1 8 0 0 0 0 0 0 1 1 1 Device 2 (ID=3) ID Bits 1 0 0 0 0 0 1 1 Bits compared after 1st collision Bits compared after 2nd collision Bits compared after 3rd collision
ID Bit = 1 (Time in milliseconds)
300 600 1200 2400 4800 9600 19200 300 140 80 80 80 80 80 440 220 120 120 120 120 120
N 1
Response
N 1
Target Address 2
A C K 3 N A K 3
N 1
Target Address 2
Table 7-7. Enquiry Description (Master-Slave, Normal Sequence)
Field Byte Description
1 2 3 3 ASCII coded N used to specify Normal-Sequence operation. ID number of target slave + 20h. Example: Slave ID is 37h. 37h+20h=57h=W Third character of 3-character enquiry sequence. Response from slave indicating positive or negative acknowledge.
Valid Range
4Eh
GFK-0582D
79
7
The first figure below shows a data transfer from the master to the slave (data write). The next figure shows a data transfer from the slave to the master (data read).
Data sent from source device (master) Data sent from target device (slave)
Tgt E N Add N Q
S O H
Header
E L T R B C
S T X
S T X
E L T R X C
E O T
Tgt E N Add N Q
A C K
A C K
Figure 7-6. Data Transfer from Master to Slave (Write, Master-Slave Normal Sequence)
Data sent from source device (master) Data sent from target device (slave)
Tgt E N Add N Q
S E L O Header T R H B C
A C K
E O T
Tgt A N Add C K
E O T
Figure 7-7. Data Transfer from Slave to Master (Read, Master-Slave Normal Sequence)
Data sent from source device (master) Data sent from target device (slave)
Tgt E Q Add N Q Tgt Data Data Data Data L A Q Add Byte Byte Byte Byte R C 1 2 3 4 C K
The following tables describe the individual fields in the communication blocks:
Valid Range
Valid Range
3-6 7 8
ACK
06h
The CCM Protocol defines a set of time ranges and retry ranges for various portions of the protocol exchange. Default values have been defined for the protocol. Some devices, like the Series Six CCM and the Series 90-70 CMM, have added capabilities to modify the default values. If the default values are to be modified, it is important that the values match for both the source and target devices.
GFK-0582D
711
Table 7-10. Timeouts for CCM Protocol
Description Timer Name None
0 0
Short
Medium
400 400
Long (Default)
800 800
ENQ_ACK_TIMER
SOH_TIMER HEADER_TIMER
Wait on ACK/NAK to master ENQ Wait on ACK/NAK to 1st peer ENQ Wait on ACK/NAK to retransmitted peer ENQ 1 300 600 1200 . . 19200 Wait on SOH Wait on End of Header 300 600 1200 . . 19200 Wait on ACK to Header Wait on STX Wait on End of Data Block 300 600 1200 . . 19200 Wait on ACK to Data Block Wait on EOT Delay Slave ACK to master ENQ Wait for CTS signal
50 50
0 0 0
0 0 0 0 0
0 0 0 0 0 0
670 50 50
0 8340 8340 8340 0 50 10000 20000 0 50 400 800 10 milliseconds + 4 character times 2 seconds
The following table defines 4 character times for each data rate selection:
Data Rate
300 600 1200 2400 4800 9600 19200
4 Character Times
147 milliseconds 74 milliseconds 37 milliseconds 19 milliseconds 10 milliseconds 5 milliseconds 3 milliseconds
1.
Value depends upon backoff algorithm detection of bit in CPU ID. (for example, at 19200 bps, a 0-bit waits 80 milliseconds; a 1-bit waits 120 milliseconds.)
712
GFK-0582D
CCM Retries
The CCM Protocol provides a retry mechanism for different parts of the protocol exchange. This mechanism allows one side to retransmit ENQ sequences, headers or data blocks if they were previously NAKed. The retry mechanism may not be used if an EOT is received for any portion of the protocol exchange. The table below lists the default retry values for each portion of the protocol exchange:
Table 7-11. Retry Values for CCM Protocol
Retry Counter Names Description Normal
32 3 3 3
Short
3 1 1 1
(Default)
Peer-to-peer or master-slave ENQ Retry Count Q-Sequence Retry Header Retry Count Data Block Retry
The following state tables illustrate the CCM Protocol for peer, master, and slave devices. Pseudo-code describes the actions to be performed while in a particular state. Separate state tables and actions are provided for peer, master, and slave implementations. The timer and counter names used in the pseudo-code match the timer and counter names listed in the Timeout and Retry Value tables presented above.
GFK-0582D
713
7
CCM Peer State Table
State/ Event Idle
Wait for ACK to ENQ (2) Wait for SOH (3) Wait for Header (4) _ Wait for ACK to Header (5) _ Wait for ACK to Data (6) _ Wait for STX (7) Wait for Data (8) _ Wait for EOT (9) Wait for Q-RSP (10) _ ENQCollision (11) (1) Receive ENQ COMM REQ Receive PLC Data Receive ACK Send ACK State (3) A Send ENQ State (2) C _ State (11) B _ Send EOT State (1) K _ _ _ _ Send EOT State (1) K _ _ Send EOT State (1) K _ _ Send ACK State (3) A _ _ _ _ _ _ Receive NAK _ Send Header State (5) E State (1/2) H State (1) L Send EOT State (1) K _ Receive EOT Receive SOH _ Send EOT State (1) K Send EOT State (1) K State (1) L State (4) Q _ _ State (6/7) F State (1/5) Send data State (6) D State (1/6) G State (1/6) _ _ _ _ _ _ _ I State (1) L Send EOT State (1) K _ J State (1) L Send EOT State (1) K _ Send EOT State (1) K Send EOT State (1) K State (1) L Send EOT State (1) K _ _ _ _ Send EOT State (1) K Send EOT State (1) K State (1) L Send EOT State (1) K _ _ _ Send Header State (5) E State (1/11) _ H State (1) _ _ _ _ Receive Good Header Receive STX _ _ Receive Character Receive Good Data _ _ Send EOT State (1) K Send EOT State (1) K _ Send EOT State (1) K Send EOT State (1) K _ Send ACK State(6/7) M _ _ _ L Send EOT State (1) K _ _ _ Send EOT State (1) K Send EOT State (1) K _ Send EOT State (1) K Send EOT State (1) K _ State (8) R _ Send EOT State (1) K _ _ Receive Bad Data/ Header Receive Good Q-ENQ Timeout _ _ Send EOT State (1) K _ Send EOT State (1) K _ State (1/3) O _ Send EOT State (1) K _ Send EOT State (1) K _ Send EOT State (1) K _ Send ACK State(7/9) N State (1/7) P _ Send EOT State (1) K Send EOT State (1) K _ _ _ _ Send EOT State (1) K Send EOT State (1) K _ Send EOT State (1) K _ _ _ Send EOT State (1) K _ _ State (1/2) H Send EOT State (1) K Send EOT State (1) K Send EOT State (1) K Send EOT State (1) K Send EOT State (1) K Send EOT State (1) K Send EOT State (1) K _ State (1/2) H
714
GFK-0582D
J If DATA _BLK_COUNT <= 3 { Increment DATA_BLK_COUNT Send data block Start DATA_ACK_TIMER Remain in State (6) } Else { Send EOT Transition to State (1) } K Send EOT Transition to State (1) L Transition to State (1) M Send ACK If read data { Start STX_TIMER Transition to State (7) } Else write data { Get PLC Data Send Data Block Start DATA_ACK_TIMER Transition to State (6) }
GFK-0582D
715
7
CCM Master State Table
State/ Event Idle
Wait for ACK to ENQ (2) _ Wait for SOH (3) _ Wait for Header (4) _ Wait for ACK to Header (5) _ Wait for ACK to Data (6) _ Wait for STX (7) _ Wait for Data Wait for EOT (9) _ Wait for Q-RSP (10) _ ENQCollision (11) _ (1) _ (8) _ Receive ENQ COMM REQ Receive PLC Data Receive ACK Send ENQ State(2/10) A _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Receive NAK _ Send Header State (5) C State (1/2) F Send EOT State (1) I Send EOT State (1) I _ _ _ State (6/7) D State (1/5) Send data State (6) B State (1/6) E State (1/6) _ _ _ _ _ _ _ Receive EOT _ _ _ Receive SOH _ _ _ Receive Good Header Receive STX _ _ _ G Send EOT State (1) I Send EOT State (1) I _ H Send EOT State (1) I Send EOT State (1) I _ Send EOT State (1) I Send EOT State (1) I Send EOT State (1) I Send EOT State (1) I _ _ _ _ _ _ Send EOT State (1) I Send EOT State (1) I Send EOT State (1) I Send EOT State (1) I _ _ _ _ _ _ _ _ _ _ _ _ Receive Character Receive Good Data _ _ Send EOT State (1) I Send EOT State (1) I _ _ _ _ _ _ _ Send EOT State (1) I Send EOT State (1) I _ Send EOT State (1) I Send EOT State (1) I _ State (8) N _ Send EOT State (1) I _ _ Receive Bad Data/ Header Receive Good Q-ENQ Timeout _ _ Send EOT State (1) I _ _ _ _ _ Send EOT State (1) I _ Send EOT State (1) I _ Send EOT State (1) I _ Send ACK State(7/9) K State (1/7) L _ Send EOT State (1) I Send EOT State (1) I _ _ _ _ _ State (1) J _ Send EOT State (1) I _ State (1/10) M _ _ _ _ State (1/2) F _ _ Send EOT State (1) I Send EOT State (1) I Send EOT State (1) I Send EOT State (1) I Send EOT State (1) I State (1/10) M _
716
GFK-0582D
J Transition to State (1) K Send Data to PLC Send ACK to Data Block If last_block { Start EOT_TIMER Transition to State (9) } Else { Start STX_TIMER Transition to State (7) }
GFK-0582D
717
7
CCM Slave State Table
State/ Event Idle Wait for ACK to ENQ (2) _ Wait for SOH (3) Wait for Header Wait for ACK to Header (5) _ Wait for ACK to Data (6) _ Wait for STX (7) Wait forData Wait for EOT (9) Wait for Q-RSP (10) _ ENQCollision (11) _ (1) (4) _ (8) _ Receive ENQ Send ACK State (3) A _ _ Send EOT State (1) E _ _ Send EOT State (1) E _ _ Send EOT State (1) E _ _ COMM REQ Receive PLC Data Receive ACK _ _ _ _ _ _ _ _ _ _ _ _ _ Send data State (6) B State (1/6) C _ _ Send EOT State (1) E Send EOT State (1) E State (1) F State (4) L _ _ _ Send EOT State (1) E Send EOT State (1) E State (1) F Send EOT State (1) E _ _ Send EOT State (1) E Send EOT State (1) E _ _ Receive NAK _ _ _ _ State (1/6) D _ _ _ Receive EOT Receive SOH _ _ _ _ _ _ _ _ State (1) F Send EOT State (1) E _ _ _ State (1) F _ _ _ _ Send EOT State (1) E _ Receive Good Header Receive STX _ _ Send ACK State(6/7) G _ _ _ _ _ _ _ Send EOT State (1) E Send EOT State (1) E _ _ Send EOT State (1) E Send EOT State (1) E _ State (8) M _ Send EOT State (1) E Send EOT State (1) E _ _ _ Receive Character Receive Good Data Receive Bad Data/ Header _ _ _ _ Send EOT State (1) E _ _ _ _ _ _ _ _ Send ACK State(7/9) H State (1/7) J _ _ _ _ Send EOT State (1) E _ State (1/3) I _ Send EOT State (1) E _ Send EOT State (1) E _ Send EOT State (1) E _ _ _ Receive Good Q-ENQ Timeout Send Q-RSP State (1) K _ _ _ _ _ _ _ _ Send EOT State (1) E Send EOT State (1) E _ Send EOT State (1) E Send EOT State (1) E Send EOT State (1) E Send EOT State (1) E _ _
718
GFK-0582D
J If DATA_BLK_COUNT <= 3 { Increment DATA_BLK_COUNT Send NAK to bad block Start STX_TIMER Transition to State (7) } Else { Send EOT Transition to State (1) }
GFK-0582D
719
This section describes the Remote Terminal Unit (RTU) serial communications protocol.
Introduction
Since the Series 90 CPUs and CMM modules discussed in this manual can only serve as RTU slave devices, this section discusses the slave implementation of the RTU protocol. RTU protocol is a query-response protocol used for communication between the RTU device and a host computer which is capable of communicating using RTU protocol. The host computer is the master device and it transmits a query to a RTU slave which responds to the master. The RTU device, as an RTU slave, cannot query; it can only respond to the master. The RTU data transferred consists of 8-bit binary characters with an optional parity bit. No control characters are added to the data block; however, an error check (Cyclic Redundancy Check) is included as the final field of each query and response to ensure accurate transmission of data.
Message Format
The general formats for RTU message transfers are shown below:
Slave Turn-around Time aGGGGGGGG' Master Slave Query Transaction Query Message Response
Master Slave
720
GFK-0582D
A distinction is made between two communicating devices. The device which initiates a data transfer is called the master and the other device is called the slave. The Series 90 Serial Communications Modules (CMM), Series 90 Micro PLCs, and CPUs 351, 352, and 363 can only serve as RTU slaves (see Chapter 3 to determine which versions of these products support RTU protocol). The master device begins a data transfer by sending a query or broadcast request message. A slave completes that data transfer by sending a response message if the master sent a query message addressed to it. No response message is sent when the master sends a broadcast request. The time between the end of a query and the beginning of the response to that query is called the slave turn-around time. The turnaround time illustrated above will vary depending on the query, the activity on the other port, and the activity of the PLC application program. A value of 500 ms can be used as a reasonable worst-case estimate.
Message Types
The RTU protocol has four message types: query, normal response, error response, and broadcast.
Query
The master sends a message addressed to a single slave.
Normal Response
After the slave performs the function requested by the query, it sends back a normal response for that function. This indicates that the request was successful.
Error Response
The slave receives the query, but for some reason it cannot perform the requested function. The slave sends back an error response which indicates the reason the request could not be processed. (No error message will be sent for certain types of errors. For more information see section, Communication Errors).
Broadcast
The master sends a message addressed to all of the slaves by using address 0. All slaves that receive the broadcast message perform the requested function. This transaction is ended by a time-out within the master.
GFK-0582D
721
Message Fields
The message fields for a typical message are shown in the figure below, and are explained in the following sections.
aGGGGGGGGGGGGGGGGGGGGG FRAME GGGGGGGGGGGGGGGGGGGGG'
Station Address
Function Code
Information
Error Check
Station Address
The station address is the address of the slave station selected for this data transfer. It is one byte in length and has a value from 0 to 247 inclusive. An address of 0 selects all slave stations, and indicates that this is a broadcast message. An address from 1 to 247 selects a slave station with that station address.
Function Code
The function code identifies the command being issued to the station. It is one byte in length and is defined for the values 0 to 255 as follows:
Function Code 0 1 2 3 4 5 6 7 8 9-14 15 16 17 18-66 67 68-127 128-255 Illegal Function Read Output Table Read Input Table Read Registers Read Analog Input Force Single Output Preset Single Register Read Exception Status Loopback Maintenance Unsupported Function Force Multiple Outputs Preset Multiple Registers Report Device Type Unsupported Function Read Scratch Pad Memory Unsupported Function Reserved for Exception Responses Description
722
GFK-0582D
Information Fields
All message fields, other than the Station Address field, Function Code field, and Error Check field are called, generically, information fields. Information fields contain the additional information required to specify or respond to a requested function. Different types of messages have different types or numbers of information fields. (Details on information fields for each message type and function code are found in the section, Message Descriptions.) Some messages (Message 07 Query, and Message 17 Query) do not have information fields. Examples As shown in the following figure, the information fields for message READ OUTPUT TABLE (01) Query consist of the Starting Point No. field and Number of Points field. The information fields for message READ OUTPUT TABLE (01) Response consist of the Byte Count field and Data field.
MESSAGE (01) READ OUTPUT TABLE Information Fields
Address
Func 01
Number of Points Hi Lo
Error Check
Information Fields
Address
Func 01
Byte Count
Data
Error Check
Normal Response
Starting Point No. field = %Q0007, so the starting address is %Q0008 Number of Points field = 16 (0010h), so addresses %Q0008 through %Q0023 will be read
723
Message Length
Message length varies with the type of message and amount of data to be sent. Information for determining message length for individual messages is found in the section Message Descriptions later in this chapter.
Character Format
A message is sent as a series of characters. Each byte in a message is transmitted as a character. The illustration below shows the character format. A character consists of a start bit (0), eight data bits, an optional parity bit, and one stop bit (1). Between characters the line is held in the 1 state. MSB 10 Stop 9 Parity (optional) 8 7 6 5 Data Bits 4 3 2 1 LSB 0 Start
Message Termination
Each station monitors the time between characters. When a period of three character times elapses without the reception of a character, the end of a message is assumed. The reception of the next character is assumed to be the beginning of a new message. The end of a frame occurs when the first of the following two events occurs: D D The number of characters received for the frame is equal to the calculated length of the frame. A length of 3 character times elapses without the reception of a character.
Timeout Usage
Timeouts are used on the serial link for error detection, error recovery, and to prevent the missing of the end of messages and message sequences. Note that although the module allows up to three character transmission times between each character in a message that it receives, there is no more than half a character time between each character in a message that the module transmits. After sending a query message, the master should wait approximately 500 milliseconds before assuming that the slave did not respond to its request.
724 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
A generating polynomial is expressed algebraically as a string of terms in powers of X such as X3 + X2 + X0 (or 1) which can in turn be expressed as the binary number 1101. A generating polynomial could be any length and contain any pattern of 1s and 0s as long as both the transmitter and receiver use the same value. For optimum error detection, however, certain standard generating polynomials have been developed. RTU protocol uses the polynomial X16 + X15 + X2 + 1 which in binary is 1 1000 0000 0000 0101. The CRC this polynomial generates is known as CRC-16. The discussion above can be implemented in hardware or software. One hardware implementation involves constructing a multi-section shift register based on the generating polynomial.
a40473
x2 CRC REGISTER 15 14 + 13 12 11 10 9 8 7 6 5 4 3 2 1
x15
x16
= EXCLUSIVE OR
DATA INPUT
GFK-0582D
725
7
To generate the CRC, the message data bits are fed to the shift register one at a time. The CRC register contains a preset value. As each data bit is presented to the shift register, the bits are shifted to the right. The LSB is XORed with the data bit and the result is: XORed with the old contents of bit 1 (the result placed in bit 0), XORed with the old contents of bit 14 (and the result placed in bit 13), and finally, it is shifted into bit 15. This process is repeated until all data bits in a message have been processed. Software implementation of the CRC-16 is explained in the next section.
When the message is transmitted, the receiver will perform the same CRC operation on all the data bits and the transmitted CRC. If the information is received correctly the resulting remainder (receiver CRC) will be 0.
Function
07
CRC-16
In this example we are querying device number 1 (address 01). We need to know the amount of data to be transmitted and this information can be found for every message type in the section, Calculating the Length of Frame. For this message the data length is 2 bytes.
726 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
TRANSMITTER CRC-16 ALGORITHM Initial Remainder XOR 1st data byte Current CRC Shift 1 Shift 2 XOR Gen. Polynomial Current CRC Shift 3 Shift 4 XOR Gen. Polynomial Current CRC Shift 5 Shift 6 XOR Gen. Polynomial Current CRC Shift 7 Shift 8 XOR Gen. Polynomial Current CRC XOR 2nd data byte Current CRC Shift 1 XOR Gen. Polynomial Current CRC Shift 2 XOR Gen. Polynomial Current CRC Shift 3 XOR Gen. Polynomial Current CRC Shift 4 Shift 5 XOR Gen. Polynomial Current CRC Shift 6 Shift 7 XOR Gen. Polynomial Current CRC Shift 8 XOR Gen. Polynomial Transmitted CRC MSB2 1111 0000 1111 0111 0011 1010 1001 0100 0010 1010 1000 0100 0010 1010 1000 0100 0010 1010 1000 0000 1000 0100 1010 1110 0111 1010 1101 0110 1010 1100 0110 0011 1010 1001 0100 0010 1010 1000 0100 1010 1110 E 1111 0000 1111 1111 1111 0000 1111 1111 0111 0000 0111 0011 0001 0000 0001 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 1000 0100 0010 0000 0010 1001 0100 0000 0100 0010 0000 0010 2 1111 0000 1111 1111 1111 0000 1111 1111 1111 0000 1111 1111 1111 0000 1111 1111 0111 0000 0111 0000 0111 0011 0000 0011 0001 0000 0001 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 1000 0100 0000 0100 4 LSB2 1111 0001 1110 1111 1111 0001 1110 1111 1111 0001 1110 1111 1111 0001 1110 1111 1111 0001 1110 0111 1001 1100 0001 1101 1110 0001 1111 1111 0001 1110 0111 0011 0001 0010 0001 0000 0001 0001 0000 0001 0001 1
RECEIVER1 CRC-16 ALGORITHM Flag MSB2 Rcvr CRC after data XOR 1st byte Trns CRC Current CRC 0 Shift 1 1 Shift 2 Shift 3 Shift 4 0 Shift 5 1 Shift 6 Shift 7 Shift 8 0 XOR 2nd byte trns CRC 1 Current CRC Shift 1-8 yields 0 1 LSB2 Flag 1110 0010 0100 0001 0000 0000 0100 0001 1110 0010 0000 0000 0111 0001 0000 0000 0 0011 1000 1000 0000 0 0001 1100 0100 0000 0 0000 1110 0010 0000 0 0000 0111 0001 0000 0 0000 0011 1000 1000 0 0000 0001 1100 0100 0 0000 0000 1110 0010 0 0000 0000 1110 0010 0000 0000 0000 0000 0000 0000 0000 0000 ALL ZEROES FOR RECEIVER FINAL CRC-16 INDICATES TRANSMISSION CORRECT!
1 1 1 0 1 0 1 1 ____________________________ | | | EXAMPLE MESSAGE | | Refer to the example of a | | transmitted message shown | | below. | |____________________________|
As stated before, the receiver processes incoming data through the same CRC algorithm as the transmitter. The example for the receiver starts at the point after all the data bits but not the transmitted CRC have been received correctly. Therefore, the receiver CRC should be equal to the transmitted CRC at this point. When this occurs, the output of the CRC algorithm will be zero indicating that the transmission is correct. The transmitted message with CRC would then be:
Address 01
Function 07 41
CRC16 E2
The MSB and LSB references are to the data bytes only, not the CRC bytes. The CRC MSB and LSB order are the reverse of the data byte order.
GFK-0582D
727
Read Output Table Read Input Table Read Registers Read Analog Input Force Single Output Preset Single Register Read Exception Status Loopback/Maintenance Force Multiple Outputs Preset Multiple Registers Report Device Type Read Scratch Pad
The value of this byte is the number of bytes contained in the data being transmitted.
728
GFK-0582D
Message Descriptions
The following pages explain the format and fields for each RTU message. MESSAGE (01): READ OUTPUT TABLE FORMAT:
Address
Func 01
Number of Points
Error Check
Hi Lo Query
Hi
Lo
Address
Func 01
Byte Count
Data
Error Check
Normal Response
QUERY: D D D An address of 0 is not allowed as this cannot be a broadcast request. The function code is 01. The starting point number is two bytes in length and may be any value less than the highest output point number available in the attached Series 90 CPU. The starting point number is equal to one less than the number of the first output point returned in the normal response to this request. The number of points value is two bytes in length. It specifies the number of output points returned in the normal response. The sum of the starting point value and the number of points value must be less than or equal to the highest output point number available in the attached Series 90 CPU. The high order byte of the starting point number and number of bytes fields is sent as the first byte. The low order byte is the second byte in each of these fields.
RESPONSE: D D The byte count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the normal response following the byte count and preceding the error check. The data field of the normal response is packed output status data. Each byte contains 8 output point values. The least significant bit (LSB) of the first byte contains the value of the output point whose number is equal to the starting point number plus one. The values of the output points are ordered by number starting with the LSB of the first byte of the data field and ending with the most significant bit (MSB) of the last byte of the data field. If the number of points is not a multiple of 8, then the last data byte contains zeros in one to seven of its highest order bits.
729
GFK-0582D
7
MESSAGE (02): READ INPUT TABLE FORMAT:
Address
Func 02
Number of Points
Error Check
Hi Lo Query
Hi
Lo
Address
Func 02
Byte Count
Data
Error Check
Normal Response
QUERY: D D D An address of 0 is not allowed as this cannot be a broadcast request. The function code is 02. The starting point number is two bytes in length and may be any value less than the highest input point number available in the attached Series 90 CPU. The starting point number is equal to one less than the number of the first input point returned in the normal response to this request. The number of points value is two bytes in length. It specifies the number of input points returned in the normal response. The sum of the starting point value and the number of points value must be less than or equal to the highest input point number available in the attached Series 90 CPU. The high order byte of the starting point number and number of bytes fields is sent as the first byte. The low order byte is the second byte in each of these fields.
RESPONSE: D D The byte count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the normal response following the byte count and preceding the error check. The data field of the normal response is packed input status data. Each byte contains 8 input point values. The least significant bit (LSB) of the first byte contains the value of the input point whose number is equal to the starting point number plus one. The values of the input points are ordered by number starting with the LSB of the first byte of the data field and ending with the most significant bit (MSB) of the last byte of the data field. If the number of points is not a multiple of 8, then the last data byte contains zeros in one to seven of its highest order bits.
730
GFK-0582D
Address
Func 03
Number of Registers
Error Check
Hi Lo Query
Hi
Lo
Address
Func 03
Byte Count
Error Check
Hi Lo Hi Normal Response
QUERY: D D D An address of 0 is not allowed as this request cannot be a broadcast request. The function code is equal to 3. The starting register number is two bytes in length. The starting register number may be any value less than the highest register number available in the attached Series 90 CPU. It is equal to one less than the number of the first register returned in the normal response to this request. The number of registers value is two bytes in length. It must contain a value from 1 to 125 inclusive. The sum of the starting register value and the number of registers value must be less than or equal to the highest register number available in the attached Series 90 CPU. The high order byte of the starting register number and number of registers fields is sent as the first byte in each of these fields. The low order byte is the second byte in each of these fields.
RESPONSE: D The byte count is a binary number from 2 to 250 inclusive. It is the number of bytes in the normal response following the byte count and preceding the error check. Note that the byte count is equal to two times the number of registers returned in the response. A maximum of 250 bytes (125) registers is set so that the entire response can fit into one 256 byte data block. The registers are returned in the data field in order of number with the lowest number register in the first two bytes and the highest number register in the last two bytes of the data field. The number of the first register in the data field is equal to the starting register number plus one. The high order byte is sent before the low order byte of each register.
GFK-0582D
731
7
MESSAGE (04): READ ANALOG INPUTS FORMAT:
Address
Func 04
Error Check
Hi Lo Query
Hi
Lo
Address
Func 04
Byte Count
Data
Error Check
Hi
Lo
Hi
Lo
Normal Response
QUERY: D D D An address of 0 is not allowed as this request cannot be a broadcast request. The function code is equal to 4. The starting analog input number is two bytes in length. The starting analog input number may be any value less than the highest analog input number available in the attached Series 90 CPU. It is equal to one less than the number of the first analog input returned in the normal response to this request. The number of analog inputs value is two bytes in length. It must contain a value from 1 to 125 inclusive. The sum of the starting analog input value and the number of analog inputs value must be less than or equal to the highest analog input number available in the attached Series 90 CPU. The high order byte of the starting analog input number and number of analog input fields is sent as the first byte in each of these fields. The low order byte is the second byte in each of these fields.
RESPONSE: D The byte count is a binary number from 2 to 250 inclusive. It is the number of bytes in the normal response following the byte count and preceding the error check. Note that the byte count is equal to two times the number of analog inputs returned in the response. A maximum of 250 bytes (125) analog inputs is set so that the entire response can fit into one 256 byte data block. The analog inputs are returned in the data field in order of number with the lowest number analog input in the first two bytes and the highest number analog input in the last two bytes of the data field. The number of the first analog input in the data field is equal to the starting analog input number plus one. The high order byte is sent before the low order byte of each analog input.
732
GFK-0582D
Address
Func 05
Point Number
Data 00H
Error Check
Hi
Lo
Data 00H
Error Check
Hi
Lo
Hi
Lo
Normal Response
QUERY: D D D An address of 0 indicates a broadcast request. All slave stations process a broadcast request and no response is sent. The function code is equal to 05. The point number field is two bytes in length. It may be any value less than the highest output point number available in the attached Series 90 CPU. It is equal to one less than the number of the output point to be forced on or off. The first byte of the data field is equal to either 0 or 255 (FFH). The output point specified in the point number field is to be forced off if the first data field byte is equal to 0. It is to be forced on if the first data field byte is equal to 255 (FFH). The second byte of the data field is always equal to zero.
RESPONSE: D The normal response to a force single output query is identical to the query.
Note
The force single output request is not an output override command. The output specified in this request is ensured to be forced to the value specified only at the beginning of one sweep of the Series 90 user logic.
GFK-0582D
733
7
MESSAGE (06): PRESET SINGLE REGISTER FORMAT:
Address
Func 06
Register Number
Data
Error Check
Hi
Lo
Data
Error Check
Hi
Lo
Hi
Lo
Normal Response
QUERY: D D D An address 0 indicates a broadcast request. All slave stations process a broadcast request and no response is sent. The function code is equal to 06. The register number field is two bytes in length. It may be any value less than the highest register available in the attached Series 90 CPU. It is equal to one less than the number of the register to be preset. The data field is two bytes in length and contains the value that the register specified by the register number field is to be preset to. The first byte in the data field contains the high order byte of the preset value. The second byte in the data field contains the low order byte.
RESPONSE: D The normal response to a preset single register query is identical to the query.
734
GFK-0582D
Address
Func 07
Error Check
Normal Response
QUERY: This query is a short form of request for the purpose of reading the first eight output points. D D D An address of zero is not allowed as this cannot be a broadcast request. The function code is equal to 07.
RESPONSE: The data field of the normal response is one byte in length and contains the states of output points one through eight. The output states are packed in order of number with output point ones state in the least significant bit and output point eights state in the most significant bit.
GFK-0582D
735
7
MESSAGE (08): LOOPBACK/MAINTENANCE (GENERAL) FORMAT:
Address
Func 08
Diagnostic Code 0, 1, or 4
Error Check
Query
Address
Func 08
Diagnostic Code 0, 1, or 4
Error Check
Normal Response
QUERY: D D The function code is equal to 8. The diagnostic code is two bytes in length. The high order byte of the diagnostic code is the first byte sent in the diagnostic code field. The low order byte is the second byte sent. The loopback/maintenance command is defined only for the diagnostic code equal to 0, 1, or 4. All other diagnostic codes are reserved. The data field is two bytes in length. The contents of the two data bytes are defined by the value of the diagnostic code.
A loopback/maintenance query with a diagnostic code equal to 0 is called a return query data request. An address of 0 is not allowed for the return query data request. The values of the two data field bytes in the query are arbitrary. The normal response is identical to the query. The values of the data bytes in the response are equal to the values sent in the query.
DIAGNOSTIC Initiate Communication Restart (Loopback/Maintenance) CODE (01): A loopback/maintenance request (query or broadcast) with a diagnostic code equal to 1 is called an Initiate Communication Restart request. D An address of 0 indicates a broadcast request. All slave stations process a broadcast request and no response is sent.
GFK-0582D
736
D D
This request disables the listen-only mode (enables responses to be sent when queries are received so that communications can be restarted). The value of the first byte of the data field (DATA1) must be 0 or FF. Any other value will cause an error response to be sent. The value of the second byte of the data field (DATA2) is always equal to 0. The normal response to an Initiate Communication Restart query is identical to the query.
DIAGNOSTIC Force Listen-Only Mode (Loopback/Maintenance) CODE (04): A loopback/maintenance request (query or broadcast) with a diagnostic code equal to 4 is called a Force Listen-Only Mode request. D D An address of 0 indicates a broadcast request. All slave stations process a broadcast request. After receiving a Force Listen-Only mode request, the RTU device will go into the listenonly mode, will not perform a requested function, and will not send either normal or error responses to any queries. The listen-only mode is disabled when the RTU device receives an Initiate Communication Restart request or when the RTU device is powered up. Both bytes in the data field of a Force Listen-Only Mode request are equal to 0. The RTU device never sends a response to a Force Listen-Only Mode request.
Note
Upon power up, the RTU device disables the listen-only mode and is enabled to continue sending responses to queries.
GFK-0582D
737
7
MESSAGE (15): FORCE MULTIPLE OUTPUTS FORMAT:
Address
Func 15
Number of Points
Byte Count
Data
Error Check
Query Address Func 15 Starting Point No. Number of Points Error Check
Normal Response
QUERY: D D D An address of 0 indicates a broadcast request. All slave stations process a broadcast request and no response is sent. The value of the function code is 15. The starting point number is two bytes in length and may be any value less than the highest output point number available in the attached Series 90 CPU. The starting point number is equal to one less than the number of the first output point forced by this request. The number of points value is two bytes in length. The sum of the starting point number and the number of points value must be less than or equal to the highest output point number available in the attached Series 90 CPU. The high order byte of the starting point number and number of bytes fields is sent as the first byte in each of these fields. The low order byte is the second byte in each of these fields. The byte count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the data field of the force multiple outputs request. The data field is packed data containing the values that the outputs specified by the starting point number and the number of points fields are to be forced to. Each byte in the data field contains the values that eight output points are to be forced to. The least significant bit (LSB) of the first byte contains the value that the output point whose number is equal to the starting point number plus one is to be forced to. The values for the output points are ordered by number starting with the LSB of the first byte of the data field and ending with the most significant bit (MSB) of the last byte of the data field. If the number of points is not a multiple of 8, then the last data byte contains zeros in one to seven of its highest order bits.
D D
RESPONSE: D The description of the fields in the response are covered in the query description.
Note
The force multiple outputs request is not an output override command. The outputs specified in this request are ensured to be forced to the values specified only at the beginning of one sweep of the Series 90 user logic.
738 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
Address
Func 16
Number of Registers
Byte Count
Data
Error Check
Query Address Func 16 Starting Register No. Number of Registers Error Check
Normal Response
QUERY: D D D An address of 0 indicates a broadcast request. All slave stations process a broadcast request and no response is sent. The value of the function code is 16. The starting register number is two bytes in length. The starting register number may be any value less than the highest register number available in the attached Series 90 CPU. It is equal to one less than the number of the first register preset by this request. The number of registers value is two bytes in length. It must contain a value from 1 to 125 inclusive. The sum of the starting register number and the number of registers value must be less than or equal to the highest register number available in the attached Series 90 CPU. The high order byte of the starting register number and number of registers fields is sent as the first byte in each of these fields. The low order byte is the second byte in each of these fields. The byte count field is one byte in length. It is a binary number from 2 to 250 inclusive. It is equal to the number of bytes in the data field of the preset multiple registers request. Note that the byte count is equal to twice the value of the number of registers. The registers are returned in the data field in order of number with the lowest number register in the first two bytes and the highest number register in the last two bytes of the data field. The number of the first register in the data field is equal to the starting register number plus one. The high order byte is sent before the low order byte of each register.
RESPONSE: D The description of the fields in the response are covered in the query description.
GFK-0582D
739
7
MESSAGE (17): REPORT DEVICE TYPE FORMAT:
Address Func 17 Query Address Func 17 Byte Device Slave Count Type Run 30 or 70 Light 5 Data Error Check Error Check
Normal Response
QUERY: The Report Device Type query is sent by the master to a slave in order to learn what type of programmable control or other computer it is. D D An address of zero is not allowed as this cannot be a broadcast request. The function code is equal to 17.
RESPONSE: D D D D The byte count field is one byte in length and is equal to 5. The device type field is one byte in length and is equal to 30 for the Series 90-30 PLC or 70 for the Series 90-70 PLC. The slave run light field is one byte in length. The slave run light byte is equal to OFFH if the Series 90 CPU is running. It is equal to 0 if the Series 90 CPU is not running. The data field contains three bytes.
Possible responses for the Series 9030 CPUs 35 00 00 for CPU331 38 00 00 for CPU340 36 00 00 for CPU341 44 00 00 for CPU350 37 00 00 for CPU351 39 00 00 for CPU352 40 00 00 for CPU360 41 00 00 for CPU363 42 00 00 for CPU364
740
GFK-0582D
Address
Func 67
Number of Bytes
Error Check
Query
Address
Func 67
Byte Count
Data
Error Check
Normal Response
QUERY: D D D An address of 0 is not allowed as this cannot be a broadcast request. The function code is equal to 67. The starting byte number is two bytes in length and may be any value less than or equal to the highest scratch pad memory address available in the attached Series 90 CPU as indicated in the table below. The starting byte number is equal to the address of the first scratch pad memory byte returned in the normal response to this request. The number of bytes value is two bytes in length. It specifies the number of scratch pad memory locations (bytes) returned in the normal response. The sum of the starting byte number and the number of bytes values must be less than two plus the highest scratch pad memory address available in the attached Series 90 CPU. The high order byte of the starting byte number and number of bytes fields is sent as the first byte in each of these fields. The low order byte is the second byte in each of the fields.
RESPONSE: D D The byte count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the data field of the normal response. The data field contains the contents of the scratch pad memory requested by the query. The scratch pad memory bytes are sent in order of address. The contents of the scratch pad memory byte whose address is equal to the starting byte number is sent in the first byte of the data field. The contents of the scratch pad memory byte whose address is equal to one less than the sum of the starting byte number and number of bytes values is sent in the last byte of the data field.
GFK-0582D
741
7
RTU Scratch Pad
The entire scratch pad is updated every time an external READ request is received by the CMM. All scratch pad locations are read only. The scratch pad is a byte-oriented memory type.
Bit pattern same as SP(00) Major2a (in hexadecimal) Minor2b (in hexadecimal) 7 ASCII characters + termination character (00h) Major (in BCD) Minor (in BCD) Major Minor (00h) (90-70: 0Ch; 90-30: 0Dh) (00h) 1-247 (Decimal) (00h) See Note (4) %R size %AI size %AQ size %I size %Q size %M size See Note (5) (00h)
742
GFK-0582D
2a
PLC CPU Major Type Codes: S9070_PLC_CPU 12 (0Ch) Series 90-70 PLC CPU S9030_PLC_CPU 16 (10h) Series 90-30 PLC CPU Series 90-70 Minor Types for CPU:
2b
Possible responses for the Series 9030 CPUs 35 00 00 for CPU331 38 00 00 for CPU340 36 00 00 for CPU341 44 00 00 for CPU350 37 00 00 for CPU351 39 00 00 for CPU352 40 00 00 for CPU360 41 00 00 for CPU363 42 00 00 for CPU364
80 00 00 for CPU780 81 00 00 for CPU781 82 00 00 for CPU782 88 00 00 for CPU788 89 00 00 for CPU789 90 00 00 for CPU790 92 00 00 for CPU914 15 00 00 for CPU915
24 00 00 for CPU924 25 00 00 for CPU925 73 00 00 for CPX772 83 00 00 for CPX782 28 00 00 for CPX928 35 00 00 for CPX935
Located in the same position as in the Series Six scratch pad. Series One, Three and Five PLC users, who need to determine the node type, should note this location and make driver modifications where necessary. Scratch Pad Bytes 18h-33h:
Bytes 18-1B 1C-1F 20-23 24-27 28-2B 2C-2F 30-33 Note: %R %AI %AQ %I %Q %M
Length of Memory Register Memory Analog Input Table Analog Output Table Input Table Output Table Internal Discrete Memory User Program Code
Size Returned In Words Words Words Points (Bits) Points (Bits) Points (Bits) Bytes
Four bytes hold the hexadecimal length of each memory type with the most significant word reserved for future expansion. For example, the CPU 731 default register memory size of 1024 words (0400h) would be returned in the following format:
Least Significant 18 00 19 04 1A 00
Most Significant 1B 00
The amount of program memory occupied by the logic program. Also appears on the Logicmaster 90 PLC Memory Usage screen in the User Program field.
GFK-0582D
743
7
Communication Errors
Serial link communication errors are divided into three groups: D D D Invalid Query Message Serial Link Time Outs Invalid Transaction
The address reflects the address provided on the original request. The exception function code is equal to the sum of the function code of the query plus 128. The error subcode is equal to 1, 2, 3, or 4. The value of the subcode indicates the reason the query could not be processed.
744
6. 7. 8.
The analog input number field specifies an analog input number not available in the attached Series 90 CPU (returned for function code 3). The diagnostic code is not equal to 0, 1, or 4 (returned for function code 8). The starting byte number and number of bytes fields specify a scratch pad memory address that is not available in the attached Series 90 CPU (returned for function code 67).
GFK-0582D
745
7
Invalid Transactions
If an error occurs during transmission that does not fall into the category of an invalid query message or a serial link time-out, it is known as an invalid transaction. Types of errors causing an invalid transaction include: D D D D Bad CRC. The data length specified by the memory address field is longer than the data received. Framing or overrun errors. Parity errors.
If an error in this category occurs when a message is received by the slave serial port, the slave does not return an error message; rather the slave ignores the incoming message, treating the message as though it was not intended for it.
746
GFK-0582D
This section contains a simplified description of the SNP Protocol for users of the SNP master and slave implementations on the CMM module. Topics covered include: protocol flow, master-slave operation, protocol timing, and Datagrams operation. The SNP Protocol transfers data using the asynchronous data format. For background information on serial data transmission and the asynchronous format, refer to Appendix E, The Serial Line Interface. For a more detailed description of the SNP Protocol, GFK-0529, SNP Communications Reference Manual is available from GE Fanuc. That manual completely describes the format of each SNP message, with examples of typical service requests and responses. This section covers the following topics: D D D D Overview of SNP Protocol SNP Master-Slave Operation SNP Timers SNP Datagrams
GFK-0582D
747
7
The GE Fanuc SNP DOS Driver is an SNP master device; PC applications that use this driver can communicate with Series 90 PLCs over an SNP communication link. Logicmaster 90 uses an SNP master to communicate with, and to configure and program Series 90 PLCs. Additionally, SNP master devices have been implemented by many other manufacturers to communicate with Series 90 PLCs. Each serial port on a Series 90 CMM module can be configured as an SNP master or slave device. Ports 1 and 2 on CPUs 351, 352, and 363 support SNP master or slave (however, SNP master is not supported in all firware versions check Chapter 3 for details). The standard serial port (accessed through the power supply connector) on all Series 90 CPUs supports SNP slave. The SNP master and slave on the CMM do not support PLC programming or configuration functions.
Message Format
There are three types of SNP messages: Attach-type messages (Attach, Attach Response, and Update Real-Time Datagram), which are always 24 bytes in length; Mailbox messages, which are always 40 bytes in length; and Buffer messages, whose length varies with the amount of data. The content of each message varies with the message type and data being transferred. SNP also returns a 2-byte acknowledgement after each Mailbox or Buffer message to confirm reception of the message.
Change SNP ID COMMREQ command. (See Chapter 6, SNP Service, for details on this command). The basic SNP message flow for establishing SNP communications is shown in the figure below: Master Slave Break (T4 delay) Attach Attach Response
7
ceived within the T5 time interval after the completion of the previous message, the SNP communication is aborted. The master must establish a new communication session. See the SNP Timers section, below, for additional information on the SNP timers. Even when message transmission or integrity errors do not occur, the slave device may be unable to successfully complete the action requested by the master. The slave device indicates a request failure by returning the appropriate major and minor error codes to the master in a response Mailbox message.
SNP Timers
A number of timers are defined to support the SNP Protocol. Adjustable timers are provided because different SNP devices can coexist on a given SNP serial link, each with its potentially different processor and different processing capability. The SNP Protocol provides several timers whose values may be adjusted by the user to allow the serial communication link to run as efficiently as possible for a given situation. The default value for each SNP timer is selected by the CMM configuration Timeout parameter. Each of the four Timeout selections establishes a set of values for all SNP timers. The default SNP timer values for each configuration selection are listed in Table 4, SNP Timer Values for Timeout Selections. Non-default SNP timer values must be provided by the Long Attach SNP command. The Long Attach command issues an SNP Parameter Select message to negotiate new timer values between the master and slave devices. All SNP timers revert to the configured default values when a new Attach request is sent (Attach command). Non-default SNP timer values must be re-established after each new Attach request. Previously established SNP timer values are not changed by the Update Real-Time Datagram request.
750 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
Each of the SNP timers is described below. Note that Modem Turnaround Delay and Transmission Time are not included in the SNP timer values unless specifically stated. Modem Turnaround Delay and Transmission Delay are described following the timers.
SNP Timer
T1
Timer Type
Minimum Turn-Around Time (Master and Slave)
Description
The minimum time interval which this device requires between a reception and the next transmission. It allows the half-duplex serial line to switch direction. It is usually used as the time delay after receiving a message until sending its acknowledgement, or after an acknowledgement until sending the next message. It must elapse before sending a message or acknowledgement. The T1 timer defaults to 5 milliseconds for all CMM configuration Timeout parameter selections. T1 timer values are always exchanged between the master and slave devices in the Attach request and response messages; each device operates with the T1 value obtained from the other device.
T2
The maximum time allowed for reception of an acknowledgement after sending a message. Failure to receive an acknowledgement within the T2 time causes the SNP device (master or slave) to abort the SNP communication. The T2 timer values can be optionally negotiated between the master and slave devices via the SNP Parameter Select message (part of the Long Attach command). The master and slave devices both use the larger of the T2 values from either device. (Each device adds the separately negotiated Modem Turnaround Time and Transmission Delay values to the negotiated T2 value prior to use. Do not include these values in the configured or programmed T2 value.)
T3
The maximum time the master will wait without activity on the serial line. It is started upon completion of an Attach or other SNP response. If the master device has sent no SNP message within the T3 time, the master will send an Inquiry or Short Status message to the attached slave device to prevent a T3 timeout on the slave. The T3 timer is always set to the current T3 timer value minus the time required to transfer 80 characters at the selected data rate, minus any negotiated Modem Turnaround Time. The T3 value is recalculated whenever a new T3 timer value is established. If the T3 timer is disabled, this timer is also disabled.
T3
(Slave only)
The maximum time the slave device will wait for activity on the serial line. It is started after completion of an SNP response and cancelled when a new request is received from the master. If no activity occurs within the T3 time, the slave aborts the SNP communication. The T3 timer default value is specified by the CMM configuration Timeout parameter; default values range from 0 (disabled) to 10 sec. The T3 timer value may be optionally negotiated between the master and slave devices via the SNP Parameter Select message (part of the Long Attach command). The master and slave devices both use the larger of the T3 values from either device. (Each device adds the separately negotiated Modem Turnaround Time value to the negotiated T3 value prior to use. Do not include this value in the configured or programmed T3 value.)
GFK-0582D
751
T3
(Slave only)
This is a special instance of the T3 timer used only by the slave immediately after a new Attach request/response. It allows the master sufficient time to negotiate new timer values by sending an SNP Parameter Select request message to the slave device. This special timer value is used only until the first message is received after the Attach; thereafter, the default or negotiated T3 value is used. The T3 timer value is always equal to the default T3 value plus a fixed worst-case Transmission Delay value of 65 sec. If the T3 timer is disabled, this timer value is also disabled.
T4
(Master only)
This is the minimum time delay the master must wait after completion of the Break sequence before it sends an Attach or Update RealTime Datagram message. This time interval allows the slave device to activate its receiver circuits and prepare to accept incoming messages. Used by the master device only. This timer is used during the Attach, Long Attach, and Update Real-Time Datagram commands. The T4 timer defaults to 50 milliseconds for all CMM configuration Timeout parameter selections. The T4 timer value may be optionally specified by the Long Attach command.
T5
(Slave only)
The maximum time that the slave device will delay while preparing a response message. It is started when the final request acknowledgement is sent to the master. If the response message is not ready to send within the T5 time, the slave sends a keep-alive message to the master to prevent a T5 timeout at the master. (The T5 timer usually keeps track of the time that the SNP slave waits for the Service Request Processor.) The T5 timer default value is specified by the CMM configuration Timeout parameter; default values range from 0 (disabled) to 5 sec. The T5 value used by the master device may be modified by the Long Attach command. The T5 timer value is not negotiated between the master and slave devices; the slave device always uses its configured T5 timer value. The T5 timer is also disabled whenever the T2 timer (Acknowledgement Timeout) is disabled.
T5
Processing Timeout.
(Master only)
The maximum time that the master device will wait for the slave device to return an expected response message. It is started when the final request acknowledgement is received from the slave. It is restarted when a keep-alive message is received from the slave. If the response is not received within the T5 time, the SNP communication is aborted. The T5 timer is always set to the current T5 timer value plus the time required to transfer 80 characters at the selected data rate, plus any negotiated Modem Turnaround Time. The T5 value is recalculated whenever a new T5 timer value is established. If the T2 or T5 timer is disabled, the T5 timer is also disabled.
T5
The maximum time a station will wait for the other station to send an expected Buffer message as part of an SNP request or response. It is started after acknowledgement has been sent and another Buffer message is expected. If the Buffer message is not received within the T5 time, the SNP communication is aborted. The T5 timer is always set to the current T5 timer value plus the Transmission Delay value plus twice the time required to transfer the next Buffer message at the selected data rate. The T5 value is recalculated whenever a Buffer message is expected. If the T2 or T5 timer is disabled, the T5 timer is also disabled.
752
GFK-0582D
Description
The length of time required by intervening modems to turn the link around. The Modem Turnaround Delay default value is specified by the CMM configuration TurnA Delay parameter; default values range from 0 (None) to 500 milliseconds. The Modem Turnaround Delay value may be optionally negotiated between the master and slave devices via the SNP Parameter Select message (part of the Long Attach command). The master and slave devices both use the larger of the Modem Turnaround Delay values from either device.
The length of time required for the data to transfer from the initiating device to the receiving device. (This time is also referred to as the wire time.) This time reflects unusual delays in the data transmission path, as when satellite links are used to transfer data.
The Transmission Delay defaults to 0 milliseconds for all CMM configuration Timeout parameter selections. The Transmission Delay value may be optionally negotiated between the master and slave devices via the SNP Parameter Select message (part of the Long Attach command). The master and slave devices both use the larger of the Transmission Delay values from either device.
GFK-0582D
753
SNP Datagrams
The SNP Read and Write Memory requests permit the master device to directly read and write memory within the slave device memory. Each read or write request is of a single memory type; multiple requests are required to access different memory types. SNP also provides the capability to read from several slave memory types in a single request. The mixed slave memory reference is called a Datagram. Datagrams provide significantly faster retrieval of mixed memory types from a slave device than separate reads of each memory type. Datagram access differs from direct memory access in that the memory references must be established before use. Once the Datagram has been established, the defined memory data may be retrieved from the slave device by reading the Datagram. When Datagram retrieval is no longer needed, the Datagram may be cancelled to free resources at the slave PLC CPU.
Establishing a Datagram
The SNP master device establishes a Datagram by specifying one or more memory areas in the slave device. Each slave memory area is defined by a Point Format, which specifies the slave memory type, memory address, and number of memory elements of that memory type. The SNP master can define up to 32 separate Point Formats when establishing a Datagram. When a Datagram is established, the slave device allocates resources in the PLC CPU to collect the various memory areas into one contiguous data area for transfer to the master device upon request. If the Datagram is successfully established, the slave returns a Datagram ID code to the master. The Datagram ID is a single byte which must be used by the master to identify this Datagram in all future requests. A Point Format may use any slave memory type available with other Read commands, including (for Series 90-70 slave devices only) Main Program Task and Program Block memory. Bit-oriented memory types in a Point Format are not supported by Series 90-70 slave devices. Significant restrictions exist when using bit-oriented memory types in a Point Format in Series 90-30 or Series 90-20 slave devices: The slave memory defined by the Point Format must not exceed a standard byte of slave memory (elements #1 to #8, #9 to #16, ..., #(N*8)+1 to #(N*8)+8, ... ). Since any bit-oriented memory can also be referenced as byte-oriented memory, it is recommended (and necessary for Series 90-70 slave devices) to use a byte-oriented instead of bit-oriented memory type in a Point Format. There is no restriction on using byte-oriented memory in a Point Format. (See Chapter 6, SNP Services, Table 16, Memory Types, Unit Lengths, and Valid Ranges, for a listing of all memory types. This table also shows the byte-oriented equivalents for each bit-oriented memory type.)
754
GFK-0582D
Retrieving a Datagram
The slave memory areas defined by a Datagram are returned to the master when the master issues an Update Datagram or Update Real-Time Datagram request. The SNP master in the CMM stores the response data in the local PLC memory specified by the update command; enough local PLC memory must be provided to store the entire response.
Note
Any existing SNP communication is aborted when the master sends an Update Real-Time Datagram request. This request generates a Break sequence, which forces all slave devices on the serial link to abort any existing communication and to wait for an Attach or Update Real-Time Datagram request. Like an Attach request, the Update Real-Time Datagram request specifies a particular slave device. The specified slave device acknowledges the Update Real-Time Datagram request; all other slave devices await the next Break sequence.
GFK-0582D Chapter 7 Protocol Definition - CCM, RTU, SNP, and SNP-X 755
7
Datagram Lifetime
An established Datagram may be cancelled at any time via the Cancel Datagram request. All established Datagrams are automatically cancelled when power is removed from the slave device. In addition, certain Datagrams are automatically cancelled when the SNP communication in which they were established is terminated. There are two types of Datagrams: Normal and Permanent . The Datagram type must be specified in all Datagram requests. The difference between the two Datagram types is the lifetime of the Datagram once it has been established. Permanent Datagrams remain established through new SNP communications. Normal Datagrams in a CMM711 (Series 90-70) slave device or in the built-in slave device in any Series 90 PLC CPU are automatically cancelled when the current SNP communication is ended. Normal Datagrams in a CMM311 (Series 90-30) slave device behave like permanent Datagrams; they are not cancelled when the current SNP communication is ended. Any Datagram (normal or permanent) may be cancelled upon request. The Datagram ID is used to identify a specific Datagram during a Cancel Datagram request. The ID value 1 can be used to specify all established Datagrams of the specified type (normal or permanent).
Note
In IC693CMM311 versions prior to 4.0, a special case occurs when both serial ports on the CMM311 module are configured as SNP slave devices: The ID value 1 in a Cancel Datagram request received at either slave device will cancel all established Datagrams on both slave devices in the same CMM. There is no interaction between Datagrams established on both ports of a CMM711 module (Series 90-70). There is no interaction between Datagrams established in any CMM module and the built-in CPU slave device, or between different CMM modules. This problem was solved in CMM311 version 4.0, released in July 1996. If you have an older version of this module that experiences this problem, you can correct this by upgrading to the latest version. Contact your GE Fanuc distributor for details.
756
GFK-0582D
This section contains a complete description of the SNP-X protocol for users writing an SNP-X communications driver. Topics covered in this section are: D D D D D Overview of SNP-X Protocol SNP-X Protocol Sequence SNP-X Message Structure SNP-X Commands SNP-X Slave State Machine
7
Either SNP or SNP-X operation can be performed on the same wiring network, as determined by the type of communication session (SNP or SNP-X). Only one session (SNP or SNP-X) can be active at any time. Either type of session may be established via a Long Break and the appropriate Attach or X-Attach command. During an SNP-X session, only SNP-X commands are recognized; SNP commands are ignored during an SNP-X session. Likewise, SNP-X commands are ignored during an SNP session.
Error Handling
SNP-X provides two types of errors: hard errors and soft errors. Hard errors are non-recoverable. These errors occur when the communication session cannot be continued. Hard errors include serial transmission errors (checksum, framing, parity or BCC errors), and protocol errors (message type, next message type or length). When an SNP-X request message cannot be received intact (that is, a serial transmission error has occurred), the slave device does not send a response to the master. The master times out waiting for the response and aborts the SNP-X communication session. When the SNP-X request message is correctly received and the slave is able to respond, the slave device returns an error code within an SNP-X response message. (See the list of Minor Error Codes for Major Error 15; minor error codes 32-35.) Both the slave and master abort the SNP-X communication session when a hard error is detected; recovery is only possible through the establishment of a new SNP-X session. Soft errors are recoverable. The slave device returns an SNP-X response message containing an error code to the master. The SNP-X communication session remains established; further SNPX commands may be issued. Soft errors include improper request codes, service request errors, and invalid request memory types or lengths.
Broadcast Capability
Every SNP-X Attach and SNP-X request message contains the SNP ID of the slave device that is to receive the message. The SNP-X protocol also provides a mechanism to broadcast an SNP-X Attach or SNP-X request to each and every slave device on a multidrop serial link. To broadcast a SNP-X request, the special Broadcast SNP ID (FFFFFFFFFFFFFFFF) is specified in the request message. Requests which are broadcast never invoke a response. For this reason, only an X-Attach or X-Write request are meaningful in the broadcast context. A broadcast X-Attach request establishes an SNP-X session with each and every SNP-X slave on a multidrop serial link. (Subsequent SNP-X requests may then be addressed as desired.) A broadcast X-Write request sends the same data to all SNP-X slave devices that have established an SNP-X session.
Modem Support
All Series 90 SNP-X devices allow the RTS serial port signal to be used as a modem keying signal. The RTS signal is always asserted for the Modem Turnaround Time interval prior to each data transmission and is removed after the transmission is complete. If the Modem Turnaround Time value is non-zero, the RTS signal will precede the outgoing data. Serial ports on the CMM modules may be configured for either hardware flow control (full RTS/CTS operation), or no flow control (CTS is ignored). Series 90 CPU slave devices do not support hardware flow control; the CTS signal is always ignored.
758 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
(Bit n+2) X-Write Success X-Read Success Session Active
The Session Active bit indicates whether an SNP-X communication session is established at this slave device. The X-Read Success and X-Write Success bits indicate that an X-Read or X-Write SNP-X command has been successfully completed by this slave device. The location and operation of the X-Status Bits within the slave device PLC memory differs for the Series 90 CPU and CMM modules. In a Series 90 CPU module, the X-Status Bits always reside at the following locations: %S19 %S18 %S17
Location X-Status Bit Mnemonic X-Write Success SNPX_WT X-Read Success SNPX_RD Session Active SNPXACT In a Series 90 CPU module, the X-Status Bits are always updated by the slave device. The Session Active bit remains set whenever the SNP-X session is active. The X-Read Success or XWrite Success bit is set for exactly one sweep upon successful completion of an X-Read or XWrite SNP-X command, respectively. In a Series 90 CMM module, the X-Status Bits reside at a user-defined location in a bit-oriented reference table in local PLC memory. A separate set of X-Status Bits must be defined for each CMM serial port configured as an SNP-X slave device. The X-Status Bits are available only after the location has been specified via the Set X-Status Bits Address COMMREQ (07003). The Session Active bit is always maintained by the slave device and must not be reset by the ladder application. The X-Read Success and X-Write Success bits are only set by the slave device; the ladder application must examine and then reset these bits every ladder logic scan in order to properly detect the next X-Status Bits indication.
GFK-0582D
759
7
Timers
The SNP-X protocol uses the following timers. Note that the T4 timer is used exactly as in the SNP protocol.
T4
This is the time interval that the SNP or SNP-X master device must wait after sending a Long Break before sending an Attach or X-Attach message. This allows the slave device to set up the serial port and prepare to receive an attach message. This timer is used only by the master device. The usual value of this timer is 50 milliseconds. If modem operation is indicated (by configuring a non-zero Modem Turnaround Time), the T4 timer value is 600 milliseconds.
Broadcast Delay
This is the minimum time interval that the SNP-X master must wait after sending a broadcast message before sending any other message. This delay is required because the SNP-X protocol requires that a slave device not respond to a broadcast request. The Broadcast Delay is typically encountered after sending a broadcast X-Attach request. This delay applies only to the SNPX master device. For the CMM module, the Broadcast Delay value defaults to the configured T2 value selected by the Timeout SNP configuration parameter (default is 2 seconds). This value may be modified by the SNP-X master user interface. The optimal Broadcast Delay value depends upon the PLC scan characteristics of the slowest of all attached slave PLCs (that is, scan rate, communication window frequency and length, and system load). Modem Turnaround Time and Transmission Delay do not apply to the Broadcast Delay.
Response Timeout
This is the maximum time interval that the SNP-X master will wait for an expected message from the slave device. Failure to receive an expected message within this time interval causes the master to abort the SNP-X communication session; the session must be re-established for any further SNP-X communication. This timeout is used when waiting for an SNP-X response or intermediate response from the slave device. (The Response Timeout is not used for broadcast commands.) This timeout applies only to the SNP-X master slave device. For the CMM module, the Response Timeout value defaults to the configured T2 value selected by the Timeout SNP configuration parameter (default is 2 seconds). This value may be modified by the SNP-X master user interface. The optimal Response Time-out value depends upon the characteristics of the slave PLC scan (that is, scan rate, communication window frequency and length, system load, and the need to detect and correct communication failures). The time required to transmit the largest possible SNP-X response message (1015 bytes) at the configured data rate is internally added to the Response Timeout value. Any non-zero Modem Turnaround Time and Transmission Delay values are also internally added to the Response Timeout value.
760
GFK-0582D
Buffer Timeout
This is the maximum time interval that the SNP-X slave will wait for an expected SNP-X buffer message from the remote master. Failure to receive a buffer message within this time interval causes the slave to abort the SNP-X communication session; the session must be re-established for any further SNP-X communication. This timeout is used whenever a buffer message is expected, during both directed and broadcast requests. The Buffer Timeout is not configured or specified by the user interface; this time interval is internally calculated as 10 seconds plus the time required to transmit the largest possible SNP-X buffer message (1008 bytes) at the configured data rate. This timeout applies only to the SNP-X master device. The Modem Turnaround Time and Transmission Delay values (used only by the SNP-X master device to add to the Response Timeout and Broadcast Delay values) are described below:
Transmission Delay
This is the time required for the data to transfer from the initiating device to the receiving device. (This time is usually referred to as wire-time .) This time reflects unusual delays in the data transmission path, as when satellite links are used to transfer data. For the CMM module, this time defaults to zero. For a master device, this default value may be modified by the SNPX master user interface.
Long Break
The SNP-X master sends a Long Break to signal all slave devices on the serial link to prepare to establish a new communication session. Each and every slave device aborts any active communication session and prepares to receive an Attach or X-Attach message. The master asserts a Long Break by holding the transmit line in a space state for at least three character times at the current baud rate. If modem operation is indicated (by configuring a non-zero Modem Turnaround Time), the Long Break duration is 400 milliseconds to allow Long Break transmission through modems. The Long Break is used identically by the SNP and SNP-X protocols.
GFK-0582D
761
7
Block Check Code (BCC)
The Block Check Code (BCC) is the final byte of each SNP-X message and is used as an integrity check of the contents of the message. The BCC value is calculated over all bytes in the message, except for the final BCC byte itself. Upon reception of any SNP-X message, the BCC value of the message is recalculated and compared to the BCC value within the message. The BCC value over a message range is calculated by successively exclusive OR-ing the next message byte and then rotating the cumulative BCC value left one bit; this process is repeated for all bytes in the message range to be checked. The BCC calculation algorithm is: Initialize Temp BCC byte to zero For first to last byte in message range to be checked Exclusive-OR Temp BCC byte with message byte Rotate Temp BCC byte left by 1 bit (with wrap around) Bump to next message byte End for Temp BCC byte now contains final BCC value
A sample C procedure to calculate a BCC byte over a message range is provided below:
byte procedure calc_bcc( msg, len ) byte * msg; /* Pointer to start of SNP-X message */ int len; /* Number of bytes to compute BCC over */ { int i; int bcc; /* Temp BCC byte; longer than byte to */ /* handle wrap-around during rotate */ i = 0; bcc = 0; while ( i < len ) { /* XOR the Temp BCC byte with message byte */ bcc = ( bcc ^ msg[i] ); /* Rotate Temp BCC byte left by 1 bit */ bcc = ( bcc << 1 ); /* (Wrap MSB into LSB for rotate) */ bcc = bcc + ( ( bcc >> 8 ) & 0x01 ); /* Increment i for next msg byte */ i++; } /* Return the computed BCC byte */ return( (byte)bcc ); }
762
GFK-0582D
GFK-0582D
763
7
Establish Session
To establish an SNP-X communication session, the master first sends a Long Break, waits for the T4 time interval. and sends an X-Attach Request message. The slave always recognizes a Long Break; the slave resets its communication circuits and prepares to receive the expected X-Attach Request message. If the X-Attach Request message is intended for this specific slave device, the slave returns an X-Attach Response to the master. All other slave devices ignore the X-Attach message. The special Null SNP ID is always accepted by any slave device instead of its actual SNP ID. The use of the Broadcast SNP ID in an X-Attach message is described under Broadcast Commands below. The SNP-X protocol sequence for the establishment of an SNP-X communication sequence is shown below:
Master Slave
XAttach Response
Once an SNP-X session has been established, SNP-X commands may be used to transfer data.
Directed Commands
When the master sends SNP-X message(s) addressed directly to a specific SNP ID, only the slave device identified by that SNP ID receives the message; that slave returns response message(s) to the master. All other slave devices ignore the message. The special Null SNP ID is always accepted by any slave device in lieu of its actual SNP ID. Any X-Read command, or an X-Write command containing up to two bytes of data, fits within a single SNP-X request. The master sends an X-Request message and the slave returns an XResponse message to complete the command. An X-Buffer message is not used. All response data is contained within the single X-Response message. The SNP-X protocol sequence for an SNP-X command without data buffer is shown below:
Master Slave
XRequest XResponse
764
GFK-0582D
An X-Write command containing more than two bytes of data cannot fit within the single SNPX request message. The master sends an X-Request message and indicates that a buffer message will follow; the slave returns a special response message called an Intermediate Response. The master then sends the data within an X-Buffer message and the slave returns the X-Response message to complete the command. The SNP-X protocol sequence for an SNP-X command with data buffer is shown below:
Master Slave
XResponse
Broadcast Commands
When the master sends an SNP-X message (X-Attach or X-Request) that is addressed to the special Broadcast SNP ID instead of the specific SNP ID for a particular slave device, all slave devices on the serial link receive the message. If the message is an X-Attach message, an SNPX session is established at every slave device. If the message is an X-Request, all slave devices which have previously established an SNP-X session receive and process the command. SNP-X slave devices do not return any messages to the master in response to any broadcast message. Therefore, the master is unable to detect slave errors in response to a broadcast command. Since there are no responses from the slave to a broadcast command, the master must wait for the Broadcast Delay time interval after sending each message to allow all slave devices to process the message. Note that direct commands may be effectively used following a broadcast X-Attach request. Rapid polling of many slave devices is easily accomplished by using a broadcast X-Attach to establish an SNP-X session simultaneously with all slave devices on the serial link, and then directing X-Read or X-Write commands to individual slave devices. For broadcast X-Attach Requests, the SNP-X protocol sequence is as follows:
Master Slave
[Long Break] (wait T4 time) XAttach Request (wait Broadcast Delay time) (no XAttach Response)
GFK-0582D
765
7
For broadcast SNP-X commands without a data buffer, the SNP-X protocol sequence is as follows:
Master Slave
For broadcast SNP-X commands with a data buffer, the SNP-X protocol sequence is as follows:
Master Slave
XRequest (wait Broadcast Delay time) XBuffer (wait Broadcast Delay time) (no XResponse) (no Intermediate Response)
766
GFK-0582D
The contents of these sections vary depending on the message type: SNP-X Request Message (X-Request), SNP-X Response Message (X-Response), or SNP-X Data Buffer (X-Buffer).
Header Command Data Trailer
Header
Command Data
Trailer
Start of Message
Byte 1
Message Type
Byte 2
SNP ID
Request Code
Byte 11
Bytes 3-10
End of Block
Byte 19
Not Used
Byte 23
GFK-0582D
767
7
The contents of the Header, Command Data, and Trailer for the X-Request message are further described below:
The SNP ID field contains the SNP ID of the slave device to which this message is sent. This field may also contain the special Null SNP ID (all 8 bytes 00h) or the special Broadcast SNP ID (all 8 bytes FFh). The Request Code and Command Specific Data fields vary with each SNP-X command.
Header
Byte 1 Byte 2 Start of Message Message Type 1Bh Start of message character. 58h SNP-X Message (58h = X).
Command Data
Bytes 3-10 Byte 11 Bytes 12-18
SNP ID of desired SNP-X slave. Desired service request code. (Depends upon command.)
Trailer
End of Block Next Message Type Next Message Length Unused Block Check Code
17h End of block character. Next message type (0 or 54h = T). Next message length (in bytes). 0 Not used (always 0). Calculated BCC value for this message.
The trailer portion of the X-Request message indicates whether a data buffer message will be used. If a data buffer is used, the Next Message Type field is set to 54h, the message type of the X-Buffer message; the Next Message Length field is set to the length of the entire X-Buffer message (header, data, and trailer). If a data buffer message is not used, these fields in the XRequest trailer are set to zero.
768
GFK-0582D
Header
Command Data
Response Code
Bytes 3
Trailer
Start of Message
Byte 1
Message Type
Byte 2
Data Length
Bytes 8, 9
End of Block
Byte N+1
Not Used
Byte N+5
GFK-0582D
769
7
The contents of the Header, Command Data, and Trailer for the X-Response message are further described below:
The Message Type field is set to 58h for an X-Response message, or 78h for an Intermediate Response message.
Header
Byte 1 Byte 2 Start of Message Message Type 1Bh Start of message character. SNP-X Message (58h = X, or 78h = x). Response code (= Request Code + 80h). PLC Status Word from slave device. Error status (00 00 = success). Data length in bytes (0-1000). Optional data (0-1000 bytes). End of block character. Next message type (always 0). Next message length (always 0). Not used (always 0). Calculated BCC value for this message.
Command Data
Byte 3 Bytes 4,5 Bytes 6,7 Bytes 8,9 Bytes 10-N
Response Code Slave PLC Status Word Error Status Code Data Length Optional data
Trailer
Byte N+1 End of Block Byte N+2 Next Message Type Bytes N+3,4 Next Message Length Byte N+5 Unused Byte N+6 Block Check Code
17h 0 0 0
The Response Code field corresponds to the Request Code of the X-Request that initiated this command. The response code value is set to the request code value, with the high order bit always set. For a successful X-Response message, the Slave PLC Status Word field contains the PLC Status Word from the slave device. For an error X-Response, this field is set to zero. For information on the contents of the Slave PLC Status Word refer to Table 28 in Chapter 6. The Error Status Code field consists of two bytes. The first byte (byte 6) contains the Major Error code (00 indicates successful completion); the second byte (byte 7) contains the Minor Error code. The meaning of the Minor Error code depends upon the Major Error code value. The Data Length field is always present; this field contains the number of data bytes which immediately follow in the message. This field is set to zero when the message contains no data. The Optional data field may not be present. The size of this field is indicated by the Data Length field. If the Data Length field is zero, the Optional data field is not present.
770
GFK-0582D
Header
Command Data
Trailer
The contents of the Header, Command Data, and Trailer for the X-Buffer message are further described below:
Start of Message
Byte 1
Message Type
Byte 2
Optional Data
Bytes 3 - N
End of Block
Byte N+1
Not Used
Byte N+5
Header
Byte 1 Byte 2 Start of Message Message Type Optional data 1Bh Start of message character. 54h SNP-X Message (54h = T).
Command Data
Bytes 3-N
Trailer
Byte N+1 End of Block Byte N+2 Next Message Type Bytes N+3,4 Next Message Length Byte N+5 Unused Byte N+6 Block Check Code
17h 0 0 0
End of block character. Next message type (always 0). Next message length (always 0). Not used (always 0). Calculated BCC for this message.
The size of the Optional data field depends upon the amount of data in the message. The size of the entire X-Buffer message was specified by the Next Message Length field in the preceding X-Request message.
GFK-0582D
771
SNP-X Commands
This section describes the SNP-X protocol message exchange for each SNP-X command. Both directed and broadcast commands are described. Examples with actual values are provided for each SNP-X command.
X-Attach Command
Before any data can be transferred between SNP-X devices, an SNP-X communication session must be established by the master with the slave. The master device sends a Long Break, waits the T4 time interval, and transmits an X-Attach request to establish an SNP-X session with the slave device. The X-Attach command may be directed to a particular slave device, or broadcast to all slave devices on the serial link. The X-Attach is directed to a particular slave device by specifying the SNP ID of that device. (In Point-to-Point wiring only, the Null SNP ID may be specified in lieu of the actual SNP ID of the slave device; the slave device will respond as if its own SNP ID had been specified.) When directed to a specific SNP-X slave, a properly encoded X-Attach request invokes an X-Attach response; an SNP-X communication session is now established with the SNP-X slave. The X-Attach response does not contain an error code; in all error cases, an X-Attach response is not returned. An X-Attach is broadcast to all slave devices by specifying the broadcast SNP ID. The slave does not return any response to a broadcast X-Attach request. Therefore, master cannot detect a broadcast X-Attach failure. After sending a broadcast X-Attach request, the master must wait the Broadcast Delay time interval before sending the next X-Request. An SNP-X communication session is now assumed to be active. Once the SNP-X communication session has been established, the slave device is able to accept SNP-X commands. Any number or combination of SNP-X commands can be performed. The SNP-X session remains established in the slave device until either a non-recoverable error occurs, a Long Break is received, or the device is restarted. The following diagrams and tables describe the actual protocol transactions involved in establishing an SNP-X communication session. Both the directed and broadcast varieties of the XAttach command are described. The key components of an SNP-X session establishment are the Long Break and the X-Attach command. Note that the X-Attach request and X-Attach response messages both use the same message structure ( the X-Request Message Structure). In the X-Attach response message, the response code is returned in the Request Code message field. As with other response messages, the X-Attach response code value is the request code (the X-Attach request code is 0h) with the high order bit set. (Therefore, the X-Attach response code is 80h.)
772
GFK-0582D
Explanation of Direct X-Attach Command
Byte Hex Value Number X-Attach Request Message
1 2 3-10 11 12-18 19 20-23 24 1 2 3-10 11 12-18 19 20-23 24
Description
1B 58 41 42 43 44 45 46 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 B2
Start of message character (1Bh). SNP-X Command = X = 58h. SNP ID of target slave. X-Attach request code = 00h. Not used (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example. Start of message character (1Bh). SNP-X Command = X = 58h. SNP ID of target slave. X-Attach response code = 80h. Not used (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example.
1B 58 41 42 43 44 45 46 00 00 80 00 00 00 00 00 00 00 17 00 00 00 00 A2
GFK-0582D
773
7
Example of Broadcast X-Attach Command
This example shows the message exchange of a broadcast X-Attach command. Note that there is no response message to the broadcast request.
Master Slave
Byte Hex Value Number X-Attach Request Message
1 2 3-10
Description
1B 58 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 17 00 00 00 00 79
11 12-18 19 20-23 24
X-Attach request code = 00h. Not used (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example.
774
GFK-0582D
X-Read Command
The X-Read Command permits the SNP-X master to make a read request for a single continuous area of a single reference table in the slave PLC memory. The request specifies the segment selector, offset, and data length. Every X-Read command generates exactly one X-Request message and returns one X-Response message. The size of the X-Response varies depending on the amount of data to be returned. The maximum amount of data that can be read with the X-Read command is 1000 (decimal) bytes. If the slave detects an error when processing the X-Request, an X-Response message is returned with an appropriate error code. Data bytes are always byte-aligned. Individual bit data to be read are supplied at the proper bit locations within the data bytes. For example, %I4 occurs at the fourth bit within the data byte: 0000 1000 = 08h. The X-Read command may be directed only to a particular slave device by using the specific slave SNP ID. (In Point-to-Point wiring only, the Null SNP ID may be used in lieu of a specific SNP ID; the slave device will respond to the Null SNP ID as if its own SNP ID had been specified.) The X-Read command may not be broadcast, since SNP-X slave devices must not respond to any broadcast command. The following diagram and table describe the actual protocol transactions involved in an XRead command.
GFK-0582D
775
7
Example of Direct X-Read Command
This example shows the message exchange of an X-Read command.
Master Slave
Explanation of Direct X-Read Command
Byte Hex Value Number X-Read Request Message
1 2 3-10 11 12 13-14 15-16 17-18 19 20-23 24 1 2 3 4-5 6-7 8-9 10-17 18 19-22 23
Description
1B 58 41 42 43 44 45 46 00 00 01 08 00 00 04 00 00 00 17 00 00 00 00 1A
Start of message character (1Bh). SNP-X Command = X = 58h. SNP ID of target slave. X-Read request code = 01h. Segment Selector: %R in word mode. Data Offset: 0000h = 0(zero based) = %R1. Data Length: 0004h = 4 registers. Not used (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example. Start of message character (1Bh). SNP-X Command = X = 58h. X-Read response code = 81h. PLC Status Word. (00 00 for this example only) Status codes (Major and Minor errors). Length of data in response (8 bytes). Data (%R1-%R4). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example.
1B 58 81 00 00 00 00 08 00 31 32 33 34 35 36 37 38 17 00 00 00 00 B6
776
GFK-0582D
X-Write Command
The X-Write Command permits the SNP-X master to make a write request of a single continuous area of a single reference table in the slave PLC memory. The request specifies the segment selector, the offset, the data length, and the data. If two or less bytes of data is to be written, a single X-Request message is transmitted; up to two bytes of data may be included directly in the message. If more than two bytes of data are to be written, an X-Request message and an X-Buffer message must be transmitted by the SNP-X master. In this case, all of the data must reside in the X-Buffer message; the data field within the X-Request message is not used. Upon reception of an X-Request which uses a data buffer, the slave returns an Intermediate Response message to the master; the master then transmits the X-Buffer message. The maximum amount of data that can be written in the X-Buffer message is 1000 (decimal) bytes. The slave completes the command by returning an X-Response message to the master. If the slave detects an error when processing the X-Request or X-Buffer, an X-Response message is returned with an appropriate error code. Data bytes are always byte-aligned. Individual bit data to be written must be supplied at the proper bit locations within the data bytes. For example, %I4 occurs at the fourth bit within the data byte: 0000 1000 = 08h. The X-Write command may be directed to a particular slave device, or broadcast to all attached slave devices on the serial link. The X-Write command is directed to a specific slave device by using the specific slave SNP ID. (In Point-to-Point wiring only, the Null SNP ID may be used in lieu of a specific SNP ID; the slave device will respond to the Null SNP ID as if its own SNP ID had been specified.) The X-Write command is broadcast by using the broadcast SNP ID. The slave does not return any response messages to a broadcast X-Write request. Therefore, the master cannot detect a broadcast X-Write failure. After sending a broadcast X-Write request or its following X-Buffer message, the master must wait the Broadcast Delay time interval before sending the next message. The following diagrams and tables describe the actual protocol transactions involved in an XWrite command. Both the directed and broadcast varieties of the X-Write command are described. The X-Write command is shown both with and without the optional X-Buffer message.
GFK-0582D
777
7
Example of Direct X-Write Command (2 Bytes or Less)
This example shows the message exchange of a direct X-Write Command without a data buffer.
Master Slave
Byte Hex Value Number X-Write Request Message
1 2 3-10 11 12 13-14 15-16 17-18 19 20-23 24 1 2 3 4-5 6-7 8-9 10
1B 58 00 00 00 00 00 00 00 00 02 48 12 00 01 00 04 00 17 00 00 00 00 2D 1B 58 82 00 00 00 00 00 00 17
Start of message character (1Bh). SNP-X Command = X = 58h. SNP ID of target slave. X-Write request code = 02h. Segment Selector: %Q in bit mode. Data Offset: 0012h = 18 (zero based) = %Q19. Data Length: 0001h = 1 bit. Data to write (Max. 1 word = 2 bytes = 16 bits). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example. Start of message character (1Bh). SNP-X Command = X = 58h. X-Write response code = 82h. PLC Status Word. (00 00 for this example only) Status codes (Major and Minor errors). Data Length (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example.
11-14 15
00 00 00 00 07
778
GFK-0582D
[XWrite Request message] 1B 58 00 00 00 00 00 00 00 00 02 08 63 00 0A 00 00 00 17 54 1C 00 00 13 [Intermediate Response] 1B 78 82 00 00 00 00 00 00 17 00 00 00 00 03 [XWrite Data Buffer] 1B 54 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 17 00 00 00 00 58 [XWrite Response] 1B 58 82 00 00 00 00 00 00 17 00 00 00 00 07
GFK-0582D
779
7
Explanation of Direct X-Write Command (More than 2 Bytes)
Byte Hex Value Number X-Write Request Message
1 2 3-10 11 12 13-14 15-16 17-18 19 20 21-22 23 24 1 2 3 4-9 10
Description
1B 58 00 00 00 00 00 00 00 00 02 08 63 00 0A 00 00 00 17 54 1C 00 00 13
Start of message character (1Bh). SNP-X Command = X = 58h. SNP ID of target slave. X-Write request code = 02h. Segment Selector: %R in word mode. Data Offset: 0063h = 99 (zero based) = %R100. Data Length: 000Ah = 10 words. Not used (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Next message type = Buffer = T = 54h. Next message length (in bytes) = 001Ch = 28. Not used (always 0). Computed Block Check Code for this example. Start of message character (1Bh). SNP-X Intermediate Response = x = 78h. X-Write response code = 82h. Not used (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example. Start of message character (1Bh). SNP-X Command = T = 54h. 20 bytes of data to write %R100 - %R109.
11-14 15 1 2 3-22
31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
23
17
00 00 00 00 58 1B 58 82 00 00 00 00 00 00 17
End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example. Start of message character (1Bh). SNP-X Intermediate Response = X = 58h. X-Write response code = 82h. PLC Status Word. (00 00 for this example only) Status codes (Major and Minor errors). Data Length (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example.
11-14 15
00 00 00 00 07
780
GFK-0582D
Description
1B 58 FF FF FF FF FF FF FF FF 02 48 12 00 01 00 04 00 17 00 00 00 00 2D
Start of message character (1Bh). SNP-X Command = X = 58h. Broadcast SNP ID. X-Write request code = 02h. Segment Selector: %Q in bit mode. Data Offset: 0012h = 18 (zero based) = %Q19. Data Length: 0001h = 1 bit. Data to write (Max. 1 word = 2 bytes = 16 bits). End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example.
GFK-0582D
781
7
Example of Broadcast X-Write Command (More than 2 Bytes)
This example shows the message exchange of a broadcast X-Write command to write more than two bytes of data. This command requires a write request message and a subsequent data buffer message. Note that there is neither an intermediate response nor a final response message to the broadcast request.
Master Slave
782
GFK-0582D
Byte Hex Value Number X-Write Request Message
1 2 3-10 11 12 13-14 15-16 17-18 19 20 21-22 23 24 1 2 3-22
1B 58 FF FF FF FF FF FF FF FF 02 08 63 00 0A 00 00 00 17 54 1C 00 00 13 1B 54
Start of message character (1Bh). SNP-X Command = X = 58h. Broadcast SNP ID. X-Write request code = 02h. Segment Selector: %R in word mode. Data Offset: 0063h = 99 (zero based) = %R100. Data Length: 000Ah = 10 words. Not used (always 0). End of block character (17h) marks the beginning of the SNP-X message trailer. Next message type = Buffer = T = 54h. Next message length (in bytes) = 001Ch = 28. Not used (always 0). Computed Block Check Code for this example. Start of message character (1Bh). SNP-X Command = T = 54h. 20 bytes of data to write %R100 - %R109.
31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
23
17
24-27 28
00 00 00 00 58
End of block character (17h) marks the beginning of the SNP-X message trailer. Not used (always 0). Computed Block Check Code for this example.
GFK-0582D
783
STATE EVENT Master Idle (1) Wait for X-Att Resp (2) Master Open (3) Wait for Inter Resp (4) Wait for X-Resp (5) User Cmd = Establish new SNP-X session Receive X-Attach Resp msg User Cmd = X-Read or X-Write Action A State (2) Action B State (3/1) Action D State (4/5) Receive Intermediate Resp msg Receive X-Response msg Broadcast Delay timer expired Action E State (5/1) Action G State (3/1) Action H State (5) Action I State (1) Action F State (3/1) Action C State (3) Action I State (1) Action C State (3) Action I State (1) Response Timeout timer expired
The table below defines the actions taken by the SNP-X master in each state:
For any invalid intersection in this table, abort all master processing and return to State (1).
784
GFK-0582D
A Build and send X-Attach message to slave If broadcast X-Attach Start Broadcast Delay timer Else directed X-Attach Prepare to read X-Attach Response Start Response Timeout timer Transition to State (2) F B Cancel Response Timeout timer If improper X-Attach Response message Error! Abort all master processing in progress Transition to State (1) Else (User Cmd is now complete) Transition to State (3) for next cmd (User Cmd is now complete; always successful) Transition to State (3) for next cmd If User Cmd = X-Write, fetch data to be written Build and send X-Request message to slave If broadcast X-Request Start Broadcast Delay timer Else directed X-Request Prepare to read Response msg Start Response Timeout timer If X-Request with Buffer Transition to State (4) Else X-Request without Buffer Transition to State (5) Cancel Response Timeout timer If improper X-Response message or fatal error code returned Error! Abort all master processing in progress Transition to State (1) If non-fatal error (X-Response msg contains error code) Else successful response If X-Read response Distribute data returned from slave device (User Cmd is now complete) Transition to State (3) for next cmd Cancel Response Timeout timer If improper X-Response message or fatal error code returned Error! Abort all master processing in progress Transition to State (1) Else non-fatal error (X-Response msg contains error code) (User Cmd is now complete) Transition to State (3) for next cmd Build and send X-Buffer message to slave Start Broadcast Delay timer Transition to State (5) G C D H I Timeout Error! Abort all master processing Transition to State (1) E Cancel Response Timeout timer If improper Intermediate Response msg Error! Abort all master processing in progress Transition to State (1) Build and send X-Buffer message to slave Prepare to read Response msg Start Response Timeout timer Transition to State (5) GFK-0582D Chapter 7 Protocol Definition - CCM, RTU, SNP, and SNP-X 785
The following action routines are used by the SNP-X Master State Table:
7
SNP-X Slave State Table
STATE EVENT Receive Long Break Wait for Break (1) Action A State (2) Wait for X-Attach (2) Action A State (2) Wait for X-Request (3) Action A State (2) Wait for X-Buffer (4) Action A State (2) Receive X-Attach msg Action B State (3/1) Receive X-Request msg Receive X-Buffer msg Buffer Timeout timer expired Action C State (3/4/1) Action D State (3/1) Action E State (1)
The table below defines the actions taken by the SNP-X slave in each state:
For any invalid intersection in this table, abort all slave processing and return to State (1).
786
GFK-0582D
A Abort all slave processing in progress Prepare to receive X-Attach msg Transition to State (2) D B If improper X-Attach message Error! Transition to State (1) If X-Attach for another slave device (No error) Transition to State (1) If not broadcast X-Attach Build and send X-Attach Response message Prepare to receive next X-Request msg Transition to State (3) Cancel Buffer Timeout timer If reportable error with X-Buffer message Build and send error X-Response message If fatal error Abort all slave processing in progress Transition to State (1) Else non-fatal error Transition to State (3) Perform requested service (Read/Write) If preceding X-Request was not broadcast Build and send X-Response message Prepare to receive next X-Request msg Transition to State (3) C If reportable error with X-Request message Build and send error X-Response msg If fatal error Abort all slave processing in progress Transition to State (1) Else non-fatal error Remain in State (3) If X-Buffer message will follow If not broadcast X-Request Build and send Intermediate Resp message Start Buffer Timeout timer Transition to State (4) Perform request service (Read/Write) If not broadcast X-Request Build and send X-Response message Prepare to receive next X-Request msg Remain in State (3) E Buffer Timeout Error! Abort all slave processing Transition to State (1)
The following action routines are used by the SNP-X Slave State Table:
GFK-0582D
787
Chapter
This chapter provides the information necessary for you to build serial communications cables from the CMM to another device, and documents standard GE Fanuc serial products such as converters, isolators, and cables. The chapter is divided into several sections:
D D D D D
Section 1: Cable Assembly Specifications Section 2: RS-232 Cables Section 3: RS-422 Cables Section 4: Station Manager Serial cable (IC693CBL316) Section 5: Multidrop cable (IC690CBL714A)
Note: Information on the IC690ACC903 Port Isolator can be found in Appendix G, and information on the IC690ACC901 Miniconverter/Cable kit can be found in Appendix O.
GFK-0582D
81
Connectors
D D Cable connector to CMM ports 1 or 2: Male, D-Subminiature Type, Cannon DB25P (solder pot) with DB110963-3 Hood, or equivalent standard RS-232 connector. Connectors for ports 1 and 2 are located on the Series 90-70 CMM module. Both ports are brought out on a single connector on the Series 90-30 CMM module. An IC693CBL305 Wye cable is provided with each Series 90-30 CMM module that provides a separate connector for each port. Connector to external device: specified by external device manufacturer.
Cable manufacturers produce computer/communications cables rated for RS232/422/485 use. As an alternative, Category 5 Ethernet cable (TIA/EIA 568A) often meets the above specifications and usually costs less than RS232/422/485 communications cable. See your cable supplier for their recommendations. At distances under 50 feet (15 meters), almost any twisted pair or shielded twisted pair cable will work, as long as the wire pairs are connected correctly. When using RS-422/RS-485, the twisted pairs should be matched so that both transmit signals make up one twisted pair and both receive signals make up the other twisted pair. If this is ignored, crosstalk resulting from the mismatching will affect the performance of the communications system. When routing communication cables outdoors, transient suppression devices can be used to reduce the possibility of damage due to lightning or static discharge.
Caution
Care should be exercised to ensure that both the CMM module and the device to which it is connected are grounded to a common point. Failure to do so could result in damage to the equipment.
82 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
25-Pin FEMALE
25-Pin MALE
a44918
25-Pin FEMALE
a44919
25-Pin FEMALE
25-Pin MALE
25-Pin FEMALE
PIN 2 3 4 5 7 20 8
25-Pin MALE
25-Pin FEMALE
a44904
25-Pin MALE
GFK-0582D
83
25-Pin FEMALE
TPK.A.44904 5-21-92
PIN TD RD RTS CTS DCD DTR GND SHLD 25-Pin MALE 2 3 4 5 8 20 7 1 PIN 3 RXD 2 TXD 5 CTS 8 DCD 20 DTR 7 GND 25-Pin MALE
a44920
25-Pin FEMALE
PC-AT
1 2 3 4 7 8 5
1 2 3 8 5 20 7
CMM
9-PIN MALE
25-Pin MALE
25-Pin FEMALE
25-Pin MALE
25-Pin MALE
a44033
CMM
25-Pin FEMALE
84
GFK-0582D
This section provides information on the RS-485 interface and on constructing RS-422/RS-485 cables.
Caution
Care must be taken that common mode voltage specifications are met. Common mode conditions that exceed those specified will result in errors in transmission and/or damage to Series 90 PLC components.
GFK-0582D
85
8
Table 8-1. Series Six RS-422 Signal Cross-Reference to the EIA Standard
Function
Send Data + Send Common Receive Data + Receive Common Ready to Send + Ready to Send Common Clear to Send + Clear To Send Common Signal Ground
During a mark condition (logic 1), B will be positive with respect to A. During a space condition (logic 0), B will be negative with respect to A.
Note
The CMM modules do not support hardware flow control in an RS422/RS485 connection arrangement.
86
GFK-0582D
**
25-PIN FEMALE
PIN
PIN
9 21 13 25 24 10 22 11 23 7 1
13 25 9 21 24 10 22 11 23 7
*TERM
RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
25-PIN MALE
* **
25-PIN MALE
a44922
**
25-PIN FEMALE
**
25-PIN FEMALE
* **
PIN
PIN J1 (J2) 18 17 13 14 4 5 (1) (6) (8) (9) (4) (5) TXD TXD RXD RXD RTS CTS
a44923
* TERM
RD (B) RD (A) SD (B) SD (A) RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD 25-PIN MALE
* *
(7)
0V
25-PIN MALE
25-PIN FEMALE
TERMINATE CONNECTION: ON THE CMM,JUMPER INTERNAL 120 OHM RESISTOR. ON THE CCM2,JUMPERS ARE INSTALLED ON THE PCB FOR TERMINATION (JUMPER T2 OR T6). ON THE CMM311, ONLY PORT 2 CAN SUPPORT RS-422/RS-485.
**
25-PIN FEMALE
PIN
PIN
SD (A) SD (B) RD (A) RD (B) RTS (A) RTS (B) CTS (A) CTS (B) TERM 0V SHLD
25-PIN MALE
9 21 13 25 10 22 11 23 24 7 1
22 10 23 11 9 25 4 8 5 20 7
*TERM
RTS DCD CTS DTR 0V
* **
25-PIN MALE
a44924
OIT
25-PIN FEMALE
GFK-0582D
87
**
25-PIN FEMALE
PIN
PIN
9 21 13 25 10 22 24 11 23 7 1
24 25 23 22 12 13 10 11
0V
25-PIN MALE
a44925
DCA
25-PIN FEMALE
25-PIN FEMALE
PIN
PIN 13 25 9 21 24 10 22 11 23 7 1
SD (A) SD (B) RD (A) RD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
25-PIN MALE
9 21 13 25 24 10 22 11 23 7 1
RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
25-PIN MALE
a44926
**
25-PIN FEMALE
PIN 13 25 9 21 24 10 22 11 23 7 1
NOTE WHEN WIRING RS-422 /485 MULTIDROPCABLES, REFLECTIONS ON THE TRANSMISSION LINE CAN BE REDUCED BY CONFIGURING THE CABLE IN A DAISY CHAIN FASHION AS SHOWN BELOW. MASTER CMM SLAVE 1
RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
25-PIN MALE
**
25-PIN FEMALE
CMM SLAVE 2
PIN 10 11 12 13 9 6 14 15 8 7 1
ALSO IT IS RECOMMENDED TO MAKE ANY NECESSARY CONNECTIONS INSIDE THE CABLE CONNECTOR TO BE MOUNTED ON THE CMM. IT IS NOT RECOMMENDED TO USE TERMINAL STRIPS OR OTHER TYPES OF CONNECTORS ALONG THE LENGTH OF THE TRANSMISSION LINE.
RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
15-PIN MALE
* **
TERMINATE CONNECTION AT FIRST AND LAST DROPS. FOR THE CMM AND SERIES 90 CPUS, INSTALL JUMPER TO CONNECT INTERNAL 120 OHM RESISTOR. ON THE CMM311, ONLY PORT 2 CAN SUPPORT RS-422/RS-485.
15-PIN FEMALE
TO OTHER CMMs (MAXIMUM OF 8 CMMs ON A MULTIDROP) TERMINATE THE RD (B) SIGNAL ONLY AT END OF MULTIDROP CABLE
25-PIN FEMALE
**
PIN SD (A) SD (B) RD (A) RD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD 25-PIN MALE 9 21 13 25 24 10 22 11 23 7 1
PIN 13 25 9 21 24 10 22 11 23 7 1 RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
* **
25-PIN TERMINATE CONNECTION: ON THE CMM, MALE JUMPER INTERNAL 120 OHM RESISTOR. ON THE CMM311, ONLY PORT 2 CAN SUPPORT RS-422/RS-485.
a45237
**
25-PIN FEMALE
**
25-PIN FEMALE
PIN
a45238
PIN 13 25 9 21
SD (A) SD (B) RD (A) RD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
25-PIN MALE
9 21 13 25 24 10 22 11 23 7 1
RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
25-PIN MALE
24 10 22 11 23 7 1
**
25-PIN FEMALE
PIN 13 25 9 21 24 10 22 11 23 7 1
RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
25-PIN MALE
**
25-PIN FEMALE
PIN 10 11 12 13 9 6 14 15 8 7 1
RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
15-PIN MALE
15-PIN FEMALE
TO OTHER DEVICES (MAXIMUM OF 8 CMMs ON A MULTIDROP) TERMINATE THE RD SIGNAL ONLY AT END OF MULTIDROP CABLE
* **
TERMINATE CONNECTION AT FIRST AND LAST DROPS. FOR SERIES 90 DEVICES, INSTALL JUMPER TO CONNECT INTERNAL 120 OHMS RESISTOR. ON THE CMM311, ONLY PORT 2 CAN SUPPORT RS-422/RS-485.
GFK-0582D
89
8
2Wire and 4Wire RTU RS422/RS485 Cable Connections
The RTU protocol only supports half duplex operation; however, it may be wired in either a 2wire or 4wire arrangement. In 4Wire RTU, the four wires are comprised of two transmit wires and two receive wires (see the following RTU Wiring Diagrams section). In 2Wire RTU, the transmit and receive pins are jumpered together in a parallel connection on the serial port connector at each device so that the two wires are shared by the transmit and receive functions. In the 2Wire figures below, notice that SD (A) is jumpered to RD (A), and SD (B) is jumpered to RD (B).
Note that the cable shield should only be grounded at one end, and the signal lines should be twistedpair. For installations where an added degree of reliability and security is desired or where noise is known to be a problem, the application of port isolators is recommended (see the section Isolators below). The use of high quality, lowcapacitance cable can help ensure reliable communications, especially over longer distances. Some cable manufacturers produce cable that is rated for RS485 use. Also, Category 5 Ethernet cable (TIA/EIA 568A) is sometimes a good lowercost match for this application. Check with your cable vendor for recommendations.
Termination
Two termination resistors are required across the RD (receive) conductors for these wiring schemes whether there are only two devices connected in a pointtopoint arrangement, or whether there are several devices connected in a multidrop arrangement. The resistance value chosen should be close to the characteristic impedance of the cable (typically, 120 ohms). For RTU 2Wire, the termination resistors should be across the extreme ends of the twistedpair. In RTU 4Wire, there are two twisted pairs. Each twisted pair should have one termination resistor, mounted on the receive end, across RD (A) and RD (B), of the twisted pair. See the following RTU Wiring Diagrams section for examples of this.
Isolators
Isolators are recommended for high noise environments or for long cable runs to further reduce the chance of noise intrusion or damage due to ground imbalance. The GE Fanuc IC690ACC903 Port Isolator is suitable for this purpose. For use with RTU protocol, this unit will connect directly to the 15pin Port 2 connector of the CPU351, 352, and 363 modules, but will require a custombuilt cable to adapt to the 25pin connectors on the CMM modules. Appendix G has data on the IC690ACC903 isolator.
810 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
PIN SD (A) SD (B) RD (A) RD (B) 13 25 9 21 24 10 22 11 23 7 1 RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
25-PIN MALE
a45237
**
25-PIN FEMALE
* TERMINATION CONNECTIONS: On the CMM, jumper pins 24 and 25 to connect * * On the CMM311, only Port 2 can support RS-422/RS-485.
internal 120 ohm resistor. If RTU master device does not have an internal termination resistor, connect resistor across RD (A) and RD (B) at the RTU master device end.
PIN SD (A) SD (B) RD (A) RD (B) 10 11 12 13 9 6 14 15 8 7 1 RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
15-PIN MALE
15-PIN FEMALE
Port 2
** Series
shown) to connect internal 120 ohm resistor. If RTU master device does not have internal termination resistor, connect 120 ohm resistor across RD (A) and RD (B) at the RTU master device end. * * On CPUs 351, 352, and 363, only Port 2 supports both RTU and RS422/RS485
PIN
13 25 9 21 24 10 22 11 23 7
25-PIN MALE
a44922
**
25-PIN FEMALE
* TERMINATION CONNECTIONS: On the CMM, jumper pins 24 and 25 to connect the * * On the CMM311, only Port 2 supports RS-422/RS-485.
internal 120 ohm resistor. If the RTU master device does not have an internal termination resistor, connect a resistor across RD (A) and RD (B) at the RTU master device end.
PIN SD (A) SD (B) RD (A) RD (B) 10 11 12 13 9 6 14 15 8 7 1 RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
Port 2 15-PIN FEMALE
** Series
15-PIN MALE
CMM modules
No configuration settings are provided for the Duplex Mode parameter. A CMM (both Series 9030 and 9070) can handle either type of connection scheme; however, to avoid locking its serial port in an endless queryresponse loop, we recommend that when using the 2Wire connection method you do not attempt to send a Loopback/Maintenance message (Message 08). For details, please see the Operating Note item for RTU Message (08), found in the RTU section of Chapter 7.
812
firmware file to your CPU through Port 1. Please call your distributor for upgrade information for these two CPUs.
GFK-0582D
813
8
2Wire and 4Wire RS422/RS485 Serial I/O Connections Connection Diagrams
User Device
PIN SD (A) SD (B) RD (A) RD (B) 10 11 12 13 9 6 14 15 8 7 1 RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
Port 2 15-PIN FEMALE
** Series
15-PIN MALE
* TERMINATION CONNECTIONS: On the CPU end, jumper pins 9 and 10 (as shown) to
connect internal 120 ohm resistor. If user device does not have internal termination resistor, connect 120 ohm resistor across RD (A) and RD (B) at the user device end.
* * On CPUs 351, 352, and 363, only Port 2 supports both Serial I/O and RS422/RS485
User Device
PIN SD (A) SD (B) RD (A) RD (B) 10 11 12 13 9 6 14 15 8 7 1 RD (A) RD (B) SD (A) SD (B) TERM RTS (A) RTS (B) CTS (A) CTS (B) 0V SHLD
15-PIN MALE
Port 2 15-PIN FEMALE
** Series
CPU352, CPU363, Ports Supported, starting with 1 and 2 firmware release 8.00
Supported, starting with Only on Port 2 using firmware release 10.00** either a COMMREQ or VersaPro 1.1 (or later) software Not supported N/A
CPU351, CPU352, CPU363, Standard SNP port (via power supply connector) Series 9030 CPUs: 311341 Series 9070 CPUs: All *
Not supported
Not supported
Not supported
N/A
Firmware 10.00, required for Serial I/O Read, will not be made available for CPU351.
** The Serial I/O Read feature requires the use of VersaPro 1.1 (or later version) PLC programming software. It is currently not supported by other programming software.
VersaPro Software. In VersaPro 1.10 (or later version), the Duplex Mode parameter for Serial I/O on Port 2 can be changed on a CPU352 or CPU363 modules Port 2 configuration screen. This Duplex Mode parameter is only supported in VersaPro 1.10 or later; it is not supported in Logicmaster or Control as of this writing. The following figure shows an example of a VersaPro Port 2 configuration screen for a CPU363. (Port 1, which only supports RS232 on these modules, does not have a Duplex Mode parameter.).
Typical Applications
D Connect a Personal Computers 9-pin serial port to the RJ-11 faceplate serial port on CPUs 351, 352, and 363 for programming, configuring, firmware updating, and monitoring purposes. Connect a Personal Computers 9-pin serial port to the Station Manager port on an IC693CMM321 or IC697CMM742 Ethernet module or on an IC693CPU364 CPU module, which has a built-in Ethernet interface. Connect a Personal Computers 9-pin serial port to an IC693DSM302 modules RJ-11 COMM port for loading motion programs (1 - 10) and firmware. Connect a Personal Computers 9-pin serial port to an IC693DSM314 modules RJ-11 COMM port for loading firmware (motion programs for this module are loaded across the PLC backplane). Connecting to Port 1 of Series 9070 CPUs CPX772, CPX782, CPX928, and CPX935.
End View of RJ11 Connector a45485A
D D
Pin 1
Pin 1
Figure 8-21. IC693CBL316A Serial Cable Table 8-3. IC693CBL316A PinOut Connections
9-Pin Connector 7 2 5 5 3 8 RJ-11 Connector 1 2 3 4 5 6
816
GFK-0582D
Please see the section Application Example for Cable IC690ACC714A later in this chapter.
Specifications
H H H H H Connector A: DB15F, 15-pin female connector with M3 latchblocks Connectors B and C: DB15M, 15-pin right angle, male connector with spring clips Wire: Cable consists of three individually shielded pairs of 22-gauge stranded conductors. Belden #8777 or equivalent. Jumpers: All jumpers are made of #22 AWG (UL1061) insulated wire. Length: The length from the back of Connector A to entry into Connector B is 6 inches (+/ 0.5 inch). The length from the back of Connector C to entry into Connector B is 40 inches (+/ 1.0 inch). Connector B
Connector C
M3 Latching Blocks (2)
Pin 1
Connector A
Pin 1
M3 pan head screws (2). Screws must not protrude through the end of the Latching Blocks.
GFK-0582D
817
8
IC690CBL714A Multi-Drop Cable Wiring Diagram
NOTE: If Connector A is used at the end node of a multidrop system, termination should be used. If connected to a GE Fanuc device with builtin termination resistor, jumper pins 9 and 10 of Connector A; otherwise, connect a 120 ohm resistor across pins 10 and 11 of Connector A.
8 14 15 5 7 10 11 12 13
Pin 5 7 10 11 12 13 6 8 14 15 9
Signal +5V 0V RD(A) RD (B) SD (A) SD (B) RTS (A) CTS (B) RTS (B) CTS (A) RT
10 11 12 13 9 6 8 14 15 N.C. 5
Conn. B PLC A
C P U
Conn. B PLC B
C P U
Conn. C PLC C
C P U
IC690CBL714A Conn. A
* Jumper pins 9 and 10 on Connector A to use the IC690ACC901s internal termination resistor
GFK-0582D
819
Chapter
This chapter describes the Serial I/O protocol, (formerly called Custom Protocol or Generic Output) which allows you to create a custom protocol in ladder logic to control a variety of communication activities through a CPU serial port. Serial I/O uses a series of Communications Request (COMMREQ) ladder logic instructions to accomplish this. As of this writing, the Serial I/O function only applies to the following three Series 90 CPUs: IC693CPU351, 352, and 363. Note that the CPU351 cannot perform Serial I/O Read functions. CPUs 352 and 363 can perform all Serial I/O tasks. Serial I/O is implemented in a similar manner in the VersaMax PLC (for information, see GFK1503, VersaMax PLC Users Manual). This chapter also contains instructions for using COMMREQs to configure the CPU serial ports for SNP, RTU, or Serial I/O protocol and for switching from one protocol to another on a given port. Content of this chapter: H H H Overview of Serial I/O Protocol Communications Format of the COMMREQ function Configuring Serial Ports Using the COMMREQ Function h h h h H h h h h h h h h h h
GFK-0582D
RTU Slave/SNP Slave Operation with a Programmer Attached COMMREQ Command Block for Configuring SNP Protocol COMMREQ Data Block for Configuring RTU Protocol COMMREQ Data Block for Configuring Serial I/O
Serial I/O COMMREQ Commands Initialize Port Set Up Input Buffer Flush Input Buffer Read Port Status Write Port Control Cancel Operation Autodial Write Bytes Read Bytes Read String
91
9
Example of Serial I/O Communication
In Serial I/O communications, a COMMREQ instruction controls data flow between an external device and user memory. The example shown in the figure below is for a Read operation. All data read from an external device is buffered through the Internal Input Buffer. The Internal Input Buffer is required because the PLC CPU and the external device do not run in synchronization. So the data is temporarily stored in the buffer until the PLC CPU is ready to read it. The Internal Input Buffer is not a part of user memory. Its data can only be accessed by using the appropriate COMMREQ, discussed later in this chapter. Data written from the PLC to an external device does not pass through the Internal Input Buffer The Internal Input Buffer has a maximum size of 2K bytes (the default setting). Data is read out of the buffer sequentially on a FirstInFirstOut (FIFO) basis. As data is read, it is removed from the buffer, which makes room for incoming data. The COMMREQ instruction can specify how much data is to be read from the buffer; it doesnt have to read the entire buffer. In the figure below, the arrow lines indicate that data flows from the Internal Input Buffer to User Data Memory and that this data flow is controlled and directed by the COMMREQ. In Serial I/O communications, COMMREQs must be used to (1) control communications setup functions, and (2) to direct the transfer of data, either to or from the serial port. Several COMMREQs may be required to perform a complete communication cycle (see the next section).
PLC CPU
COMM REQ
Status Word
92
GFK-0582D
2.
3. 4. 5.
6.
Operating Notes
Note that the data placed in the specified user data memory area by a Read Bytes or Read String COMMREQ will be overwritten the next time that COMMREQ runs. If the data is to be stored for future use, you will need to move the data into another memory area before that COMMREQ runs again. Step 5. includes error checking to ensure that data was transferred correctly. If not transferred correctly, corrective action could be taken by repeating steps 2. and 4. You would need to limit the number of these retries to avoid the possibility of an endless loop. To facilitate this, you could program each step in a separate subroutine block and call each one in the proper order from the main program block or from another subroutine block. This would allow you to more easily repeat portions of the communication cycle by simply calling the applicable blocks. Also, this modular programing style is generally more easily maintained and understood, and it lends itself to a team programming strategy.
GFK-0582D
93
9
Format of the Communication Request Function
Serial I/O is implemented through the use of Communication Request (COMMREQ) functions. The operations of the protocol, such as transmitting a character through the serial port or waiting for an input character, are implemented through the COMMREQ function block. The COMMREQ requires that all its command data be placed in the correct order (in a command block) in the CPU memory before it is executed. The COMMREQ should then be executed by a contact of a transition (oneshot) coil to prevent sending the data multiple times. A series of Block Move (BLKMV) commands should be used to move the words to create a command block in the Register tables. The COMMREQ function has three inputs and one output. When the function receives power flow, a command block of data is sent to the specified module.
Choices
On or Off
Description
When the Enable input goes high, the communications request is performed. R, AI, AQ IN contains the address of the first word of the command block. I, Q, M, T, G, SYSID contains the rack number (most significant byte) and R, AI, AQ, slot number (least significant byte) of the target device. For the constant CPU, SYSID must specify rack 0, slot 1 (0001 hex). R AI, AQ, constant High, Low TASK specifies which port on the target device will be used: task 19 (13 Hex) for port 1 task 20 (14 Hex) for port 2 FT goes high if an error is detected processing the COMMREQ: The specified target address is not present (SYSID). The specified task is not valid for the device (TASK). The data length is 0. The devices status pointer address (in the command block) does not exist.
TASK
FT
94
GFK-0582D
GFK-0582D
95
9
Example of a Serial I/O COMMREQ Instruction
The following example is of a Read Port Status Function, COMMREQ #4303. In the example, when %M0021 (should be a transition type) is ON, a Command Block whose location starts at %R0032 (specified at the IN input) controls communications through Port 2 (specified by TASK input = 20, (14hex)) of the CPU (rack 0, slot 1, specified by SYSID = 0001). If an error occurs processing the COMREQ, %Q0110 is set by the FT (Fault) output. When the port status data is read, the results are placed in two words (32 bits), starting at address %M0101.
%M0021 | | %R0032 0001
%Q0110 ( )
20 (14h) TASK (Port 2) 0001 = Rack 0, Slot 1 Series 9030 PLC, Rack 0 CPU
Slot No:
10
COMMREQ Command Block Address %R0032 %R0033 %R0034 %R0035 %R0036 %R0037 %R0038 %R0039 %R0040 Value* 0003 0000 0008 0024 0000 0000 4303 0076 0101 Description Data Block Length NOWAIT Mode COMMREQ Status Word Memory Type (%R) COMMREQ Status Word Address 1 (%R0025) Not Used Not Used Read Port Status Command Port Status Memory Type (%M) Port Status Memory Starting Location (%M0101) %M0101 %M0132 Port Status Memory %R0025 COMMREQ Status Word
96
GFK-0582D
Unit
Valid Range1
Dec
Hex
Length
Registers (%R) Analog Inputs (%AI) Analog Outputs (%AQ) Discrete Inputs (%I) Discrete Outputs (%Q)
Discrete Temporaries (%T) Discrete Internals (%M) Discretes (%SA) Discretes (%SB) Discretes (%SC)
08 10 12 70 16 72 18 74 20 76 22 78 24 80 26 82 28 84 30 86 56
08h 0Ah 0Ch 46h 10h 48h 12h 4Ah 14h 4Ch 16h 4Eh 18h 50h 1Ah 52h 1Ch 54h 1Eh 56h 38h
word word word bit byte bit byte bit byte bit byte bit byte bit byte bit byte bit byte bit byte
1-maximum units 1-maximum units 1-maximum units 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2 1-maximum units 1-maximum units2
The maximum addressable ranges for each memory type depends on the model of CPU and memory configuration. When using a byte-oriented memory type, the corresponding memory address offsets and number of elements are expressed in bytes, not bits. Bit type memory does not have to be bytealigned.
Notes
There is no difference between bit and byte-oriented memory types in terms of processing speed, message length or message transfer time. COMMREQ Status Word Pointer memory type is 0based. The Data Area memory is 1based.
GFK-0582D Chapter 9 Serial I/O Protocol 97
9
Configuring Serial Ports Using the COMMREQ Function
The following tables list the command block values required for setting up a Serial Port for SNP, RTU, and Serial I/O. All values are in hexadecimal unless otherwise indicated. The BLKMV commands that are used to create the command block are described in the example.
Timing
If a port configuration COMMREQ is sent to a serial port that currently has an SNP/SNPX master (for example, the programmer) connected to it, the serial port configuration specified by the COMMREQ does not take effect until the CPU detects a loss of the SNP/SNPX master. This occurs the configured T3 time after the master disconnects. The COMMREQ status word for the port configuration COMMREQ is updated as soon as the CPU verifies that the specified configuration is valid. That means a COMMREQ Successful value may be returned by the Port Configuration COMMREQ before the specified configuration is actually installed.
98
GFK-0582D
Example
1. 2. 3. 4. Port 1 is running RTU Slave protocol at 9600 baud. A programmer is attached to port 1. The programmer is using 9600 baud. The CPU installs SNP Slave on port 1 and the programmer communicates normally. The programmer stores a new configuration to port 1. The new configuration sets the port for SNP Slave at 4800 baud (it will not take effect until the port loses communications with the programmer). When the CPU loses communications with the programmer, the new configuration takes effect.
5.
GFK-0582D
99
9
COMMREQ Command Block for Configuring SNP Protocol
Table 9-2. COMMREQ Command Block for SNP
Values
Address Address + 1 Address + 2 Address + 3 10H 0 = No Wait 0008 = %R, register memory Zerobased number that gives the address of the COMMREQ status word (for example, a value of 99 gives an address of 100 for the status word) 0 (Only used in Wait/No Wait mode) 0 (Only used in Wait/No Wait mode) FFF0H 0001 0000=Slave 7=38400, 6=19200, 5=9600, 4=4800 0 = None, 1 = Odd, 2 = Even 1 = None 0 = None, 1 = 10ms, 2 = 100ms, 3 = 500ms 0 = Long, 1 = Medium, 2 = Short, 3 = None 1 = 8 bits 0 = 1 Stop Bit, 1 = 2 Stop bits not used not used userprovided* userprovided* userprovided* userprovided*
Meaning
Data Block Length WAIT/NOWAIT Flag Status Word Pointer Memory Type Status Word Pointer Offset
Address + 4 Address + 5 Address + 6 Address + 7 Address + 8 Address + 9 Address + 10 Address + 11 Address + 12 Address + 13 Address + 14 Address + 15 Address + 16 Address + 17 Address + 18 Address + 19 Address + 20 Address + 21
Idle Timeout Value Maximum Communication Time Command Word (serial port setup) Protocol: 1=SNP Port Mode Data Rate Parity Flow Control Turnaround Delay Timeout Bits Per Character Stop Bits Interface Duplex Mode Device identifier bytes 1 and 2 Device identifier bytes 3 and 4 Device identifier bytes 5 and 6 Device identifier bytes 7 and 8
The device identifier for SNP Slave ports is packed into words with the least significant character in the least significant byte of the word. For example, if the first two characters are A and B, the Address + 18 will contain the hex value 4241.
910
GFK-0582D
Meaning
Data Block Length WAIT/NOWAIT Flag Status Word Pointer Memory Type Status Word Pointer Offset
Address + 4 Address + 5 Address + 6 Address + 7 Address + 8 Address + 9 Address + 10 Address + 11 Address + 12 Address + 13 Address + 14 Address + 15 Address + 16 Address + 17 Address + 18 Address + 1921
Idle Timeout Value Maximum Communication Time Command Protocol: 0003=RTU Port Mode: 0000=Slave Data Rate Parity Flow Control Turnaround delay Timeout Bits per Character Stop Bits Interface Duplex Mode Device Identifier Device Identifier
GFK-0582D
911
9
COMMREQ Data Block for Configuring Serial I/O Protocol
Table 9-4. COMMREQ Data Block for Serial I/O
Values
Address Address + 1 Address + 2 Address + 3 10H 0 = No Wait 0008 = %R, register memory Zerobased number that gives the address of the COMMREQ status word (for example, a value of 99 gives an address of 100 for the status word) 0 (Only used in Wait/No Wait mode) 0 (Only used in Wait/No Wait mode) FFF0H 0005 0 = Slave 6=19200, 5=9600, 4=4800 0 = None, 1 = Odd, 2 = Even 0 = Hardware, 1 = None 0 = None 0 = Long 0=7 bits, 1=8 bits 0 = 1 stop bit, 1 = 2 stop bits not used 0 = 2wire, 1 = 4wire, 2 = pointtopoint not used
Meaning
Data Block Length WAIT/NOWAIT Flag Status Word Pointer Memory Type Status Word Pointer Offset
Address + 4 Address + 5 Address + 6 Address + 7 Address + 8 Address + 9 Address + 10 Address + 11 Address + 12 Address + 13 Address + 14 Address + 15 Address + 16 Address + 17 Address + 1821
Idle Timeout Value Maximum Communication Time Command Protocol: 0005=Serial IO Port Mode Data Rate Parity Flow Control Turnaround Delay Timeout Bits per Character Stop Bits Interface Duplex Mode Device Identifier
912
GFK-0582D
Protocol Incompatibility
The COMMREQ function blocks supported by Serial I/O are not supported by other currently existing protocols (such as SNP slave, SNP master, and RTU slave). Errors are returned if a Serial I/O COMMREQ is attempted for a port configured for one of those other protocols. To avoid this problem, you must configure the port for Serial I/O. There are two ways to do this: 1. Using the configuration software, configure the protocol for the applicable port to a setting of CUSTOM or Serial I/O. Either one or the other will be offered as a choice for ports supporting Serial I/O. For example, in VersaPro 1.1, in the CPU363 Serial Port configuration window, the Port Mode parameter choice would be Serial I/O. However, the term CUSTOM is used both in Logicmaster and in the VersaPro 1.1 Serial Port configuration window for CPU351. Activate a COMMREQ that configures the applicable port for Serial I/O, as discussed in the previous section.
2.
GFK-0582D
913
9
Serial I/O COMMREQ Status Word Codes
A value of 0001 (hex) is returned in the COMMREQ Status Word upon successful completion of the COMMREQ. Any other value returned is an error code where the low byte is a major error code and the high byte is a minor error code. In the table below, the codes are shown in decimal format with hexadecimal format in parentheses. For example, a code of 0E0C (hex), has the following meaning: h h The 0C (the low byte) is the major error code and designates a Local error. The 0E (the high byte) is the minor error code and designates that COMMREQ data is invalid. Minor Error Code Description
13 (0Dh)
14 (0Eh)
Successful Completion (this is the expected completion value in the COMMREQ status word). Local error Error processing a local command. The minor error code identifies the specific error. 1 (01h) Waittype command is not permitted. Use NoWait command. 2 (02h) COMMREQ command is not supported. 5 (05h) Error writing COMMREQ status word to PLC memory. 6 (06h) Invalid PLC memory type specified. 7 (07h) Invalid PLC memory offset specified. 8 (08h) Unable to access PLC memory. 9 (09h) Data length exceeded. 12 (0Ch) COMMREQ data block length too small. 14 (0Eh) COMMREQ data is invalid. 15 (0Fh) Could not allocate system resources to complete COMMREQ. Remote error Error processing a remote command. The minor error code identifies the specific error. 2 (02h) String length exceeds end of reference memory type. 3 (03h) COMMREQ data block length is too small. String data is missing or incomplete. 4 (04h) Receive timeout awaiting serial reception of data 48 (30h) Serial output timeout. The serial port was unable to transmit the string. (Could be due to missing CTS signal when the serial port is configured to use hardware flow control.) 50 (32h) COMMREQ timeout. The COMMREQ did not complete within a 20second time limit. Autodial Error An error occurred while attempting to send a command string to an attached external modem. The minor error code identifies the specific error. 1 (01h) Not used. 2 (02h) The modem command string length exceeds end of reference memory type. 3 (03h) COMMREQ Data Block Length too small. Output command string data missing or incomplete. 4 (04h) Serial output timeout. The serial port was unable to transmit the modem autodial output. 5 (05h) Response was not received from modem. Check modem and cable. 6 (06h) Modem responded with BUSY. Modem is unable to complete the requested connection. The remote modem is already in use; retry the connection request later. 7 (07h) Modem responded with NO CARRIER. Modem is unable to complete the requested connection. Check the local and remote modems and the telephone line. 8 (08h) Modem responded with NO DIALTONE. Modem is unable to complete the requested connection. Check the modem connections and the telephone line. 9 (09h) Modem responded with ERROR. Modem is unable to complete the requested command. Check the modem command string and modem.
914
GFK-0582D
Description (continued)
Modem responded with RING, indicating that the modem is being called by another modem. Modem is unable to complete the requested command. Retry the modem command later. An unknown response was received from the modem. Modem is unable to complete the requested command. Check the modem command string and modem. The response should be CONNECT or OK. COMMREQ timeout. The COMMREQ did not complete within a 20second time limit.
50 (32h)
GFK-0582D
915
9
Serial I/O COMMREQ Commands
The following COMMREQs are used to implement Serial I/O:
Set Up Input Buffer (4301) Flush Input Buffer (4302) Read Port Status (4303)
916
GFK-0582D
NEW COMMREQ Currently pending COMMREQs Write Bytes (4401) Read Bytes (4402) Read String (4403) Autodial (4400) Write Bytes (4401) Initial- Set Up Flush ize Input Input Port Buffer Buffer (4300) (4301) (4302) Yes Yes Yes Yes No No Yes No No Read Port Status (4303) Yes Yes Yes Write Port Control (4304 Yes Yes Yes Read Bytes (4402) Read Cancel String Opera(4403) tion (4399) Yes No No Yes Yes Yes Serial Port Setup (FFF0 ) No No No
No No No
No Yes Yes
Yes No No
GFK-0582D
917
Operating Notes
Note: COMMREQs that are cancelled due to this command executing do not have their respective COMMREQ status words updated. Caution: If this COMMREQ is sent when a Write Bytes (4401) COMMREQ is transmitting a string from a serial port, transmission is halted. The position within the string where the transmission is halted is indeterminate. In addition, the final character received by the device the CPU is sending to is also indeterminate.
918
GFK-0582D
Operating Notes
It is not possible to set the buffer length to zero. If zero is entered as the buffer length, the buffer size will be set to the 2048 byte default. If a length greater than 2048 bytes is specified, an error is generated.
GFK-0582D
919
920
GFK-0582D
2.
The Port Status data returned by this function indicates the status of various tasks, such as whether or not a task was successfully completed. Each bit in the status word has a separate meaning, so the status of several items can be determined with one of these COMMREQs. The table on the next page defines the meaning of each Port Status word bit. A second Port Status word reports on the remaining number of characters in the input buffer. The Port Status memory type (address + 7) can specify either bit type (i.e. %M) or word type (i.e. %R) memory. Bit type memory does not have to be bytealigned. Memory codes are found earlier in this chapter. Port Status memory consists of two words worth of data. So if bit type memory is specified, 32 consecutive bits (two words worth) will be used starting with the bit specified by address +8 of the Command Block. If word type memory is specified, two consecutive words will be used starting with the word specified by address +8 of the Command Block. In the example below, bit type memory (%M) is specified for the Port Status words. In this case, the first word of Port Status data is %M00101, and the last bit will be %M00132. Figure 92 also shows an example of this COMMREQ.
GFK-0582D
921
9
Port Status Words
The port status consists of two words: (1) a word reporting the status of various communication functions, and (2) a word reporting the number of characters in the input buffer that have not been retrieved by the application (characters which have been received and are available). The Port Status Words, which report specific status information for a serial port, should not be confused with the COMMREQ Status Word, which reports general COMMREQ status information. The COMMREQ Status Word resides in user memory; the Port Status Words do not reside in user memory and can only be accessed with this COMMREQ.
Word 1 Word 2 Port status word (see below) Characters available in the input buffer
The following table details the meaning of each bit in Port Status Word 1:
Bit 15 Name RI Definition Read In progress Meaning Set Cleared 14 13 12 RS RT WI Read Success Read Timeout Write In progress Set Cleared Set Cleared Set Cleared 11 10 9 8 7 6 5 WS WT CA OF FE PE CT Write Success Write Timeout Character Available OverFlow error Framing Error Parity Error CTS is active Set Cleared Set Cleared Set Cleared Set Cleared Set Cleared Set Cleared Set Cleared 40 U not used, should be 0 Read Bytes or Read String invoked Previous Read bytes or String has timed out, been canceled, or finished Read Bytes or Read String has successfully completed New Read Bytes or Read String invoked Receive timeout occurred during Read Bytes or Read String New Read Bytes or Read String invoked New Write Bytes invoked Previouslyinvoked Write Bytes has timed out, been canceled, or finished Previouslyinvoked Write Bytes has successfully completed New Write Bytes invoked Transmit timeout occurred during Write Bytes New Write Bytes invoked Unread characters are in the buffer No unread characters in the buffer Overflow error occurred on the serial port or internal buffer Read Port Status invoked. (Cleared after port status is read.) Framing error occurred on the serial port Read Port Status invoked. (Cleared after port status is read.) Parity error occurred on the serial port Read Port Status invoked. (Cleared after port status is read.) CTS line on the serial port is active or the serial port does not have a CTS line CTS line on the serial port is not active
922
GFK-0582D
Port Control Word Format (see Operating Note 2. below for additional details): Bit No. 15 Signal RTS Description Commanded state of the RTS output 1 = activates RTS 0 = Deactivates RTS Unused (should be zero)
014
Operating Notes
1. For CPU port 2 (RS485), the RTS signal is tied to the transmit driver. Therefore, control of RTS is dependent on the current state of the transmit driver. If the transmit driver is not enabled, asserting RTS with the Write Port Control COMMREQ will not cause RTS to be asserted on the serial line. The state of the transmit driver is controlled by the protocol and is dependent on the current Duplex Mode of the port. For 2wire and 4wire Duplex Mode, the transmit driver is only enabled during transmitting. Therefore, RTS on the serial line will only be seen active on port 2 (configured for 2wire or 4wire Duplex Mode) when data is being transmitted. For pointtopoint Duplex Mode, the transmit driver is always enabled. Therefore, in pointtopoint Duplex Mode, RTS on the serial line will always reflect what is chosen with the Write Port Control COMMREQ. The Duplex Mode choices are shown in Table 94. Configuring the port control status word can be facilitated by entering the value for the Port Control word (address +7) in hexadecimal format: h h
GFK-0582D
2.
Use 8000 (hex) to activate RTS (this places a 1 in bit 15, and a 0 in the other bits) Use 0000 to deactivate RTS
Chapter 9 Serial I/O Protocol 923
Operating Notes
This function does not update the status of words of the cancelled COMMREQs. Caution: If this COMMREQ is sent in either Cancel All or Cancel Write mode when a Write Bytes (4401) COMMREQ is transmitting a string from a serial port, transmission is halted. The position within the string where the transmission is halted is indeterminate. In addition, the final character received by the device the CPU is sending to is also indeterminate.
924
GFK-0582D
GFK-0582D
925
9
Autodial Command Block
The Autodial command automatically transmits an Escape sequence that follows the Hayes convention. If you are using a modem that does not support the Hayes convention, you may be able to use the Write Bytes command to dial the modem. Examples of commonly used command strings for Hayescompatible modems are listed below:
Command String
ATDP15035559999<CR> ATDT15035559999<CR> ATDT9,15035559999<CR> ATH0<CR> ATZ <CR>
Length
16 (10h) 16 (10h) 18 (12h) 5 (05h) 4 (04h)
Function
Pulse dial the number 15035559999 Tone dial the number 15035559999 Tone dial using outside line with pause Hang up the phone Restore modem configuration to internally saved values
Definition
0009h 0000h 0008h 0000h 0000h 0000h 04400 (1130h) 00030 (001Eh) 0012 (000Ch) 5441h 5444h 3332h 3534h 3736h 0D38h NOWAIT mode
Values
CUSTOM data block length (includes command string) Status word memory type (%R) Status word address minus 1 (Register 1) not used not used Autodial command number Modem response timeout (30 seconds) Number of bytes in command string A (41h), T (54h) D (44h), T (54h) Phone number: 2 (32h), 3 (33h) 4 (34h), 5 (35h) 6 (36h), 7 (37h) 8 (38h) <CR> (0Dh)
926
GFK-0582D
*Although printable ASCII characters are used in this example, there is no restriction on the values of the characters that can be transmitted. The numbers in parentheses are the ASCII codes in hexadecimal format. A list of ASCII codes can be found in Appendix B.
Operating Notes
Note: Specifying zero as the Transmit timeout sets the timeout value to the amount of time actually needed to transmit the data, plus 4 seconds. Caution: If an Initialize Port (4300) COMMREQ is sent or a Cancel Operation (4399) COMMREQ is sent in either Cancel All or Cancel Write mode while this COMMREQ is transmitting a string from a serial port, transmission is halted. The position within the string where the transmission is halted is indeterminate. In addition, the final character received by the device the CPU is sending to is also indeterminate.
GFK-0582D Chapter 9 Serial I/O Protocol 927
928
GFK-0582D
Operating Note
If the input data memory type parameter is specified to be a word memory type, and if an odd number of bytes is actually received, the high byte of the last word to be written with the received data is set to zero.
GFK-0582D
929
930
GFK-0582D
So, for example, if 24 characters were read, the data block would be 14 words long. Be sure to allow sufficient room in user memory for this data block.
GFK-0582D
931
Appendix A Glossary
A
In the Series 90 PLCs serial communications, a number of special terms are used. Also, many of these terms are referenced by acronyms. For example, a Programmable Logic Controller (PLC), computer, or other device that connects to a network is called by the general name station. This appendix contains a concise, alphabetized listing of conventional communications terms and (where applicable) their associated acronyms. Most of these terms (but not necessarily all) are used in this manual.
GFK-0582D
A1
CCU CMM
COMMREQ CPU CRC CTS DCD DCE DMA DOS DSR DTE DTR EIA EEPROM
A2
GFK-0582D
Glossary
Glossary of Terms
Address
A series of decimal numbers assigned to specific program memory locations and used to access those locations.
Analog
A numerical expression of physical variables such as rotation, distance, or voltage to represent a quantity.
Application program
The ladder logic program executing in a PLC or user program in computer.
ASCII
An acronym for the American Standard Code for Information Interchange. It is an 8-level code (7 bits plus 1 parity bit) that represents characters such as alphabetical, numeric, and punctuation types.
Attach
An SNP message which establishes communication between the SNP master and a specific SNP slave device. (See Chapter 7, Section 3, SNP Protocol for details.)
Asynchronous
Transmission of data in which time intervals between transmitted characters may be of unequal length. Asynchronous transmission is controlled by start and stop bits at the beginning and end of each character.
Backplane
A group of connectors physically mounted at the back of a rack so that printed circuit boards can be mated to them.
Baud
A unit of data transmission speed equal to the number of code elements per second.
Binary
A numbering system that uses only the digits 0 and 1. This system is also called base 2.
GFK-0582D
Appendix A Glossary
A3
A
Bit
The smallest unit of memory. Can be used to store only one piece of information that has two states (for example, a One/Zero, On/Off, Good/Bad, Yes/No, etc.). Data that requires more than two states (for example, numerical values 000-999) will require multiple bits.
Break
A wake up signal transmitted on the serial line which precedes each new SNP communication session. (See Chapter 7, Section 3, SNP Protocol for details.)
Break-Free SNP
An updated version of the SNP protocol providing break-free operation. When normal breaks are received, SNP/SNP-X communication is identical to previous versions of the protocol requiring the long break. However, this version of the protocol can also recognize an Attach or X-Attach message without a preceding break.
Brick
A nickname for the obsolete GE Fanuc isolated RS-232/RS-485 repeater/converter, catalog number IC655CCM590. The Horner Electric HE485ISO232 can be used as a replacement.
Broadband Network
A network which can handle medium-to-large size applications with up to several hundred stations as a typical number which might be attached. Broadband technology is used in larger networking systems and requires a headend remodulator.
Bus
An electrical path for transmitting and receiving data that is usually shared by two or more devices.
Byte
A group of binary digits operated on as a single unit. In Series 90 PLCs, a byte is made up of 8 bits.
Carrierband Network
A network designed to handle small to medium-size applications with 6-20 stations as a typical number of stations which might be attached. Carrierband technology is often used in Local Area Networks.
Glossary
Communication Windows
Communication between the ladder logic program and the local interface module which takes place during the PLC scan.
Custom Protocol
See Serial I/O
Data Link
The equipment including interface modules and cables that allow transmission of information.
Datagram
A serial communications message that combines data from various memory types and/ or locations.
EIA232
Formerly RS232. See RS232.
Ethernet
A network technology utilizing Carrier Sense Multiple Access with Collision Detection (CSMA/CD) often used in Local Area Networks.
Firmware
A series of instructions contained in ROM (Read Only Memory) which are used for internal processing functions only. These instructions are transparent to the user.
Generic Output
See Serial I/O
Hardware
All of the mechanical, electrical and electronic devices that comprise a Programmable Logic Controller and its application(s).
GFK-0582D Appendix A Glossary A5
A
Hexadecimal
A numbering system, having 16 as a base, represented by the digits 0 through 9, then A through F.
Initiating Station
The station from which communication originates.
Input
An externally developed signal that provides information to the PLC, usually via an input module. Inputs may be discrete (ON or OFF) or analog (having a range of values).
Input Module
An I/O module that converts signals from user devices to logic levels used by the CPU.
Interface
To connect a Programmable Logic Controller with its application devices, communications channels, and peripherals through various modules and cables.
I/O (Input/Output)
That portion of the PLC to which field devices are connected.
I/O Scan
A method by which the CPU monitors all inputs and controls all outputs within a prescribed time.
ISO Standards
The International Standards Organization (ISO) for Open System Interconnection (OSI).
Isolation
A method of separating field wiring from logic level circuitry. Typically accomplished through the use of optical isolation devices.
K
An abbreviation for kilo or exactly 1024 as applied to computerbased devices. Usually related to 1024 words of memory. Equal to 2 raised to the 10th power.
A6 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
Glossary
Keep-Alive Message
A message generated by the SNP master or slave for the sole purpose of preventing a timeout at the attached device (that is, keep the SNP communication alive).
Ladder Diagram
A representation of control logic relay systems. The user programmed logic is expressed in relay equivalent symbols.
LED
An acronym for Light-Emitting-Diode, which is a solid state device commonly used as a visual indicator in electronic equipment.
Logic
A fixed set of responses (outputs) to various external conditions (inputs). All possible situations for both synchronous and asynchronous activity must be specified by the user. Also referred to as the program.
Logic Memory
In the Series Six PLC, dedicated CMOS RAM memory accessible by the user for storage of user ladder programs.
Long Attach
An SNP Attach message, followed by an SNP Parameter Select message. Used to establish SNP communications and to negotiate non-default operating parameters between the SNP master and a specific SNP slave device. (See Chapter 7, Section 3, SNP Protocol for details.)
Master-Slave
Communication between stations where one station always initiates requests and the other station always responds to requests.
Memory
A grouping of physical circuit elements that have data entry, storage and retrieval capability.
GFK-0582D Appendix A Glossary A7
A
Microprocessor
An electronic computer processor consisting of integrated circuit chips that contain arithmetic, logic, register, control and memory functions.
Mnemonic
An abbreviation given to an instruction, usually an acronym formed by combining initial letters or parts of words.
Modules
A replaceable electronic subassembly usually plugged in and secured in place but easily removable in case of fault or system redesign. In the Series 90 PLC , a combination of a printed circuit board and its associated faceplate which when combined form a complete assembly.
Multidrop
A serial wiring configuration which connects more than two devices in a daisychain configuration. All devices on a multidrop network must be uniquely addressable.
Noise
Undesirable electrical disturbances to normal signals, generally of high frequency content.
Non-Volatile Memory
A memory capable of retaining its stored information under no-power conditions (power removed or turned off).
OFF-Line
Equipment or devices that are not connected to a communications line. For example, the Workmaster computer, when off-line, operates independent of the Series 90 CPU.
ON-Line
Descriptive of equipment or devices that are connected to the communications line.
Optical Isolation
Use of a solid state device to isolate the user input and output devices from internal circuitry of an I/O module and the CPU.
A8 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
Glossary
Output
Information transferred from the CPU, through a module (for level conversion), for controlling an external device or process. There are two basic types discrete and analog.
Output Devices
Physical devices such as motor starters, solenoids, etc. that receive data from the Programmable Logic Controller.
Output module
A module that converts logic levels within the CPU to a usable output signal for controlling a machine or process.
Parity
The anticipated state, either odd or even, of a set of binary digits.
Parity Bit
A bit added to a memory word to make the sum of the bits in a word always even (even parity) or always odd (odd parity).
Parity Check
A check that determines whether the total number of ones in a word is odd or even.
Parity Error
A condition that occurs when a computed parity check does not agree with the parity bit.
Peer-to-Peer
Communication between stations where either station can initiate requests or respond to requests.
Peripheral Equipment
External units that can communicate with a PLC, for example, programmers, printers, etc.
Piggyback Status
Six bytes of general PLC status information returned within each SNP response message. This data may be passed to the master PLC if so requested. The master may be aa programmer or a PLC. Typically, only a programmer master requests Piggyback status.
PLC
Acronym for Programmable Logic Controller.
GFK-0582D Appendix A Glossary A9
A
Point-to-Point
A serial wiring configuration which connects only two devices.
Program
A sequence of functions entered into a Programmable Logic Controller to be executed by the processor for the purpose of controlling a machine or process.
Programmer
A device for entry, examination and alteration of the PLCs memory, including logic and storage areas.
PROM
An acronym for Programmable Read Only Memory. A retentive digital device programmed at the factory and not readily alterable by the user.
Protocol
A set of rules for exchanging messages between two communicating processes.
Q Sequence
The Q sequence protocol format is used to poll and transfer 4 bytes of data from a slave to a master without issuing the 17-byte header. Used by the CCM protocol.
RAM
An acronym for Random Access Memory. A solid-state memory that allows individual bits to be stored and accessed. This type of memory is volatile; that is, stored data is lost under no power conditions; therefore, a memory backup battery is generally used to maintain memory contents when power is off.
Read
To receive data from another device.
Reference
A number used in a program that tells the CPU where data is coming from or where to transfer the data.
A10 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
Glossary
Reference Table
Any of the various PLC memory areas addressable from the ladder program, or by the communications protocol. PLC memory is addressed by memory type and address.
Register Memory
In the Series Six PLC, dedicated CMOS RAM memory accessible by the user for data storage and manipulation.
RS-232
A standard specified by the Electronics Industries Association (EIA) for the mechanical and electrical characteristics of the interface for connecting Data Communications Equipment (DCE) and Data Terminal Equipment (DTE). Features a singleended circuit arrangement. Renamed EIA232 in the 1990s by the EIA.
RS-422
A recommended standard defining electrical interface characteristics to connect Data Terminal Equipment (DTE) or Data Circuit-Transmitting Equipment (DCE). The RS-422 standard permits longer range and faster transmission rate than the RS-232D standard. Features a differential circuit arrangement. Renamed EIA422 in the 1990s by the EIA.
RS-485
Similar to RS-422. Contains additional protection for receiver circuits. Also, receivers have greater sensitivity which provides the capability for more drops than available with RS422. Features a differential circuit arrangement. Renamed EIA485 in the 1990s by the EIA.
Rung
A grouping of PLC functions/instructions that control one output (coil). One or more rungs form a ladder program.
Scan
The method of examining or solving all tasks in a sequential order from the first step to the last.
Serial Communication
A method of data transfer in which individual bits are transmitted sequentially, one at a time, rather than simultaneously as in parallel transmission.
Serial I/O
Serial Input/Output. This feature lets a user write a custom protocol for reading from or writing to a wide variety of serial devices such as bar code readers or pagers. In its
GFK-0582D Appendix A Glossary A11
A
early implementations, Serial I/O was sometimes referred to as Custom Protocol or Generic Output.
Significant Bit
A bit that contributes to the precision of a number. The number of significant bits is counted beginning with the bit contributing the most value, referred to as the Most Significant Bit (MSB), and ending with the bit contributing the least value, referred to as the Least Significant Bit (LSB).
Status Word
Indicates overall status of the CCM, SNP, and Serial I/O protocols and the communication network. Also refers to a memory location that holds COMMREQ status data.
Storage
Synonymous with memory.
Synchronous
Transmission in which data bits are transmitted at a fixed rate, with the transmitter and receiver synchronized by a clock. This eliminates the need for start and stop bits.
Terminator
A device or load (resistor) connected to the end of a transmission line to terminate the signals on that line. Used to eliminate or reduce undesirable signal reflections.
Tristate
A point that has three states: logic 1, logic 0, and disconnected (disabled). Or it may refer to the third (disconnected) state. The tristate design is used in communications circuits to allow a driver or buffer to be disconnected from its communications line.
User Memory
Term commonly used when referring to the memory circuits within the PLC used for storage of user ladder programs and configuration. Application program memory.
Volatile Memory
A memory that will lose the information stored in it if power is removed from it.
Word
A measurement of memory length, usually 16 bits long (for the Series 90 PLC).
Write
To send data to another device.
A12 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
Glossary
Wye Cable
A cable (IC693CBL305) supplied with each Series 90-30 CMM module which separates serial ports 1 and 2 from the single serial port connector on the module. It loosely resembles the letter Y because one end of the cable has a single connector and the other end has a dual connector.
GFK-0582D
Appendix A Glossary
A13
B
Char. NUL SOH STX ETX EOT ENQ ACK BEL BS HT LF VT FF CR SO SI DLE DC1 DC2 DC3 DC4 NAK SYN ETB CAN EM SUB ESC FS GS RS US SP ! # $ % & ( ) * + , . /
Thia appendix provides a table of the standard ASCII (American Standard Code for Information Interchange) characters.
Dec. 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 Hex. 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F Char. 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Dec. 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 Hex. 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A Char. [ \ ] ^ _ a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~ Dec. 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 Hex. 5B 5C 5D 5E 5F 60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F
GFK-0582D
B1
This section compares the Series 90 CCM implementation with the CCM implementation of the Series Six, Series One, and Series Five PLCs. The following table lists the CCM Commands supported by the Series 90 PLC:
Description
GFK-0582D
C1
C
The following table summarizes those Series Six CCM commands not supported by the Series 90 PLC:
Table C-2. Series Six CCM Commands NOT Supported by the Series 90 CCM
Command Number
6004-6009 6106 6116 6010 6011 6012 6104 6105 6114 6115 6108 6118 6128 6117 6130 6131
Descriptions
Quick Access Buffer Manipulations
Set CPU Memory Write Protect Reinitialize CCM Task Set OIU Timers and Counters I/O Override Table Manipulations
Character String Manipulations (unformatted read/write) Write to Target from Source User Logic Set CCM Retries 1 Set CCM Timeouts 1
1 Functionality is available in a Series 90 PLC, but in a slightly different form. See Series 90 CCM command code 6004: Software Configuration.
C2
GFK-0582D
CCM Compatibility
The following table summarizes the CCM memory types supported by the Series 90:
Operation
Those Series Six memory types which are not supported are summarized in the following table:
Table C-4. Series Six Memory Types NOT Supported by the Series 90 CCM
CCM Memory Type
0 4 5 7 8 10 11 15 16 19 20 21 22
Operation
GFK-0582D
C3
C
The next two tables compare the Series One and Series Five CCM memory types with those supported by the Series 90 CCM:
Table C-5. Series One Memory Types vs. Series 90 CCM Memory Types
Series One CCM Memory Type
1 3 6 7 9
1
Target Table
Timer/Counter/Data Register Discrete I/O1 Scratch Pad2 User Logic Diagnostic Status Words3
Target Table
Register Table Input Table, Output Table CCM Scratch Pad Not Supported
The addressing scheme for the Series One differs from that of the Series 90 when accessing I/O points. Scratch pad definitions are not the same in the Series One PLC and the Series 90 PLC. See Table 11 for the Series 90 scratch pad layout. Diagnostic status words and error code definitions are different in the Series One PLC and the Series 90 PLC. See Table 12 for the Series 90 diagnostic status words, and refer to Table 15 for the Series 90 error code definitions.
Table C-6. Series Five Memory Types vs. Series 90 CCM Memory Types
Series Five CCM Memory Type
1 2 3 6 7 9
Target Table
Registers Inputs1,3 Outputs2,3 Scratch Pad4 User Logic Diagnostic Status Words5
Target Table
Register Table Input Table Output Table CCM Scratch Pad Not Supported
1 The Series Five local and special inputs do not exist in the Series 90 input table. All inputs are
The Series Five local and internal outputs do not exist in the Series 90 output table. All outputs are equivalent, and it is up to the user to determine their functionality. For example, an output to be used as an internal coil must not be tied to a real output. The addressing scheme for the Series Five differs from that of the Series 90 when accessing I/O points. Scratch pad definitions are not the same in the Series Five PLC and Series 90 PLC. See Table 11 for the Series 90 scratch pad layout. Diagnostic status words and error code definitions are different in the Series Five PLC and the Series 90 PLC. See Table 12 for the Series 90 diagnostic status words, and refer to Table 15 for the Series 90 error code definitions.
C4
GFK-0582D
This appendix compares the function code set for the Series 90, Series Six, and Series Five PLCs, and the CIMPLICITY System 3000 Models I and W.
Series 90
Series Five
Series Six
CIMPLICITY
Description
0 1 2 3 4 5 6 7 8 15 16 17 65 66 67 68 69 70 71 72
X X X X X X X X X X X X
X X X X X X X X X X X X X X
X X X X X X X X X X X X X X X X X X X X
X X X X X X X
Illegal Function Read Output Table Read Input Table Read Registers Read Registers * Force Single Output Preset Single Register Read Exception Status Loopback Maintenance
X X
Force Multiple Outputs Preset Multiple Registers Report Device Type Read Output Override Table Read Input Override Table Read Scratch Pad Memory Read User Logic Write Output Override Table Write Input Override Table Write Scratch Pad Memory Write User Logic
X X X X X
* Series 90 is Read Analog Inputs Series Five and Series Six are Read Registers CIMPLICITY is Read Input Registers
GFK-0582D
D1
The Serial Line Interface encodes/decodes messages according to a particular information code, and performs parity checking of each character received over the serial line. The drivers for the transmission line are also part of the Serial Line Interface. This appendix covers the following topics: D D D D Information Codes Transmission Errors and Detection Asynchronous Transmission Serial Communications Line
Information Codes
An information code is a standard by which numbers, letters, symbols, and control characters are presented for serial transmission. In the CCM protocol, characters in headers as well as control characters are encoded. Other characters such as those occurring in data, are uncoded binary data. There are a number of different coding schemes used today, but the most common and the type used in CMM communications is the American Standard Code for Information Interchange or ASCII code. As shown in the illustration below, the CMM uses an 8-bit character code plus an optional parity bit to transfer serial data.
MSB 10 Stop 9 Parity (optional) 8 7 6 Data Bits 5 4 3 2 LSB 1 0 Start
The table below shows examples of the binary and hexadecimal forms, including parity bit, of several ASCII characters. The parity bit is explained in the section, Parity Checking. Refer to Appendix B for a complete list of the ASCII character set represented in hexadecimal and decimal.
ASCII Character
STX (control character) Start Of Text + NAK (control character) Negative Ack. 9
GFK-0582D
E1
Noise Errors
The CMM uses four types of noise error checking: D D D D Parity Checking. Block Check Code checking (SNP, SNP-X). Longitudinal Redundancy Checking (CCM). Cyclic Redundancy Checking (RTU).
Block Check Code checking (SNP, SNP-X Protocols), Longitudinal Redundancy Checking (CCM Protocol), and Cyclic Redundancy Checking (RTU Protocol) are performed in the Communication Protocol and are discussed in the applicable chapter.
Parity Checking
Parity checking can be generally specified as even, odd, or none. The parity bit, derived by the sender and monitored by the receiver, is dependent on the number of 1s occurring in the binary character. If parity is defined as odd, the total number of 1s in the binary character (in addition to the parity bit) must be odd. If the parity is even, the total number of 1s in the character including the parity bit must be even. If the parity is none, no parity checking is performed. In the example shown below, the ASCII coded A contains two 1s, therefore, the parity bit must be 1 for odd parity. The parity bit would be 0 in the case parity were defined as even. In the case of no parity the parity bit is not transmitted. For CCM protocol, the optional parity bit may be odd or none; for the SNP, SNP-X, and RTU protocols, the parity may be odd, even or none. If parity checking is employed, and one of the bits is transmitted incorrectly, the parity bit will reflect the error.
8 0
7 1
6 0
2 0
1 1
8 0
7 1
6 0
2 0
1 0
The receiver monitors the parity bit and detects the error in transmission because the received character with parity has an even number of 1s instead of an odd number.
E2 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
If, on the other hand, an even number of bits in a character is transmitted incorrectly, the parity bit will not reflect the error.
8 0
7 1
6 0
2 1
1 0
The parity bit does not reflect the error because the received character with parity shows an odd number of 1s as it is supposed to.
GFK0582D
E3
Asynchronous Transmission
Asynchronous serial transmission is used in CMM communications. Although there is no synchronizing clock used, the transmitting and receiving equipment must be operating at the same bit rate or errors mentioned in the previous section will occur. The general format for asynchronous communications includes a start bit, eight data bits, an optional parity bit, and a stop bit.
>
When the receiver detects the leading edge of the start bit, which is always logic 0, a timer is triggered to allow sampling to occur in the middle of each bit. After the last data bit (or the parity bit) has been received, the logic state of the line must be a 1 for at least one bit-time before receiving the next character. If no more characters are to be sent, the line will be maintained in the 1 state.
logic 1 logic 0
Start Bit
LSB 1 2
Data Bits 4
MSB 8
Stop Bit
(First)Order of transmission(Last)
E4
GFK-0582D
Modems
The word modem is an acronym for MO dulator/ DEModulator. A modem is a device that converts data from digital to analog for transmitting and from analog to digital for receiving over telephone communications lines. Some modems use other methods of transmission, such as radio or microwave.
COMPUTER
MODEM
TELEPHONE LINE
a44905
MODEM
CRT
Modems are generally classified as to the type of telephone line facility that can be connected, half-duplex or full-duplex, synchronous or asynchronous, modulation technique for the analog signal, and the maximum data rate in bits per second. Modems were originally designed for and most frequently used with the RS-232D interface.
Communications Modes
There are three modes of communication: D D D Simplex : mode in which information can be sent over a communications line in one direction only. Half-duplex : mode in which information can be sent in both directions over a communications line, but only one direction at a time. Full-duplex : mode in which information can be sent over a communications line in both directions at the same time.
GFK0582D
E5
Interface Standards
An interface standard is a set of rules which define the signal characteristics, cable and connection characteristics, connector pin assignments, and control sequences for a physical link between devices. CMM communications are based on the interface standards explained below.
RS-232
This standard was developed for interconnecting Data Terminal Equipment (DTE), such as a printer, CRT, or computer, to Data Communications Equipment (DCE), such as a modem, for transmission over a telephone line or network. It can, however, be used over short distances without a modem. Electrically, RS-232 can be described as an unbalanced or single ended voltage interface. This means that all the interchange signals share a common electrical ground. The basic characteristics of RS-232 are: D D D D Supports direct, pointtopoint communications Maximum nominal cable length: 50 feet (15 meters) Maximum nominal data rate: 20 Kilobits/sec Logic assignments referenced to signal ground: Space or logic 0: +3v to +25v Mark or logic 1: 3v to 25v D D Uses 25-pin D-type connector (9pin also supported but some optional signals not available) Includes 21 interchange circuits including data transmit and receive, data control, and timing. The most commonly used circuits are:
Note: For applications requiring distances longer than 50 feet, improved noise immunity, and/ or multidrop connections (support for more than two devices), inexpensive converters are available to convert RS232 to RS485 (the GE Fanuc IC690ACC901 miniconverter is described in Appendix O). Information on RS485 is provided later in this appendix.
Function
Protective Ground Transmit data Receive data Request to send
Abbreviation
PROT GND TXD RXD RTS CTS DSR GND RLSD or DCD DTR -
Type
Direction
From DTE To DTE From DTE To DTE To DTE To DTE From DTE
Clear to send
Data Set Ready Signal Ground Receive Line Signal Detect or Data Carrier Detect Data Terminal Ready
The RS-232 interface can be used for direct connections not exceeding 50 feet (15 meters). The following illustration shows the lines required for both devices to transmit and to receive.
E6 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
a44906 HOST COMPUTER OR SERIES 90 WITH CMM TXD RXD GND RXD TXD SERIES 90 WITH CMM
TELEPHONE LINE
GFK0582D
E
D Logic assignments; differential inputs not referenced to ground: Space or logic 0: Circuit A is +200 mv to + 6 v with respect to circuit B. Mark or logic 1: D Circuit A is 200 mv to 6 v with respect to circuit B.
There are no standard connector pinout for RS422, or RS485. (This is unlike RS232, which has standard 25pin and 9pin Dshell connector pinouts.) Therefore, each device manufacturer s data sheet should be consulted for pinout information when fabricating cables. 30 interchange circuits.
For a complete explanation of the electrical and mechanical characteristics of these interfaces, obtain a copy of EIA Standards RS-422 and RS-485 from the EIA. The EIA was formerly called the Electronics Industries Association. Their name was changed in 1997 to Electronic Industries Alliance. The EIA web site address can be found in the EIA Standards section of Appendix L.
E8
GFK-0582D
The term network (system) configuration refers to the way in which computers, terminals, and communication equipment are interconnected. With Series 90 PLCs the following data communications system configurations are possible: D D D Point-to-Point (Peer-to-Peer or Master-Slave) Multidrop (Single Master-Multiple Slaves) Modem Transmission
Point-To-Point
Point-to-Point connection is the simplest type of system configuration; when using this method, only two devices are connected to the same communication line. Either RS-232 or RS-422 can be used. They can be connected in peer-to-peer mode where both devices can initiate communications, or in master-slave mode where only the master can initiate communications. The following figures illustrate the point-to-point configuration:
Programmer
RS-232
SERIES 90-70 PLC P S C C P M U M SERIES 90-70 PLC P S C C P M U M
a449081A
Programmer
RS-232/RS-422/485 CONVERTER
a449091A
GFK-0582D
F1
Multidrop
The multidrop configuration is a party-line structure in which several devices share the same communication line. For a hardwired multidrop network, all devices must use RS-422/485. If converters or modems are used to connect devices to the network, RS-232 or RS-422/485 can be used. It is important to note that RS-232 can be used only between two devices; whenever any device is physically connected to more than one other device, RS-422/485 must be used. In a multidrop network, only one device is a master and the rest are slaves; only the master can initiate communication with other elements in the system. The next figure shows a computer running GE Fanuc CIMPLICITY software serving as the master in a multidrop configuration:
a449111A
CIMPLICITY
RS-232/RS-422/485 CONVERTER
RS-422/485
RS-422/485
RS-422/485
RS-422/485
P S C P U C M M SERIES 90-30 PLC PS C C P M U M SERIES 90-30 PLC PS C C P M U M SERIES 90-70 PLC P S C P U C M M
Communication Networks
slaves will look for a new request. Since there is typically more than one slave device sharing the multidrop line, each slave will process only requests containing its own Station Address, or the broadcast address which is sent to all slaves. Additional information on SNP Multidrop can be found in Appendix H.
Modem Transmission
The word modem is an acronym for MOdulator/ DEModulator. A modem is a device that converts data from digital to analog for transmitting and from analog to digital for receiving over telephone communications lines. In the following figure, a computer running GE Fanuc CIMPLICITY software is communicating via modem with a Series 9070 PLC.
CIMPLICITY
MODEM
SERIES 90-70 PLC P S C C P M U M RS-232
a44910A
GFK-0582D
F3
The IC690ACC903 RS485 Port Isolator replaces the IC655CMM590 Isolated Repeater/Converter (also referred to as the Brick). This device features 500 volts of isolation in a compact package servicing all Series 9030, Series 9070, and VersaMax PLC product lines. The Port Isolator connects either directly to an RS485 serial port or through an optional 12 inch (30 cm) extender cable, IC690CBL003, which may be ordered separately. The extension cable is intended for applications where direct connection to the port is obstructed by surrounding equipment or when it is not acceptable for the Port Isolator to protrude from a PLC module. The Port Isolator can operate in either single or multidrop mode, selected by a slide switch on the top of the unit (see switch in figure below). The Port Isolator provides the following features: D Four optoisolated signal channels: SD, RD, RTS, and CTS D Electrical compatibility with RS485 D Single or multidrop operation D A 5V DC/DC converter for power isolation D Hot insertion is supported
0.7 in. (18 mm) 2.6 in. (66 mm)
IC690ACC903A
MULTIDROP OFF ON
15
12 in (30 cm)
To Port Isolator
15Pin Male
15Pin Female
Connectors
The Isolator provides two connectors, one 15 pin male Dtype (PL1) and one 15 pin female Dtype (PL2). Note that in the following table, A denotes and B denotes +. Also, A and B denote outputs and A and B denote inputs. RS485 Connectors Pin
PL1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Pin Name
SHLD NC NC NC 5V CTS (A) 0V RTS (B) NC SD (A) SD (B) RD (A) RD (B) CTS (B) RTS (A)
Pin Type
In Out Out Out In In In Out
Description
Chassis Ground
+5V power Clear to send Signal Ground Request to send + Send data Send data + Read data Read data + Clear to send + Request to send
Pin
PL2 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Pin Name
NC NC NC NC 5V RTS (A) 0V CTS (B) RT RD (A) RD (B) SD (A) SD (B) RTS (B) CTS (A)
Pin Type
Out In In In Out Out Out In
Description
+5V power Request to send Signal Ground Clear to send + Termination Resistor* Read data Read data + Send data Send data + Request to send + Clear to send
*Use the termination resistor if the Port Isolator is used in porttoport mode or at the end of a multidrop configuration. To terminate the RD balanced line, place a jumper wire from pin 9 to pin 10.
G2
GFK-0582D
Logic Diagram
Optical Isolation
15pin male Dconnector PL1 SD(B) SD(A) 11 10 15pin female Dconnector PL2 11 RD(B) RD(A)
10 9
121 ohms
RT
RD(B) RD(A)
13 12
13 12
Output Enable Always on (single port mode)
+5V
SD(B) SD(A)
Multidrop Switch
RTS Driven multidrop mode) (
Output Enable
CTS(B) CTS(A)
14 6
14 6
RTS(B) RTS(A)
RTS(B) RTS(A)
8 15
8 15
CTS(B) CTS(A)
+5Vdc GND
Ground 1
DC/DC Converter
+5Vdc GND
Ground 2
GFK-0582D
G3
Installation
The Isolator is packaged in a contoured plastic enclosure designed for either direct attachment to a serial port or through a 12 extender cable for panel mounted applications. Two M3 thumbscrews secure the device to its mating connector. The device can be easily inserted into an existing communication channel with no additional hardware. In Figure G3, the Isolator is shown connected directly to a CPU module. Alternatively, the Isolator can be mounted separately from the PLC system using the optional IC690CBL003 extender cable. For mounting separately to a panel, you will need to provide two #632 (4 mm) mounting screws (Figure G4). When installing the Isolator, tighten the connector screws and panel mounting screws (if used) to the following torque values: Screws
Connector Thumbscrews (supplied with Isolator) Panel Mounting Screws (usersupplied) M3 #6/32 (4 mm)
Type
Torque
8 in./lbs. (0.9 Newtonmeter) 12 in./lbs. (1.4 Newtonmeters)
PLC 1
PS
CPU
PLC 2
PS
CPU
Multidrop Switch
TOP VIEW
The RS485 Port Isolator supports both porttoport and multidrop configurations (shown in the next figure). In some cases the Isolator is powered by a source other than the host port. This configuration is used to prevent an interrupt in communications if the host system requires a power cycle. It also prevents power loss to equipment using the port for power. For this, you will need to build a custom cable as shown in Figure G6.
Master PLC
RT SD(B) SD(A) RD(B) RD(A) RTS(B) RTS(A) CTS(B) CTS(A) +5V GND
9 13 12 11 10 14 6 8 15 5 7
Make connections connect inside D connectors
Slave Device 15 pin port 9 RT 11 RD(B) 10 RD(A) 13 SD(B) 12 SD(A) 8 CTS(B) 15 CTS(A) 14 RTS(B) 6 RTS(A) 1 SHLD 5 +5V 7 GND Slave Device 15 pin port 9 RT 11 RD(B) 10 RD(A) 13 SD(B) 12 SD(A) 8 CTS(B) 15 CTS(A) 14 RTS(B) 6 RTS(A) 1 SHLD 5 +5V 7 GND Slave Device 25 pin port 24 RT 25 RD(B) 13 RD(A) 21 SD(B) 9 SD(A) 23 CTS(B) 11 CTS(A) 22 RTS(B) 10 RTS(A) 7 1 GND SHLD
Isolator
Figure G-5. Multidrop Configuration Connecting Devices with 15Pin Ports and 25Pin Ports
GFK-0582D Appendix G IC690AC903 Port Isolator G5
Twisted Pair
13 12 11 10 14 6 8 15 5 7 1
RD(B) RD(A) SD(B) SD(A) CTS(B) CTS(A) RTS(B) RTS(A) +5V GND SHLD
+5VDC
RT RD(B) RD(A) SD(B) SD(A) CTS(B) CTS(A) RTS(B) RTS(A) +5V GND SHLD
9 11 10 13 12 8 15 14 6 5 7 1
Ground
Twisted Pair
Isolator
Slave Device
Figure G-6. Cable for Supplying External Power Through the Port Isolator
Terminate at first and last ports only Make connections inside Dconnector
Master PLC RT SD(B) SD(A) RD(B) RD(A) RTS(B) RTS(A) CTS(B) CTS(A) +5V GND SHLD 9 13 12 11 10 14 6 8 15 5 7 1
Make connections inside Dconnector
Slave Device 9 11 10 13 12 8 15 14 6 5 7 1 RT RD(B) RD(A) SD(B) SD(A) CTS(B) CTS(A) RTS(B) RTS(A) +5V GND SHLD
RT SD(B) SD(A) RD(B) RD(A) RTS(B) RTS(A) CTS(B) CTS(A) +5V GND
9 13 12 11 10 14 6 8 15 5 7
9 11 10 13 12 8 15 14 6 5 7 1
RT RD(B) RD(A) SD(B) SD(A) CTS(B) CTS(A) RTS(B) RTS(A) +5V GND SHLD
Slave Device
Specifications
Mechanical
RS485 15pin D shell male for direct mounting to serial port on the programmable controller 15pin D shell female for communication cable Two M3 thread connector thumbscrews. Recommended torque: 8 in./lbs. (0.9 Newtonmeter). These are supplied with Isolator. Two user supplied #6/32 (4mm) thread panel mounting screws. Recommended torque: 12 in./lbs. (1.4 Newtonmeter) +5VDC (supplied by port) 25 mA 100 mA available for external equipment 500 Volts EIA422/485 Balanced Line 0_ 60_C (32_ 140_ F) Those supported by PLC
Installation Hardware
Electrical
Voltage Supply Typical Current Ground Isolation Conformance
GFK-0582D
G7
H
SNP Multidrop Overview
As used in this appendix, the term SNP Multidrop refers to a serial communications system that allows a programming device (called the master or host), such as a personal computer running GE Fanuc programming software, to connect to two or more PLCs or intelligent Option modules (called slaves) via a single connection. In this arrangement the programmer is able to program, configure, test, troubleshoot, etc., any one of the multidropped devices from one connection point. Physically, a typical SNP multidrop system consists of a personal computer and two or more PLCs interconnected by a daisy-chain type cabling arrangement, as shown in the figure below. It is necessary to assign each slave device (PLC or Option module) a unique SNP (Series Ninety Protocol) address, using programming software such as Logicmaster or VersaPro. The SNP address is used by the programmer to designate which PLC it will communicate with. The SNP protocol uses the RS-422 communications standard. Note that the PLCs or Option modules do not communicate with each other over the multidrop system. They only communicate with the programmer. And only one device, the one designated by the programmer, can communicate with the programmer at a time.
Multidrop Connector 15-pin Male Series 90-30 PLC (slave) Multidrop Connector 15-pin Male Series 90-30 PLC (slave) Multidrop Connector 15-pin Male Series 90-30 PLC (slave)
Multidrop Connector 15pin Female Multidrop Cable IC690ACC901 Miniconverter Multidrop Cable
Serial Cable
Programmer (master)
Multidrop Cables
There are two sources of multidrop cables: D GE Fanuc cable, catalog number IC690CBL714A This pre-made cable can be purchased for applications where the PLCs are mounted in the same cabinet, such as in the case of redundant systems. The length of this cable is 40 inches (1 meter). See Chapter 8 for details about this cable. Custom built For PLCs that are more than 40 inches (1 meter) apart, it is necessary to build a custom length cable. The specifications are provide below.
Limitations
D D The maximum cable length between a master (programmer) and slave device (PLC or Option module) in a multidrop system is 4,000 feet (1,219 meters). The maximum number of slave devices is limited to eight.
When using RS-422/RS-485, the twisted pairs should be matched so that both transmit signals make up one twisted pair and both receive signals make up the other twisted pair. If this is ignored, cross-task resulting from the mismatching will affect the performance of the communications system. When routing communication cables outdoors, transient suppression devices can be used to reduce the possibility of damage due to lightning or static discharge. Care should be exercised that all connected devices are grounded to a common point. Failure to do so could result in damage to the equipment.
H2
GFK-0582D
SNP Multidrop
IC690ACC901 MINICONVERTER) SERIAL CABLE (SUPPLIED WITH MINICONVERTER) RD ( A ) RD ( B ) SD ( A ) SD ( B ) RT CTS ( A ) CTS ( B ) RTS ( A ) RTS ( B ) +5V 0V SHLD 15PIN MALE 15 PIN FEMALE
9PIN FEMALE
12 13 10 11 9 6 14 15 8 5 7 1
NOTE WHEN WIRING RS422 /485 MULTIDROP CABLES, REFLECTIONS ON THE TRANSMISSION LINE CAN BE REDUCED BY CONFIGURING THE CABLE IN A DAISY CHAIN FASHION, AS SHOWN BELOW.
PIN 2 3 12 13 10 11 9 6 14 15 8 5 7 1
PROGRAMMER
ALSO IT IS RECOMMENDED TO MAKE ANY NECESSARY CONNECTIONS INSIDE THE CABLE CONNECTOR TO BE MOUNTED ON THE PLC. IT IS NOT RECOMMENDED TO USE TERMINAL STRIPS TO OTHER TYPES OF CONNECTORS ALONG THE LENGTH OF THE TRANSMISSION LINE.
MINI CONVERTER
LAST SLAVE STATION (PLC) PLC 15PIN CONNECTOR SERIES 9030 LOCATED ON POWER SUPPLY SERIES 9070 LOCATED ON THE CPU BOARD *
* TERMINATION RESISTANCE FOR THE RECEIVE DATA (RD) SIGNAL NEEDS TO BE CONNECTED ONLY ON UNITS AT THE END OF THE LINES. THIS TERMINATION IS MADE ON THE SERIES 90 PLC PRODUCTS BY CONNECTING A JUMPER BETWEEN PIN 9 AND PIN 10 INSIDE THE 15PIN DSHELL WITH THE FOLLOWING EXCEPTION. FOR SERIES 9070 PLCs, CATALOG NUMBERS IC697CPU731 AND IC697CPU771, THE TERMINATION FOR RD AT THE PLC IS IMPLEMENTED BY A JUMPER BETWEEN PIN 9 AND PIN 11. GROUND POTENTIAL: MULTIPLE UNITS, NOT CONNECTED TO THE SAME POWER SOURCE, MUST HAVE COMMON GROUND POTENTIALS OR GROUND ISOLATION FOR PROPER OPERATION OF THIS SYSTEM.
GFK-0582D
H3
IC690ACC901 Miniconverter
Serial Cable
Figure H-3. Connecting CPU and APM to Programmer with IC690CBL714A Cable
a47100
Conn. B PLC A
C P U
Conn. B PLC B
C P U
Conn. C PLC C
C P U
IC690CBL714A Conn. A
RS232/422 Converter
Figure H-4. Multidrop Arrangement for Series 90-70 TMR Redundant System
H4 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
SNP Multidrop
Serial Cable
D D
GFK-0582D
H
D D
Press the Enter key. The new SNP ID will be written to the PLC and the CURRENT PLC ID field on your screen will update to show this new SNP ID. Repeat the above steps for each PLC that is on the multidrop system. If assigning an SNP ID to a module other than a CPU, see the users manual for that particular module for instructions.
D D D
Select the SNP ID Value field, then enter a unique value for the SNP ID parameter. Save the configuration and store it to the PLC. Repeat for each CPU on the multidrop system.
H6
SNP Multidrop
D D
In the PORT CONNECTION field, select MULTIDROP. Press F6, setup, to connect to the selected PLC or device. You should connect within a few seconds. If you cannot connect, see the next section, SNP Multidrop Troubleshooting.
D D D
Click the OK button to close the Add New Device window and save your device (setup). Your new setup should appear in the Device Names column of the CCU window. If you wish to create setups for other PLCs, repeat this Add New Device process for each one. Click OK to close the CCU window. Click PLC on the Menu bar. Click Connect on the PLC menu. The Connect dialog box will appear. In the Device column, click the Device Name you created for the PLC you wish to connect to. Click the Connect button to connect to the specified PLC.
D D D D D
GFK-0582D
H
D
SNP ID may be incorrect. You may not be able to connect because you are specifying the wrong SNP ID. If you are not sure of a PLCs SNP ID and would like to check it, you can connect your programmer directly to the PLCs programmer port and read its SNP ID from Logicmaster s ASSIGN PLC ID screen, (as described in Assigning an SNP ID to a PLC with Logicmaster, above), or in VersaPro, click PLC on the Menu bar, then click Status Info. An status box will appear that contains the SNP ID read from the PLC. In Logicmaster, make sure you change the programming softwares connection method to Direct for this test. When set for Direct connection, Logicmaster will communicate with a directly connected PLC without regard to its SNP ID. In VersaPro, use a communications setup (Device) that contains a blank SNP ID field. Communications settings may not match. If the PLCs serial port communication settings and the programming softwares communication settings do not match, they will not be able to communicate. These settings include such things as BAUD Rate, Parity, Stop Bits, etc. If you suspect this to be the problem, try connecting directly to the PLC as described above in SNP ID may be incorrect. If you cannot connect directly, there may be a communication settings mismatch. If so, set the programming software to its default communication settings and try again. If this doesnt work, you may be able to change the programmer s communications settings, one at a time, until you get it to match the device. Multidrop may not be selected as the Logicmaster connection method. The default Logicmaster connection method in the programming software is Direct, which requires that you be connected directly to a PLC or modules programmer port. If this default setting is not changed to Multidrop, you will not be able to connect to a selected SNP ID over a multidrop system. You may have a hardware problem. Inspect the multidrop cable; it may be wired incorrectly, damaged, or disconnected. A wire may be loose on one of the connectors. Also, physically check the status of the PLC you are trying to connect to. It may not be powered up; it may be stopped; or it may have some other problem. A quick check can be made of the LED indicator lights on the Rack 0 (the CPU rack) power supply. For example, in a Series 9030 system, the PWR, OK, and RUN LEDs should all be ON. Eliminate the PLC itself as a possible problem by connecting your programmer directly to the PLCs programmer port. You should be able to communicate with a PLC using this direct connection (even if the Logicmaster software is configured for Multidrop), as long as the SNP IDs match. If you are not sure of the SNP ID of the PLC, and are using Logicmaster, set your Logicmaster software to Direct connect and it will connect regardless of the PLCs SNP ID (unless there is a hardware problem or communications setting mismatch, both of which are described above). If using VersaPro, use a communications setup (Device) that contains a blank SNP ID field, which should let you connect to a directly connected PLC regardless of the PLC SNP ID.
H8
GFK-0582D
Appendix
I
Introduction
This chapter discusses serial communications using modems. Some possible Series 90 PLC communications applications that require use of modems are listed next. D Connecting a programmer running GE Fanuc PLC Programming software to a Series 90 PLC system. This is useful for connecting to a remote site for troubleshooting or monitoring purposes. If there are multiple PLCs at the remote site, they can be connected in a multidrop arrangement, which can be accessed via a modem. This would allow a remote programmer to access all PLCs on the multidrop network. For more information on multidrop systems, see Appendix H. Connecting two PLCs for the purpose of sharing data when the PLCs are a long distance apart, or when the PLCs are in locations where it would be impractical to string serial cabling between them. A wireless modem system can be used in a remote PLC installation where there are no telephone lines available. DATALINC (www.datalinc.com/geschm.htm) makes suitable modem equipment for this application.
The following main topics are covered in this chapter: D D D D Example modem application Modem Recommendations General Modem Issues Modem Operating Tips
GFK-0582D
I1
Personal Computer Logicmaster 90 Serial Port Setup COM2 BAUD: 9600 Parity: None Stop Bits: One Modem TT: 1 COMM2 Serial Port Modem Cable External Modem Baud Rate: 9600 Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None Modem Cable RS232RS485 Converter Serial Cable Serial Port Series 90 PLC Telephone Line External Modem Baud Rate: 9600 Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None Logicmaster 90 AutoDial Utility Port: COM2 Timeout: 40 Init String: xxx Dial String: xxx
CPU Configuration Settings Mode (Protocol): SNP Baud Rate: 9600 Parity: None Stop Bits: 1 Modem TT: 1
I2
GFK-0582D
Modem Recommendations
Refer to the setup documents (cabling, AT commands, general setup) for your modem on the GE Fanuc website: http://www.gefanuc.com/support/plc/modems.htm You will find details there on the following modems: D SIXNET VTMODEM1 D D D US Robotics Courier V.Everything 56K Business Modem US Robotics 56K Sportster FaxModem Datalinc DLM4000 Leased line dialup modem (this modem is preconfigured by Datalinc according to your application. Datalinc is a GE Fanuc Accompany Program member. Contact them at www.datalinc.com
You can also obtain modem information on the GE Fanuc Faxlink system. This system will send documents that you specify to your fax machine. The phone number and instructions are found in Appendix L, Getting Help. The modems listed above have been tested by GE Fanuc for compatibility with the SNP protocol; however, it is possible that future changes in these modems may affect their SNP compatibility. Please check our web site for the latest information. Because there have been hundreds of different modem models marketed by over 100 modem manufacturers over the past several years, it has not been practical for GE Fanuc to test them all. Not all modem models will work with the SNP protocol, so if you wish to use a model not listed on our web site, some experimentation will be required to determine if it will work. This chapter provides guidelines to assist you with setting up your modem. If you need additional help, you may refer to our web site for general information or call the GE Fanuc Technical Support Hotline (see Appendix L for Technical Support phone numbers). Modem configuration may be accomplished with the Logicmaster AutoDialer utility or the Windows 95/98 HyperTerminal utility by entering the AT commands specified by the above documents. Both utilities are discussed later in this chapter. Some typical parameter settings necessary for SNP to operate across a modem connection are: Disabling flow control Disabling error correction Disabling data compression Forcing the modems to only communicate at the desired baud rate Sending a break signal intact (only for preBreakFree CPUs) Ignoring the DTR signal Setting autoanswer for remote modem You should choose a modem that allows you to make these settings if you cannot obtain a modem from the recommended list above. For Testing Purposes: There are 3 PLCs with modems connected to them on the GE Fanuc Technical Support Hotline for anyone who wants to run testing. They are all configured for 9600 baud, no parity, 8 data bits, 1 stop bit, modem turnaround time of 1. 8049785871 8049785872 8049785938 9070 CPM915 9030 CPU351 (without breakfree SNP) 9030 CPU351 (with breakfree SNP)
Note that NO PCMCIA modems have been recommended by GE Fanuc Technical Support because of mixed results in testing. This does not mean that a PCMCIA modem will not work, but there will be cases where our PLCs will not communicate through PCMCIA modems.
GFK-0582D Appendix I General Modem Information I3
The Chipset
The first thing to look at is the chipset that the modem uses. This infomation can be obtained through the modem manufacturer, their web site, or occasionally through the computer manufacturer. The chipset dictates what AT commands are used to configure the modem. The AT command reference will be available from the chipset manufacturer (typ. Rockwell, Lucent, USRobotics, Hayes).
The Break
The long break is a signal from the UARTs transmit pin, where it is held as a 1 for at least 3 character times. It is only sent before an SNP attach message when a master is trying to establish communications with a slave. The slave will be sleeping until it receives a break from a master. It will then process the following characters and determine if the message is valid or not. The master sends the break to the slave, waits for 500ms for the slave to wake up, and sends the attach message. Note that breakfree SNP is available on some GE Fanuc CPUs; for these, the break is not required (see table below). For those CPUs that require the break to be passed, the modem needs to send the break intact without affecting the data being sent. This mode is sometimes called nondestructive, expedited, or passthrough. A destructive break will clear all data in the buffers of the modem, which is usually not a problem because the break is sent before any other data. It may also force the modem into one of many modes including diagnostic, command, and remote loopback. Typical parameters that configure modems to pass the break are the S82 register (for most chipsets) and &Y command (for USR). 9030 CPU311, 313, 323 CPU321 CPU331, 341 CPU340 CPU350, 351, 352 CPU360 CPU363, 364 CMM311 BreakFree supported YES NO YES NO YES YES YES NO Firmware revision required 8.20 or later N/A 8.20 or later N/A 9.00 or later 9.00 or later ALL N/A
9070 NO 9070 CPUS OR COMMUNICATIONS MODULES SUPPORT BREAKFREE SNP 90 Micro NO SERIES 90 MICRO PLCS SUPPORT BREAKFREE SNP VersaMax ALL VERSAMAX PLCS SUPPORT BREAKFREE SNP
PCMCIA Modems
PCMCIA modems operate differently than external modems. One major difference is that some PCMCIA slot drivers will remove power from the modem card when the port is deactivated (ie. HyperTerminals connection is removed). Removing power from the PCMCIA slot will obviously hang up the modem This means that dialing with HyperTerminal will not work. You must use the modem connect procedure within the programming software in order to keep the com port handle active.
BAUD Rate
The baud rate is a critical setting for reliable communications. 19200 baud is the current maximum rate for GE Fanuc PLCs , but the distance between modems and line quality will dictate what baud rate is acceptable. Keep in mind that modem manufacturers recommend that modem speeds do not exceed 2400 baud if error correction is disabled. SNP does not use hardware flow control and all data integrity/correction features of the modems must be disabled. Therefore we are relying on an 8bit checksum to catch transmission errors, meaning 1 out of every 256 errors will not be detected. Running the modem over lowquality analog phone lines with high data rates will increase the chances of transmission errors. It is a good idea to find the optimum baud rate by experimenting with the actual line quality and connection rate before fully implementing a system. Experimenting would include loading FROM the PLC many times to see if any communication errors occur. Another test is see if the modem being used contains a line quality diagnostic setting. Many modems will have a feature that can be displayed with an AT command that will show the line quality of the last connection made. Some manufacturers also have test modems that can be called and that will download connection statistics to the caller. Forcing modems to a single baud rate is desirable. Because the PLC serial port can only be configured to one rate, forcing the PLC modem to its baud rate ensures that the modems will not negotiate to a different speed.
Parity
Most modems will not pass parity. They usually only encode a 10bit frame (typically 1 start bit, 8 data bits, 1 stop bit) not an 11bit frame (1 start bit, 8 data bits, 1 parity bit, 1 stop bit.)
Turnaround Time
The modem turnaround time in the PLC and programmer delays the time from when the device receives transmission to when it responds. You may need to have a Turnaround Time value of 1 (10ms) or greater in the PLC and programmer if a modem is being used,
GFK-0582D Appendix I General Modem Information I5
J
Introduction
This appendix discusses setting up a serial communications link using modems between a personal computer running GE Fanucs Logicmaster PLC programming software and a Series 90 PLC. For general modem information, such as modems recommended by GE Fanuc, and example applications, please see Appendix I.
The following main topics are covered in this chapter: D D D Setting PLC CPU Communications Parameters in Logicmaster Using the Logicmaster AutoDialer Utility Using Windows HyperTerminal Communications Utility
GFK-0582D
J1
2.
If using a CPU that has ports in addition to the Standard SNP port, decide which serial port you will use. The main LM90 CPU configuration screen shown above has settings for the Standard SNP port that is accessed through the connector on the PLC power supply in Rack 0. In the case of CPUs that have two additional serial ports, these have their own screen for setting communications parameters. This additional screen can be accessed by pressing the Page Down key from the main CPU configuration screen. The configuration screen for the extra ports on a CPU352 are shown in the next example screen:
J2
GFK-0582D
3.
On the applicable screen for the port you will be using, enter/choose the following: D D D D Data Rate 9600 Parity: None Stop Bits: 1 Modem Turnaround Time: 2 (this is a starting value sometimes a higher value will be needed).
4.
GFK-0582D
J3
Note
The Logicmaster 90-30/20/Micro modem auto dial feature only supports serial ports COM1 and COM2.
1.
J4
GFK-0582D
2.
To set the modem parameters, move the cursor to Setup and press the Enter key.
A. Complete the fields on the screen displayed, using the Enter key to move among the fields and the right/left cursor keys to move within each field. Press Zoom (F10) to display other values, as shown in the following screen.
Note
You can add any non-numerical characters that your modem accepts for the dial prefix or suffix, e.g., commas to add pauses (particularly useful when trying to connect to a number in a different country). See your modem users manual for acceptable non-numerical characters.
B. Press the Enter key to select a parameter for each field. When all the fields are complete, press the Escape key.
GFK-0582D Appendix J Using Modems with Logicmaster J5
3.
To edit an entry or enter a new listing in the directory, move the cursor to Edit and press the Enter key.
A. Highlight the entry you wish to edit, or select: < add new entry > and press the Enter key to add a new listing. B. Complete the fields on the screen displayed, using the Enter key to move among the fields and the right/left cursor keys to move within each field. Press Zoom (F10) to display the choices for each parameter, cursor to one of the choices, and then press F10 again or the Enter key to select the parameter. When all the fields are complete, press the Escape key. 4. 5. 6. To dial a number, press the Enter key with the cursor on Dial. Use the cursor keys to select an entry, and then press the Enter key to dial the number. Move the cursor to Hangup and press the Enter key to abort the call and hang up the modem. To exit the modem, cursor to Quit and press the Enter key, or press ALT-F8.
Note
All computers with modems or add-in card or PCMCIA slot modems include communications software. You may choose to use one of these packages to dial and connect Logicmaster to a remote PLC, especially if you are using COM3 or COM4. If you use other communications software, set up the modem to stay connected (i.e., NOT to hang up the line) when exiting the software (so that you can start Logicmaster). Usually, this means forcing DTR high or telling the modem to ignore DTR. After exiting Logicmaster, you must re-enter the modem software package to send a command, such as the command to hang up the line.
J6 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
Note
This approach MAY NOT WORK for PCMCIA modems.
1.
In Windows 95, HyperTerminal is located under the START menu PROGRAMS ACCESSORIES HYPERTERMINAL. (In Windows 98, HyperTerminal is under ACCESSORIES COMMUNICATIONS) In HyperTerminal, enter a name for the connection. Naming and saving your settings (in a file) lets you open the file and use the saved settings in future sessions. In the Test Properties dialog box for the connection, next to CONNECT USING, choose the com port that the modem is connected (or mapped) to, as shown in the next figure. Make sure you select a physical com port and not a port that has the name of a modem.
2.
Click on the CONFIGURE button to configure the communications parameters. Set the baud rate to 9600, data bits to 8, parity to none, stop bits to 1, and flow control to none. Click OK to accept the parameters.
Windows is a registered trademark of Microsoft Corporation Appendix J Using Modems with Logicmaster
GFK-0582D
J7
Note
Modems autobaud to the settings of the DTE when in command mode. This means that any port settings will work to configure the modem and dial it. However, when the modem is in data mode (connected to another modem), the modem may not respond to the escape sequence unless it is sent at the same baud rate the modem is using.
3.
In HyperTerminal, test the connection to the modem by typing AT and hitting ENTER. The modem should respond with OK. To dial the modem, type ATDT# (where # is the phone number of the remote modem) and wait for the connection response (ex. CONNECT 9600). Set up the PLC programmer to communicate at the desired port settings, but assume a standard serial port connection, not a modem connection, using the desired port setup parameters. The port setup in the CCU will not have an associated modem, but will have a modem turnaround time. To hang up, first disconnect the PLC programmer connection (this will free up the comm port for use with HyperTerminal). Then connect to the modem with HyperTerminal. While connected, wait at least 1 second, then hit 3 plus signs (+++), and one second later, the modem should respond with an OK. Now ATH, the hangup command, may be entered. The modem should respond OK again.
4.
5.
Note
The HyperTerminal connection must be set to the same baud rate that the modem is currently using. If not, the escape sequence will not be recognized.
J8
GFK-0582D
K
Introduction
This appendix discusses setting up a serial communications link, using modems, between a personal computer running GE Fanucs VersaPro (Series 9030 only) or Control PLC programming software and a Series 90 PLC. For general modem information such as modems recommended by GE Fanuc, and example applications, please see Appendix I.
Note
Although the PLC programming/configuration screen examples shown in this appendix use VersaPro screen captures, the information generally applies to Control as well, since both programs use the Communications Configuration Utility (CCU).
3.
4.
K2
GFK-0582D
Note
If, for some reason, a Standard Modem cannot be added (which may typically be the case for PCMCIA modems because of the tight integration with Windows) then follow these instructions below, paying close attention to the notes that start with ***. A modem that is not a Standard Modem will have a name that corresponds to the make and model of the actual modem being used. Because the Windows communications strategy uses TAPI (Telephone Application Program Interface), a nongeneric driver will reconfigure the modem and essentially ruin any useredited parameters in the modem upon dialing.
2.
With the standard modem selected, click on the PROPERTIES button. Under the MAXIMUM SPEED for that modem, choose 9600 (or other desired baud rate) if it is not already selected.
GFK-0582D
K3
3.
Under the CONNECTION tab, the Data bits should be 8, Parity should be NONE, and Stop bits should be 1.
4.
Click on the ADVANCED button, and deselect the FLOW CONTROL checkbox.
***If the modem is not a Standard Modem, the USE ERROR CONTROL checkbox may be checked. Uncheck it. The EXTRA SETTINGS textbox needs to be populated with the AT commands from the modem configuration settings documentation provided (either from faxlink or the web). The AT commands can be put on a single line by putting the AT first and appending all commands to it on the same line. For example: AT&F0&A1&B0&D0&H0&I0&K0&M0&N6&R1.
K4 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
The Z, S0=1, and &W do not need to be used because they reset the modem, set it to answer on one ring, and write to the NVRAM in the modem, respectively.
5.
Keep clicking OK until you get out of the modem control panel.
GFK-0582D
K5
4.
2.
Give the modem a name and enter the area code and phone number. Click OK to accept the modem. Do NOT click on the Configure Line button because ANY CHANGES MADE WILL NOT BE SAVED! There is no fix planned for this problem.
GFK-0582D
K6
After a modem has been created and the OK button on the above window is clicked, there will be a Send Break checkbox visible in the Selected Modem Parameter Settings.
If this box is checked, then the programmer will send the break signal to the remote PLC. If the remote CPU has breakfree SNP, this box does not need to be checked. See Chapter 3 for information about breakfree SNP. 3. In the CCU, click on the PORTS tab. Click NEW to add a new port to the list.
4. 5. 6. 7. 8. 9.
Enter in the name of the port Next to TYPE, select SNP_SERIAL Next to PHYSICAL PORT, select the desired COM port for the modem on your computer Set the PORT SETTINGS to be equal with those that were configured for the PLC CPU Select the ASSOCIATED MODEM that was created in step 1. Click on the ADVANCED button
10. Next to CONNECT TIMEOUT, enter a value (in milliseconds) of approximately 40000 (40 seconds). This time may be longer or shorter depending on how long it takes for the modem to establish communications.
GFK-0582D
K7
11. if the communications lines between the PLC and programmer are of very poor quality, you may avoid possible future communications problems by configuring the following settings: D D D D D REQUEST TIMEOUT to 10000 SNP_T3 to 10250 SNP_T3P to 10500 SNP_T3PP to 10750 If the baud rate being used is approaching 2400 and below, set the SNP_T3 to 10500, the SNP_T3P to 11000, and the SNP_T3PP to 11500.
12. Click OK to accept the port. 13. In the CCU, click on the DEVICES tab. Click NEW to add a new device to the list.
14. Under DEVICE NAME, type in the desired name for the device 15. Next to DEVICE MODEL, select from the list the type of CPU to communicate with 16. Next to DEFAULT PORT, select from the list the port that was created in step 2 17. Next to ASSOCIATED MODEM, select the modem that was created in step 1 from the list 18. Click OK to accept the device 19. Click OK in the CCU to accept the configuration changes.
K8
GFK-0582D
2.
If not already selected, select the DEVICE and PORT that are configured for the modem. Click on CONNECT to initiate communications. The modem will dial and communications will be initialized.
A common problem reported by a number of users is that the modem hangs up approximately 10 seconds after the connect button has been pressed. This is usually because the connect timeout setting, explained in an earlier section of this appendix, has not been changed from the default.
GFK-0582D
K9
Note
This approach MAY NOT WORK for PCMCIA modems. 1. HyperTerminal is located under the START menu PROGRAMS ACCESSORIES HYPERTERMINAL. (In WIN98, HyperTerminal is under ACCESSORIES COMMUNICATIONS) In HyperTerminal, enter a name for the connection. Naming and saving the connection makes it easier to reconnect in the future. In the Test Properties dialog box for the connection, next to CONNECT USING, choose the com port that the modem is connected (or mapped) to, as shown in the next figure. Make sure you select a physical com and not a port that has the name of a modem.
2.
Click on the CONFIGURE button to configure the communications parameters. Set the baud rate to 9600 (or other desired baud rate), data bits to 8, parity to none, stop bits to 1, and flow control to none. Click OK to accept the parameters.
Note
Modems autobaud to the settings of the DTE when in command mode. This means that any port settings will work to configure the modem and dial it. However, when the modem is in data mode (connected to another modem), the modem may not respond to the escape sequence unless it is sent at the same baud rate the modem is using.
K10 Series 90 PLC Serial Communications Users Manual November 2000 GFK-0582D
3.
In HyperTerminal, test the connection to the modem by typing AT and hitting ENTER. The modem should respond with OK. To dial the modem, type ATDT# (where # is the phone number of the remote modem) and wait for the connection response (ex. CONNECT 9600). Set up the PLC programmer to communicate at the desired port settings, but assume a standard serial port connection, not a modem connection, using the desired port setup parameters. The port setup in the CCU will not have an associated modem, but will have a modem turnaround time. To hang up, first disconnect the PLC programmer connection (this will free up the comm port for use with HyperTerminal). Then connect to the modem with HyperTerminal. While connected, wait at least 1 second, then hit 3 plus signs (+++), and one second later, the modem should respond with an OK. Now ATH, the hangup command, may be entered. The modem should respond OK again.
4.
5.
Note
The HyperTerminal connection must be set to the same baud rate that the modem is currently using. If not, the escape sequence will not be recognized.
GFK-0582D
K11
GFK-0582D
L1
Modem Support
Modem manufacturers such as 3Com (makers of US Robotics modems), Motorola, Boca Research, and DATA LINC have web sites where you can find resources such as downloadable manuals and upgrades, answers to Frequently Asked Questions, application notes, and modem cable diagrams.
EIA Standards
The Electronic Industries Alliance (formerly called Electronic Industries Association) publishes communication standards such as the EIA232 (RS232) and EIA485 (RS485) interface standards. Their web site can be found at: http://www.eia.org
L2
GFK-0582D
The material in this appendix is based upon information in the Series 90 Micro PLC Users Manual , GFK1065 (version F or later).
Serial Ports
Port 1 on the Micro PLC is intended to be used as the programmer serial port. A second RS422 compatible serial port, to be used by monitoring devices, is provided on 23 and 28point Micro PLCs.
SNP/SNPX Slave
Port 1 All releases Ports 1 and 2, Rel. 3.00 and later Ports 1 and 2, Rel. 2.01 and later
SNP/SNPX Master*
not supported Port 2 Rel. 3.00 and later Port 2 Rel. 3.00 and later
*Also requires the following versions or later hardware: IC693UDR001LP1, IC693UDR002LP1, IC693UAA003JP1, IC693UDR005JP1, IC693UAL006BP1, IC693UAA007HP1, and IC693UDR010BP1.
SNP/SNPX Protocols
The full set of SNP(X) Master commands, as described earlier in this manual in SNPX Commands, is supported on Port 2 of the 23 and 28point Micro PLCs.
GFK-0582D
M1
Description
Read Output Table Read Input Table Read Registers Read Analog Input Force (Write) Single Output Preset Single Register Read Exception Status Loopback Maintenance Force (Write) Multiple Outputs Preset Multiple Registers Report Device Type Read Scratch Pad Memory
For the 14 point unit, an additional feature is implemented that automatically detects whether the configuration/programming software is attached to the Micro PLC. The firmware will auto detect the presence of the programmer when RTU is the active protocol, so that you only need to begin using the configuration/programming software for a 14 point Micro to be able to communicate with it.
I1 24 VDC OUT
I2
Potentio meters
100240VAC L H Q1
It is not possible to load and store programs and configuration through Port 2, because the privilege level is restricted to level 2 by the PLC firmware. Autobaud is not supported on Port 2. Port 2 can be configured using the Logicmaster 90 configuration software or by a COMM_REQ function block within a ladder logic program (see Configuring Serial Ports in Chapter 5). On release 3.0 and later 28point Micro PLCs, a separate SNP ID for Port 2 can be configured using Logicmaster 90 software release 8.00 or later. On earlier releases, Port 2 shares the SNP ID with Port 1 and the SNP ID can only be changed through Port 1. (For more information about the SNP ID, refer to Selecting SNP Connections and CPU Configuration in the Logicmaster Series 9030/20/Micro Programming Software Users Manual, GFK0466.) Communication through Port 2 may be lost (host may time out) while operations that involve writing to flash memory, including storing the program, are being performed through Port 1.
GFK-0582D
M3
Note: This product is no longer available. It has been replaced by catalog number IC690ACC903 (see Appendix G for details). This information is for reference by those alreading using this product.
This section describes how to use the Isolated Repeater/Converter. The section covers the following topics: D D D Description of the Isolated Repeater/Converter System Configurations Cable Diagrams
To purchase this unit, please contact your local authorized GE Fanuc PLC distributor or GE Fanuc sales representative.
Note
The catalog number for the Isolated Repeater/Converter was previously IC630CCM390.
GFK-0582D
N1
Obsolete Product
The figure below shows the appearance of the unit and the location of the user elements:
(TOP VIEW)
POWER CORD
RS422 RS422 H 115VAC N 230VAC N RS232C
GE Fanuc
a42418
FUSE
POWER
J1
J2
SWITCH
FUSE
(BACK VIEW)
FUSE-1AMP
POWER CORD
(SIDE VIEW)
N2
GFK-0582D
Obsolete Product
IC655CMM590 Isolated Repeater/Converter
RS-422 J1
OPTICAL ISOLATION
22 RD ( B ) 14
15 RD ( A ) 23
15 SD (A ) 23 4
8 CTS ( B ) 10
RTS (RS-232C)
RTS (B )
RTS (A )
19 RD ( B ) 17
25 SD ( B ) 17
16 SD ( A ) 24
12 RTS (B ) 13
RTS (A )
( CTS) (ON) ISOLATED POWER SUPPLIES (SE)
16 RD ( A ) 18 3 8 CTS ( B ) 12
RD (RS-232C)
13 9 5 CTS ( A )
CTS (RS-232C)
25
SE (RS-232C)
115 VAC
Note
All inputs on the unit are biased to the inactive state. Inputs left unconnected will produce a binary 1 (OFF) state on the corresponding output.
GFK-0582D Appendix N IC655CMM590 Isolated Repeater/Converter
N3
Obsolete Product
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 RD(B) RD(A) SD(A) SD(B) 0V CTS(B) CTS(A) CTS(B) CTS(A) RTS(B) RTS(A) RD(B) RD(A) SD(A) SD(B)
NC NC NC NC NC NC Ground Connection Clear to Send (Optional Termination Clear to Send (Optional Termination) Clear to Send Clear to Send Request to Send Request to Send Receive Data Receive Data Send Data Send Data NC NC NC NC Receive Data (Optional Termination) Receive Data (Optional Termination) Send Data Send Data
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SE SD(B) SD(A) 0V CTS(B) CTS(A) RTS(B) RTS(A) CTS(B) CTS(A) SD(B) SD(A) RD(A) RD(B) RD(A) RD(B) SD RD RTS CTS
NC Send Data (RS-232) Receive Data (RS-232) Request to Send (RS-232) Clear to Send (RS-232) NC Ground Connection Clear to Send (Optional Termination) Clear to Send (Optional Termination) Request to Send Request to Send Clear to Send Clear to Send Send Data Send Data Receive Data Receive Data Receive Data (Optional Termination) Receive Data (Optional Termination) NC NC Send Data Send Data NC Enable (RS-232C) Not Used
NC=No Connection SD (Send Data) and RD (Receive Data) are the same as TXD and RXD (used in the Series Six PLC). (A) and (B) are the same as and +. A and B denote outputs, and A and B denote inputs.
N4
GFK-0582D
Obsolete Product
IC655CMM590 Isolated Repeater/Converter
Caution
The signal ground connections (pin 7 on each connector) must be made between the Isolated Repeater/Converter and the PLC for J1, and the Isolated Repeater/Converter and the host computer for J2. Pin 7 of the J1 port is connected to the metal shell of the J1 connector. Pin 7 of the J2 port is connected to the metal shell of the J2 connector. These two signal ground connections are isolated from each other and are isolated from the power system ground (green wire on the terminal block). To maintain proper isolation, these signal grounds cannot be tied together.
System Configurations
The figures below show various ways you can connect the Isolated Repeater/Converter to convert signals, expand the number of drops, and obtain greater distance. Any system configuration can be reduced to a minimum number of cables each covering a part of the overall system configuration. The example system configurations below refer to these cables as Cables A-D shown in Cable Diagrams later in this section. Downstream and Upstream Contention. In this section, simple multidrop configurations are those where a single Isolated Repeater/Converter is used. Complex multidrop configurations contain one or more multidrop sections where an Isolated Repeater/Converter is included as one of the drops. In both simple and complex multidrop configurations, the transmitters directed downstream from the master can be on at all times. There will be no contention for the communication line because only one device (the master) transmits downstream. In simple multidrop configurations, there will be no contention when transmitting upstream as long as devices tri-state their drivers when idle and turn them on only when they have something to transmit. This is the case for the Series 90-70 and Series 90-30 CMMs. In complex multidrop configurations, however, special steps must be taken to switch the upstream transmitters of the Isolated Repeater/Converter. Switching Upstream Transmitters. For the RS-422 drivers to be active at the J2 port of the Isolated Repeater/Converter, the RTS input at J1 must be true. The state of the RS-422 drivers at the J1 port depends on the position of the switch on the unit. When the switch is in the center position, the J1 transmitters will always be turned on. When the switch is in the CTS position, (toward the power cable), then either the RS-232 or RS-422 CTS signal must be true to turn on the J1 drivers.
Note
Note the position of the switch on the Isolated/Repeater Converter in thesystem configurations below.
GFK-0582D
N5
Obsolete Product
RS-232 (CABLE A)
RS-422 (CABLE B) J2
* BRICK
SW ON
RS-422 (CABLE D) J1
a44928
SERIES 90 PLC
* BRICK
J2 RS-232 (CABLE A) RS-422 (CABLE B) SW ON
RS-422 (CABLE D) J1 J2
BRICK SW ON
RS-422 (CABLE D)
SERIES 90 PLC
J1
SERIES 90 PLC
* BRICK
J2 SW ON
RS-422 (CABLE D) J1 J2
* BRICK
SW ON
RS-422 (CABLE D)
SERIES 90 PLC
J1
SERIES 90 PLC
* BRICK
J1 SW CTS
RS-232 (CABLE E)
SERIES 90 PLC
J2
Obsolete Product
IC655CMM590 Isolated Repeater/Converter
25-PIN FEMALE
PIN
PIN
2 3 4 5 8 20
3 2 4 5
RD SD RTS CTS
GND SHLD
25-PIN MALE
7 1
GND
25-PIN MALE
J2
a44929 ON
SW
25-PIN FEMALE
J1
25-PIN FEMALE
PIN SD (A) SD (B) RD (A) RD (B) TERM TERM RTS (A) CTS (A) RTS (B) CTS (B) GND SHLD 25-PIN MALE 9 21 13 25 12 24 10 11 22 23 7 1
PIN 16 17 15 14 19 18 10 12 11 13 7 RD (A) RD (B) SD (A) SD (B) TERM TERM RTS (B) CTS (B) RTS (A) CTS (A) GND
* *
25-PIN MALE
J2
a44930 SW ON
25-PIN FEMALE
J1
TERMINATE CONNECTION: ON THE CMM, INSTALL JUMPER TO CONNECT INTERNAL 120 OHM RESISTOR. ON THE ISOLATED REPEATER/CONVERTER, INSTALL 150 OHM RESISTOR (SUPPLIED).
GFK-0582D
N7
Obsolete Product
SUBSTITUTE APPROPRIATE UP STREAM DEVICE (WITHIN DOTTED BOX) PER SYSTEM DIAGRAMS. PIN SD (A) 9 SD (B) 21 RD (A) 13 RD (B) 25 12 TERM 24 TERM RTS (A) 10 CTS (A) 11 RTS (B) 22 CTS (B) 23 GND 7 SHLD 1 25-PIN MALE
25-PIN FEMALE
SW ON
PIN RD (A) RD (B) SD (A) SD (B) TERM TERM RTS (A) CTS (A) RTS (B) CTS (B) 0V SHLD 25-PIN MALE
13 25 9 21 12 24 10 11 22 23 7 1
J1
a44931
**
25-PIN FEMALE
J2
25-PIN FEMALE
J1 NOTE
PIN SD (A) SD (B) RD (A) RD (B) RTS (B) CTS (B) RTS (A) CTS (A) TERM TERM GND 25-PIN MALE 16 17 15 14 12 10 13 11 22 23 7
SW
CTS
(USED AS A CONVERTER)
25-PIN FEMALE
J2
WHEN WIRING RS-422 /485 MULTIDROPCABLES, REFLECTIONS ON THE TRANSMISSION LINE CAN BE REDUCED BY CONFIGURING THE CABLE IN A DAISY CHAIN FASHION AS SHOWN BELOW.
MASTER
CMM SLAVE 1
* 150 OHMS
7 GND 25-PIN MALE
ALSO IT IS RECOMMENDED TO MAKE ANY NECESSARY CONNECTIONS INSIDE THE CABLE CONNECTOR TO BE TO OTHER DEVICES MOUNTED ON THE CMM. IT IS NOT RECOMMENDED TO (MAXIMUM OF 8 DEVICES ON A MULTIDROP) USE TERMINAL STRIPS OR OTHER TYPES OF TERMINATE THE RD (B) SIGNAL ONLY AT END CONNECTORS ALONG THE LENGTH OF THE OF MULTIDROP CABLE TRANSMISSION LINE.
J2
SW
ON
25-PIN FEMALE
J1 J 1
* **
TERMINATE CONNECTION ON FIRST AND LAST DROPS ONLY: ON THE CMM, INSTALL JUMPER TO CONNECT INTERNAL 120 OHM RESISTOR. ON THE ISOLATED REPEATER/CONVERTER, INSTALL 150 OHM RESISTOR (SUPPLIED) ON THE CMM311, ONLY PORT 2 CAN SUPPORT RS-422/RS-485.
N8
GFK-0582D
Obsolete Product
IC655CMM590 Isolated Repeater/Converter
J2
SW
ON
25-PIN FEMALE
J1 NOTE
PIN 16 17 15 14 11 10
* OHMS 150
24 7 1
J1 J2
a44932
25-PIN FEMALE
WHEN WIRING RS-422 /485 MULTIDROPCABLES, REFLECTIONS ON THE TRANSMISSION LINE CAN BE REDUCED BY CONFIGURING THE CABLE IN A DAISY CHAIN FASHION AS SHOWN BELOW.
SW
CTS
MASTER
CMM SLAVE 1
* 150
22 OHMS 23 7
(USED AS A CONVERTER)
25-PIN FEMALE
ALSO IT IS RECOMMENDED TO MAKE ANY NECESSARY CONNECTIONS INSIDE THE CABLE CONNECTOR TO BE MOUNTED ON THE CMM. IT IS NOT RECOMMENDED TO USE TERMINAL STRIPS OR OTHER TYPES OF CONNECTORS ALONG THE LENGTH OF THE TRANSMISSION LINE.
SW
ON
* 150
19 OHMS 18 7
25-PIN FEMALE
J2 J1
TO OTHER DEVICES (MAXIMUM OF 8 DEVICES ON A MULTIDROP) TERMINATE THE RD (B) SIGNAL ONLY AT END OF MULTIDROP CABLE
* **
TERMINATE CONNECTION ON FIRST AND LAST DROPS ONLY: ON THE CMM, INSTALL JUMPER TO CONNECT INTERNAL 120 OHM RESISTOR. ON THE ISOLATED REPEATER/CONVERTER, INSTALL 150 OHM RESISTOR (SUPPLIED) ON THE CMM311, ONLY PORT 2 CAN SUPPORT RS-422/RS-485.
GFK-0582D
N9
Obsolete Product
J1
SW
CTS
25-PIN FEMALE
J2
PIN
PIN
SD RD CTS GND
2 3 5 7
3 2 5 4 7
8 20
DCD DTR
1
25-PIN MALE
SHLD
25-PIN MALE
a45239
25-PIN FEMALE
N10
GFK-0582D
This appendix describes how to use the RS-422 to RS-232 Miniconverter. The following topics are covered: D D D Description of the Miniconverter System Configurations Cable Diagrams
Description of Miniconverter
The Miniconverter Kit (IC690ACC901) consists of an RS-422 (SNP) to RS-232 Miniconverter, a 6 foot (2 meter) serial extension cable, and a 9-pin to 25-pin Converter Plug assembly. The 15-pin SNP port connector on the Miniconverter plugs directly into the serial port connector on the Series 90-30 power supply, Series 90-70 CPU, Series 90-20 CPU, Series 90 Micro, or VersaMax. The 9-pin RS-232 port connector on the Miniconverter connects to an RS-232 compatible device.
a44985
RS-422 PORT
RS-232 PORT
O
Pin Assignments, RS-232 Port
The pinout of the Miniconverter is shown in the following two tables. The first table shows the pinout for the RS-232 port. The direction of signal flow is with respect to the Miniconverter.
The pinouts were chosen to allow direct connection (using a straight through, or 1 to 1 cable (as provided with kit)) to the IBM PC-AT. Most IBM compatible computers equipped with an RS-232 port will provide a pinout compatible with the one shown above.
O2
GFK0582D
System Configurations
The Miniconverter can be used in a point-to-point configuration as described above, or in a multidrop configuration with the host device configured as the master and one or more PLCs configured as slaves. The multidrop configuration requires a straight through (1 to 1) cable from the Miniconverters RS-422 port to the first slave PLCs SNP port. Other slaves will require a daisy chain connection between slaves. A maximum of eight devices can be connected in an RS-422 multidrop configuration. All of the devices must have a common ground. If isolation is required, the IC690ACC903 Port Isolator can be used with the Miniconverter. See Appendix G for information. When using the Miniconverter with a modem connection, it may be necessary to jumper RTS to CTS (consult the users manual for your modem).
a44983 PIN TXD RXD CTS RTS GND 2 3 7 8 5 PIN 3 2 4 5 7 8 6 20 RXD TXD RTS CTS GND DCD DSR DTR
a44984
Figure O-4. Miniconverter to 9-Pin Workmaster or PC-XT Computer (Additional Adapter Required)
O4
GFK0582D
Index Numbers
2Wire RTU, 810 4Wire RTU, 810 Cables serial comm, 81 SNP multidrop, H2 Cancel Datagram (SNP Command), 662 Cancelling a Datagram, 756 Catalog numbers, converters, IC690ACC901, O1 CCM Command Examples, 516 Clear CCM Diagnostic Status Words, 517 Read CCM Diagnostic Status Words to Source Registers, 517 Read QResponse to Source Register Table, 520 Read Target to Source Memory, 519 Set Q Response, 516 Single Bit Write, 521 Software Configuration, 518 Write to Target from Source, 522 CCM Command Number, 52 CCM Command Summary, 54 CCM COMMREQ Programming Examples, 514 CCM Compatibility, C1, C2 CCM Data Lengths, 510 CCM MasterSlave Mode, 79 CCM Memory Addresses, 59 CCM Memory Types, 55 CCM Operation, Memory Types not Supported, C3 CCM PeertoPeer Mode, 77 CCM Protocol, 72 CCM Protocol Timing/Retry, 711 CCM Scratch Pad, 56 CCM Service, 51 CCM State Tables, 713 CCM Master State Table, 716 CCM Peer State Table, 714 CCM Slave State Table, 718 CCM Status Word, 511 CGR CPUs, comm. features, 38 Change Privilege Level (SNP Command), 638 Change SNP ID (SNP Command), 624 Clear CCM Diagnostic Status Words (CCM Command), 517
Index-1
A
Acronyms, A2 Appendix A - Glossary of Terms, A1 B - ASCII Code List, B1 C - CCM Compatibility, C1 D - RTU Compatibility, D1 E - Serial Line Interface, E1 F - Communications Networks, F1, G1 SNP Multidrop, H1, I1, J1 ASCII Code List, B1 Asynchronous Transmission, E1, E4 Attach (SNP Command), 634 Auto dial feature, J4 Autodial, 925 Autodial (SNP Command), 668
B
Block Check Code (BCC), 762 Break Sequence, 748 Broadcast Delay, 631, 633, 760 Broadcast SNP ID, 758 Broadcast SNP-X Commands, 765
C
Cable IC693CBL316, 816 IC690CBL714A, 817 Cable and connections for serial port, multidrop cable, H2 Cable Assembly Specifications, 82 Cable Diagrams, 81 Cable Diagrams for Isolated Repeater/Converter, N7 Cable Diagrams for Miniconverter, O3
GFK-0582D
Index
Clear Diagnostic Status Words (SNP Command), 621 COMMREQ, 94 4300, 918 4301, 919 4302, 920 4303, 921 4304, 923 4399, 924 4400, 925 4401, 927 4402, 928 4403, 930 for Serial I/O, 94 COMMREQ Command Block, 42, 47 COMMREQ Data Block (CCM), 52 COMMREQ Data Block (SNP), 62 COMMREQ Ladder Instruction, 42, 45 COMMREQ Status Word CCM Status Word, 511 Serial I/O, 914 SNP Status Word, 64 Communication Errors (RTU), 744 Communication Networks, Types of Modem Transmission, F3 Multidrop, F2 Point-to-Point, F1 Communication Request. See COMMREQ Communications Line, Serial, E5 Communications Networks, F1 Communications Parameters, 212 Communications Parameters (CPU 351), 317 Communications Parameters (CPU 352), 317 Communications Protocols for the CMM, 13 Communications Request (COMMREQ), 42 Compatibility, communication protocols, M1 Compatibility (CCM), C1 Compatibility (RTU), D1 Configuration Modes, 210 Configuring the CMM, 210 I/O Rack Configuration, 210 Index-2 Configuring the CPU 351 Serial Ports, 31, 315 Configuring the CPU 352 Serial Ports, 31, 315 Connection, diagrams, 81 Control Information Area, 651 Control Program Area, 649 Converter, N1 Converters, IC690ACC901, O1 CPU 351 Serial Ports, Configuring, 31, 315 CPU 352 Serial Ports, Configuring, 31, 315 CPU ID (CCM), 52 CPU serial ports, M1 CPU351, ports 1 and 2, 34 CPU352, ports 1 and 2, 34 CPU363, ports 1 and 2, 34 CPX CPUs, comm. features, 37 Cyclic Redundancy Check (CRC), 725 Calculating the CRC16, 726
D
Data Length (CCM COMMREQ), 53 Data Length (CCM), 53 Data Lengths (CCM Memory Types), 510 Datagrams, 754 Cancel Datagram, 662 Cancelling a Datagram, 756 Datagram ID, 658, 754 Datagram Lifetime, 756 Establish Datagram, 658 Establishing a Datagram, 754 Normal Datagram, 659, 756 Permanent Datagram, 659, 756 Point Formats, 659, 754 Retrieving a Datagram, 755 Update Datagram, 661 Update RealTime Datagram, 663, 755 Diagnostic Status Words (CCM), 58 Diagnostic Status Words (SNP), 622 Directed SNP-X Commands, 764 Duplex mode, configuring, 812
GFK-0582D
Index E
Error Codes CCM Error Codes, 512 RTU Error Responses, 744 SNP Major Error Codes, 65 SNP Minor Error Codes, 66 Autodial Error Codes, 613 Local SNP/SNP-X Error Codes, 68 Port Configurer Error Codes, 615 Remote SNP Error Codes, 612 Service Request Error Codes, 66 SNP DOS Driver Error Codes, 67 SNP-X Slave Error Codes, 614 Errors, Noise, E2 Errors, Transmission Timing, E3 Establish Datagram (SNP Command), 658 Establish SNP-X Session, 764 Establishing a Datagram, 754 Establishing SNP Communication, 748
I
IC655CMM590, isolated converter, (obsolete), N1 IC690CBL714A, multidrop cable, H2 IC690CBL714A cable, wiring diagram, 818 IC693CBL316, Cable, 816 Information Codes, E1 Information codes, E1 Initialize Port function, 918, 919 Input Buffer, Flush, 920 Input Buffer, Set Up, 919 Installing and Configuring the CMM, 27 Installing the CMM Hardware, 28 Interface Standards, E6 RS-232, E6 RS-449, RS-422, RS-485, E7 Internet, GE Fanuc site, L1 Isolated Repeater/Converter Cable Diagrams, N7 System Configurations, N5
F
Fault Table Format, 654 Fax Link system, L1 Force Multiple Outputs (RTU message), 738 Force Single Output (RTU message), 733 Framing Errors, E3 Function codes, RTU, M2
L
Ladder Program Example CCM Program Example, 514 SNP Program Example, 616 LED Indicators, 23 Module OK LED, 23 P1 (CPU 351), 33 P2 (CPU 351), 33, 37 Serial Port LEDs, 23 Line, Serial Communications, E5 Long Attach (SNP Command), 665 Long Break, 761 Loopback/Maintenance (RTU message), 736
G
Glossary of Terms, A1
H
Hardware Description, 22 Series 9030 CPU LED Indicators, 33 Serial Ports, 33 Series 9070 CPU figure, 36 LED Indicators, 37 Serial Ports, 37 Help, from GE Fanuc, L1
GFK-0582D
M
MasterSlave, 79, 747 Memory Addresses CCM Memory Addresses, 59 SNP Memory Addresses, 63 Memory Types CCM Memory Types, 55
Index-3
Index
Series Five vs. Series 90, C4 Series One vs. Series 90, C4 Series Six vs. Series 90, C3 SNP Memory Types, 63 IC690CBL714A, multidrop cable, 817 Miniconverter kit cable diagrams, O3 IC690ACC901, O1 RS-232 port pin assignments, O2 RS-422 port pin assignments, O2 RS-422 (SNP) to RS-232, O1 specifications, O4 system configurations, O3 Series 90 CPU, Serial Port Pin Assignments, 39 Port 2, pinout, 39 Modem, J4 Hayescompatible, 926 support, L2 Modem Command via SNP Autodial, 668 Modem Communications Modes, E5 Modem setup, with Windows software, K1 Modem Transmission, F3 Modem Turnaround Delay, 631, 633, 753 Modems, E5 Modes, Communications, E5 MultiSlave Session, 631, 633 Multidrop, F2 cable, 817 configuring, H5 SNP ID, 664 system limitations, H2 Multidrop cables specfication table, H2 types, H2 Multidrop, SNP connecting, H6 examples, H4 overview, H1 setting SNP ID, H5 troubleshooting, H6 wiring diagram, H3 Noise Errors, E2 NOWAIT mode, 47
O
Operation auto dial feature, J4 using a modem, J4 Overrun Errors, E3 Overview of the CMM, 21
P
Parity Checking, E2 PeertoPeer, 77 Piggyback Status, 635, 636, 665 PLC Status Word, 637 PLC Major/Minor Type Codes, 651 PLC Short Status (SNP Command), 646 PLC Status Word, 637 PLC Sweep, calls Serial I/O, 913 Point Format, 659 Memory Type Restrictions, 660 Point-To-Point, F1 Port 1, pinout, 39 Port Status, read, 921 Port, serial, Series 90, standard, 310 Ports, RS422, described, M1 Preset Multiple Registers (RTU message), 739 Preset Single Register (RTU message), 734 Privilege levels, for Serial Port 2, M3 Privilege Levels in PLC, 639 Programming Examples CCM Program Example, 514 SNP Program Example, 616 Protocol Definition CCM Protocol, 72 RTU Protocol, 720 SNP Protocol, 747 SNP-X Protocol, 757 Protocol DefinitionCCM, RTU, SNP, SNP-X, 71 Protocol errors, 913
GFK-0582D
N
Noise Error Checking, Parity Checking, E2 Index-4
Index
Protocols, communication, release information, M1 Return Control Program Name (SNP Command), 648 Return Controller Type/ID (SNP Command), 650 Return Fault Table (SNP Command), 653 Return PLC Time/Date (SNP Command), 652 RS232, E6 RS232 Cable Diagrams, 83 RS422, serial ports, Micro PLC, described, M1 RS422/RS485 Cable Diagrams, 85 Read Analog Inputs (RTU message), 732 Read Bytes, 928 Read CCM Diagnostic Status Words to Source Registers (CCM Command), 517 Read Diagnostic Status Words (SNP Command), 622 Read Exception Status (RTU message), 735 Read Input Table (RTU message), 730 Read Output Table (RTU message), 729 Read Program Block Memory (SNP Command), 644 Read QResponse to Source Register Table, 520 Read Registers (RTU message), 731 Read Scratch Pad Memory (RTU Message), 741 Read String, 930 Read System Memory (SNP Command), 640 Read Target to Source Memory (CCM Command), 519 Read Task Memory (SNP Command), 642 Repair, product, L2 Repeater/Converter, N1 Report Device Type (RTU Message), 740 Response Timeout, 631, 633, 760 Restart/Reset Pushbutton, 24 Retries (CCM), 713 Retries (SNP), 750 Retrieving a Datagram, 755
GFK-0582D
Q
QSequence, 710 QueryResponse, 720 Quick Guide to the Manual, 11
RS449, RS422, and RS485, E7 RS485 Interface, 85 2Wire Operation, 518 RS-232 (CPU 351 Port 1), 33, 37 RS-485 (CPU 351 Port 2), 33, 37 RTS/CTS Timing, 214 RTU 2Wire, 810 Duplex Mode parameter, 810 4Wire, 810 defined, M1 function codes, M2 RTU Character Format, 724 RTU Communication Errors, 744 IC690ACC901, Miniconverter/Cable, O1 RTU Compatibility, D1 RTU Message Descriptions, 729 Force Multiple Output, 738 Force Single Output, 733 Loopback/Maintenance, 736 Preset Multiple Registers, 739 Preset Single Register, 734 Read Analog Inputs, 732 Read Exception Status, 735 Read Input Table, 730 Read Output Table, 729 Read Registers, 731 Read Scratch Pad Memory, 741 Report Device Type, 740 RTU Message Fields, 722 Error Check Field, 724 Function Code, 722 Information Field, 723 Station Address, 722 RTU Message Format, 720
Index-5
Index
RTU Message Length, 728 RTU Message Termination, 724 RTU Message Types, 721 Broadcast, 721 Error Response, 721 Normal Response, 721 Query, 721 RTU Protocol, 720 RTU Scratch Pad, 742 RTU slave, 913 RTU Timeout Usage, 724 Session SNP Communication Session, 748 SNP-X Communication Session, 757 Session Type (SNP-X), 631, 633 Set PLC Time/Date (SNP Command), 655 Set Q Response (CCM Command), 516 Set XStatus Bits Address (SNP-X Command), 625, 627 Short Status, 646 Signal names conventions, 86 RS422, 86 Single Bit Write (CCM Command), 521 SingleSlave Session, 631, 633 Slave Memory Access Bits (X-Status Bits), 759 Slave PLC Status Word (SNP-X), 631, 633, 759 SNP, 99 SNP Command Examples, 622 Attach, 634 Autodial Command, 668 Cancel Datagram, 662 Change Privilege Level, 638 Change SNP ID, 624 Clear Diagnostic Status Words, 621 Establish Datagram, 658 Long Attach, 665 PLC Short Status, 646 Read Diagnostic Status Words, 622 Read Program Block Memory, 644 Read System Memory, 640 Read Task Memory, 642 Return Control Program Name, 648 Return Controller Type and ID Information, 650 Return Fault Table, 653 Return PLC Time/Date, 652 Set PLC Time/Date, 655 Set XStatus Bits Address, 625, 627 Toggle Force System Memory, 656 Update Datagram, 661 Update RealTime Datagram, 663 Write Program Block Memory, 645 Write System Memory, 641 Write Task Memory, 643 XRead, 630 XWrite, 632 SNP Command Summary, 620
GFK-0582D
S
Scratch Pad (CCM), 56 Scratch Pad (RTU), 742 Serial Communications Line, E1, E5 Serial I/O Cancel Operation function, 924 Flush Input Buffer function, 920 Initialize Port function, 918 Input Buffer function, 919 Overview, 313 Read Bytes function, 928 Read Port Status function, 921 Read String function, 930 Write Bytes function, 925, 927 Write Port Control function, 923 Serial Line Interface, E1 Serial port, standard, Series 90 CPU, 310 Standard SNP serial port, Series 90 CPU, 310 Serial port connector, when functional, 310 Serial Port Pin Assignments, 39 Series 90 CPU, 39 Serial Ports, 24 CMM311, 25 CMM711, 24 Series 90 Micro PLC, M1 Serial ports protocols supported, M1 Series 90 PLC, described, M1 Series 90 Micro PLC, Serial Ports, M1 Series 9030 CPUs, figure, 32 Index-6
Index
SNP COMMREQ Programming Examples, 616 SNP ID, 624, 631, 632, 635, 663, 666, 748, 758, M3 for multidrop, H5 Null, 664 SNP master, 913 SNP MasterSlave Operation, 747 SNP Message Format, 748 SNP multidrop, overview, H1 SNP Protocol, 747 SNP RequestResponse, 749 SNP Retry and Error Recovery, 750 SNP Service, 61 SNP Status Word, 64 SNP Timers, 750 Change via Long Attach, 665 T1, 751 T2, 751 T3, 751 T3, 752 T3, 751 T4, 752 T5, 752 T5, 752 T5, 752 SNP-X Commands, 772 XAttach Command, 772 XRead Command, 775 XWrite Command, 777 SNP-X Protocol, 757 SNP-X Protocol Sequence, 763 SNP-X State Tables, 784 SNP-X Master State Table, 784 SNP-X Slave State Table, 786 SNP-X COMMREQ Programming Examples, 620 Set XStatus Bits Address, 625, 627 XRead, 630 XWrite, 632 Software Configuration (CCM Command), 518 Source Memory Address (CCM), 53 Standards, Interface, E6 State Tables (CCM), 713 Station Manager s cable, 816
GFK-0582D
Status Word CCM Status Word, 511 SNP Status Word, 64 Synchronize PLC Time/Date, 655
T
Target ID (CCM), 52 Target Memory Address (CCM), 53 Target Memory Type (CCM), 53 Telephone numbers, GE Fanuc help, L2 Timeout Errors, E3 Timeouts (CCM), 711 Timeouts (RTU), 724, 745 Timers (SNP-X), 760 Broadcast Delay, 760 Buffer Timeout, 761 Response Timeout, 760 Timers (SNP) Default SNP Timer Values, 215 SNP Timers, 750 Toggle Force Memory Types, 657 Toggle Force System Memory (SNP Command), 656 Transmission Delay, 631, 633, 753 Transmission Errors and Detection, E1, E2 Transmission Timing Errors, E3 Transmission, Asynchronous, E4 Troubleshooting, multidrop problems, H6
U
Update Datagram (SNP Command), 661 Update RealTime Datagram, 755 Update RealTime Datagram (SNP Command), 663
W
WAIT mode, 47 Web site, GE Fanuc, L1 Wiring Diagrams, 81 Write Bytes, 927
Index-7
Index
Write Program Block Memory (SNP Command), 645 Write System Memory (SNP Command), 641 Write Task Memory (SNP Command), 643 Write to Target from Source (CCM Command), 522 WYE Cable for CMM311, 25
X
XBuffer Message Structure, 771 XRead (SNP-X Commands), 630 XRequest Message Structure, 767 XResponse Message Structure, 769 XStatus Bits, 625, 627, 759 XWrite (SNP-X Command), 632
Index-8
GFK-0582D