Quick Talking to ControlLogix (PCCC-style)

Transcription

1 Quick Talking to ControlLogix (PCCC-style) 1 Packet Formats 1.1 TCP Socket The explicit unconnected messaging we are doing uses a normal TCP socket opened to remote TCP port xaf12 ( or decimal). For this to work you need to enable PCCC command processing in RSLogix... which means little more than mapping AB file numbers to ControlLogix data objects. It is easiest to create arrays of 16-bit INT's in the ControlLogix, otherwise the tendency for ControlLogix to like 32-bit alignment will complicate your exchange. 2 Ethernet/IP Register Session This packet must be issued on a new TCP socket to register a formal Ethernet/IP session. A 4-byte session handle is returned that MUST be reused on all future requests. Technically, we should issue an Unregister Session command before ending, but closing the socket works as well. 2.1 Request (You send to ControlLogix) Offset Value 2.2 Description / x 1 / x1 2 / x2 3 / x3 4 / x4 5 / x5 6 / x6 7 / x7 8 / x8 9 / x9 1 / xa 11 / xb 12 / xc 13 / xd 14 / xe 15 / xf 16 / x1 17 / x11 18 / x12 19 / x13 2 / x14 21 / x15 22 / x16 23 / x17 24 / x18 25 / x19 26 / x1a 27 / x1b x65 x4 x1 Ethernet/IP Encapsulation Command: Register Session Length of data attached to Ethernet/IP Encapsulation Header Set session handle remote server will fill in. Status remote server will fill in. Header Options Field MUST be zero () Register Protocol Version MUST be one (1) Register Options MUST be zero () Quick Talking to ControlLogix 16-Oct-2 Page 1 of 8

2 2.3 Response (You receive from ControlLogix) Offset Value 2.4 Description / x 1 / x1 2 / x2 3 / x3 4 / x4 5 / x5 6 / x6 7 / x7 8 / x8 9 / x9 1 / xa 11 / xb 12 / xc 13 / xd 14 / xe 15 / xf 16 / x1 17 / x11 18 / x12 19 / x13 2 / x14 21 / x15 22 / x16 23 / x17 24 / x18 25 / x19 26 / x1a 27 / x1b x65 x4 x1 Ethernet/IP Encapsulation Command: Register Session Length of data attached to Ethernet/IP Encapsulation Header Session handle returned as 32-bit value. You do not place any meaning on this other than to return the same 4 bytes in every Ethernet/IP Encapsulation Header until you disconnect. An example Session Handle is xf222 Status if not ZERO (), some error occurred. See ODVA/CIP specification Vol 2, Chapter 2 for error code meanings. You should NOT receive any if you follow these packet formats and there are no hardware faults. Sender/Client Context your 8 bytes will be returned here Header Options Field MUST be zero () Register Protocol Version MUST be one (1) Register Options MUST be zero () Quick Talking to ControlLogix 16-Oct-2 Page 2 of 8

3 3 Ethernet/IP Unconnected Send SLC5 Read Use this packet to query a SLC5 File defined in the ControlLogix. 3.1 SLC5 Read Request (You send to ControlLogix) Offset Value Description / x x6f Ethernet/IP Encapsulation Command: Read RR Data 1 / x1 2 / x2 ( x36 ) Length of data attached to Ethernet/IP Encapsulation Header 3 / x3 4 / x4 Session handle return the value you obtained from Register Session 5 / x5 6 / x6 7 / x7 8 / x8 Status. 9 / x9 1 / xa 11 / xb 12 / xc 13 / xd 14 / xe 15 / xf 16 / x1 17 / x11 18 / x12 19 / x13 2 / x14 Header Options Field MUST be zero () 21 / x15 22 / x16 23 / x17 24 / x18 Interface Handle MUST be zero () 25 / x19 26 / x1a 27 / x1b 28 / x1c ( xa ) Command Timeout in Seconds 1 is a good number 29 / x1d 3 / x1e x2 CPF item count should be 2 31 / x1f 32 / x2 33 / x21 CPF Address Item two 16-bit zero () for NULL address type (this is only used for connected messaging or I/O messaging) 34 / x22 35 / x23 36 / x24 xb2 CPF Data Item Type B2 is unconnected or UCMM 37 / x25 38 / x26 ( x26 ) CPF Data Item Length (in BYTES) adjust to correct length 39 / x27 4 / x28 x52 CIP Connection Manager Service = Unconnected Send 41 / x29 x2 Length (in WORDS) of CIP IOI Path 42 / x2a x2 Logical Segment, Class=x6 (Connection Manager) 43 / x2b x6 44 / x2c x24 Logical Segment, Instance=x1 45 / x2d x1 46 / x2e xa Priority / Ticks multiplier, xa means normal priority, multiple by about 1 second 47 / x2f ( x9 ) Given above multiplier, this means Time out in 9 seconds 48 / x3 ( x18 ) Length of CIP message we are unconnected sending (in BYTES) 49 / x31 5 / x32 x4c PCCC Object Service Code 51 / x33 x2 Length (in WORDS) of CIP IOI Path 52 / x34 x2 Logical Segment, Class=x67 (Rockwell Specific, PCCC Object) 53 / x35 x6 54 / x36 55 / x37 x24 x1 Logical Segment, Instance=x1 Quick Talking to ControlLogix 16-Oct-2 Page 3 of 8

4 56 / x38 57 / x39 58 / x3a 59 / x3b 6 / x3c 61 / x3d 62 / x3e 63 / x3f x1 PCCC addressing info just use these defaults. 64 / x4 xf PCCC CMD / Command (see DF1 manual # at 65 / x41 PCCC STS / Status send as zero 66 / x42 ( x1 ) PCCC TNS / Transaction Number should vary between each poll 67 / x43 ( ) 68 / x44 xa2 PCCC FNC = Protected Typed Logical Read with 3 address fields 69 / x45 ( x6 ) Byte Count to Read 7 / x46 ( x7 ) File Number defined in ControlLogix limited to / x47 x89 File Type = 16-bit INTEGER see DF1 manual for other types 72 / x48 ( ) Read starting at this element 73 / x49 Sub-Element only used for bit or structured data file types?? WARNING must PAD if byte 48 is ODD but NO PAD in this example!! 74 / x4a x1 Length of Connection Path route through ControlLogix Backplane 75 / x4b Reserved must be zero 76 / x4c ( x1 ) Route to ControlLogix Backplane MUST be one (1) 77 / x4d Which SLOT normally ControlLogix CPU is in slot 3.2 SLC5 Read Response (You receive from ControlLogix) Offset Value 3.3 Description / x 1 / x1 2 / x2 3 / x3 4 / x4 5 / x5 6 / x6 7 / x7 8 / x8 9 / x9 1 / xa 11 / xb 12 / xc 13 / xd 14 / xe 15 / xf 16 / x1 17 / x11 18 / x12 19 / x13 2 / x14 21 / x15 22 / x16 23 / x17 24 / x18 25 / x19 26 / x1a 27 / x1b 28 / x1c 29 / x1d 3 / x1e 31 / x1f 32 / x2 33 / x21 34 / x22 35 / x23 x6f ( xa ) x2 Ethernet/IP Encapsulation Command: Read RR Data Length of data attached to Ethernet/IP Encapsulation Header Session handle Status - should be zeros, bad encap error is not Header Options Field MUST be zero () Interface Handle MUST be zero () Command Timeout in Seconds 1 is a good number CPF item count should be 2 CPF Address Item two 16-bit zero () for NULL address type (this is only used for connected messaging or I/O messaging) Quick Talking to ControlLogix 16-Oct-2 Page 4 of 8

5 36 / x24 xb2 CPF Data Item Type B2 is unconnected or UCMM 37 / x25 38 / x26 CPF Data Item Length (in BYTES) 39 / x27 4 / x28 xcc PCCC Object Service Code or d with x8 to indicate REPLY 41 / x29 42 / x2a 43 / x2b Response codes should all be ZERO. If byte 42 is NOT zero, an error occurred. Byte 42 will be the GRC or General Response Code. See ODVA manual for how to decode bytes following GRC 44 / x2c 45 / x2d 46 / x2e 47 / x2f 48 / x3 49 / x31 5 / x32 51 / x33 x1 PCCC addressing info notice 4-byte pieces swapped. 52 / x34 x4f PCCC CMD or d with x4 to indicate REPLY 53 / x35 PCCC STS if not zero, PCCC error, see DF1 manual 56 / x42?? PCCC TNS / Transaction Number should MATCH what you sent 57 / x43?? 58 / x44?? Little-endian data word, 1 of 3 in this example 59 / x45?? 6 / x46?? Little-endian data word, 2 of 3 in this example 61 / x47?? 62 / x48 63 / x49???? Little-endian data word, 3 of 3 in this example Quick Talking to ControlLogix 16-Oct-2 Page 5 of 8

6 4 Ethernet/IP Unconnected Send SLC5 Write Use this packet to write a SLC5 File defined in the ControlLogix. 4.1 SLC5 Write Request (You send to ControlLogix) Offset Value Description / x x6f Ethernet/IP Encapsulation Command: Read RR Data 1 / x1 2 / x2 ( x3c ) Length of data attached to Ethernet/IP Encapsulation Header 3 / x3 4 / x4 Session handle return the value you obtained from Register Session. 5 / x5 6 / x6 7 / x7 8 / x8 Status 9 / x9 1 / xa 11 / xb 12 / xc 13 / xd 14 / xe 15 / xf 16 / x1 17 / x11 18 / x12 19 / x13 2 / x14 Header Options Field MUST be zero () 21 / x15 22 / x16 23 / x17 24 / x18 Interface Handle MUST be zero () 25 / x19 26 / x1a 27 / x1b 28 / x1c ( xa ) Command Timeout in Seconds 1 is a good number 29 / x1d 3 / x1e x2 CPF item count should be 2 31 / x1f 32 / x2 33 / x21 CPF Address Item two 16-bit zero () for NULL address type (this is only used for connected messaging or I/O messaging) 34 / x22 35 / x23 36 / x24 xb2 CPF Data Item Type B2 is unconnected or UCMM 37 / x25 38 / x26 ( x2c ) CPF Data Item Length (in BYTES) adjust to correct length 39 / x27 4 / x28 x52 CIP Connection Manager Service = Unconnected Send 41 / x29 x2 Length (in WORDS) of CIP IOI Path 42 / x2a x2 Logical Segment, Class=x6 (Connection Manager) 43 / x2b x6 44 / x2c x24 Logical Segment, Instance=x1 45 / x2d x1 46 / x2e xa Priority / Ticks multiplier, xa means normal priority, multiple by about 1 second 47 / x2f ( x9 ) Given above multiplier, this means Time out in 9 seconds 48 / x3 ( x1e ) Length of CIP message we are unconnected sending (in BYTES) 49 / x31 5 / x32 x4c PCCC Object Service Code 51 / x33 x2 Length (in WORDS) of CIP IOI Path 52 / x34 x2 Logical Segment, Class=x67 (Rockwell Specific, PCCC Object) 53 / x35 x6 54 / x36 55 / x37 x24 x1 Logical Segment, Instance=x1 Quick Talking to ControlLogix 16-Oct-2 Page 6 of 8

7 56 / x38 57 / x39 58 / x3a 59 / x3b 6 / x3c 61 / x3d 62 / x3e 63 / x3f x1 PCCC addressing info just use these defaults. 64 / x4 xf PCCC CMD / Command (see DF1 manual # at 65 / x41 PCCC STS / Status send as zero 66 / x42 ( x1 ) PCCC TNS / Transaction Number should vary between each poll 67 / x43 ( ) 68 / x44 xaa PCCC FNC = Protected Typed Logical Read with 3 address fields 69 / x45 ( x6 ) Byte Count to Write 7 / x46 ( x7 ) File Number defined in ControlLogix limited to / x47 x89 File Type = 16-bit INTEGER see DF1 manual for other types 72 / x48 ( x5 ) Write starting at this element 73 / x49 Sub-Element only used for bit or structured data file types 74 / x4a?? Little-endian data word, 1 of 3 in this example 75 / x4b?? 76 / x4c?? Little-endian data word, 2 of 3 in this example 77 / x4d?? 78 / x4e?? Little-endian data word, 3 of 3 in this example 79 / x4f???? WARNING must PAD if byte 48 is ODD but NO PAD in this example!! 8 / x5 x1 Length of Connection Path route through ControlLogix Backplane 81 / x51 Reserved must be zero 82 / x52 ( x1 ) Route to ControlLogix Backplane MUST be one (1) 83 / x53 Which SLOT normally ControlLogix CPU is in slot 4.2 SLC5 Write Response (You receive from ControlLogix) Offset Value 4.3 Description / x x6f Ethernet/IP Encapsulation Command: Read RR Data 1 / x1 2 / x2 Length of data attached to Ethernet/IP Encapsulation Header 3 / x3 4 / x4 Session handle 5 / x5 6 / x6 7 / x7 8 / x8 Status should be zeros 9 / x9 1 / xa 11 / xb 12 / xc 13 / xd 14 / xe 15 / xf 16 / x1 17 / x11 18 / x12 19 / x13 2 / x14 Header Options Field MUST be zero () 21 / x15 22 / x16 23 / x17 24 / x18 Interface Handle MUST be zero () 25 / x19 26 / x1a 27 / x1b 28 / x1c ( xa ) Command Timeout in Seconds 1 is a good number Quick Talking to ControlLogix 16-Oct-2 Page 7 of 8

8 29 / x1d 3 / x1e 31 / x1f x2 32 / x2 33 / x21 34 / x22 35 / x23 36 / x24 xb2 37 / x25 38 / x26 39 / x27 CPF item count should be 2 CPF Address Item two 16-bit zero () for NULL address type (this is only used for connected messaging or I/O messaging) CPF Data Item Type B2 is unconnected or UCMM CPF Data Item Length (in BYTES) 4 / x28 xcc PCCC Object Service Code or d with x8 to indicate REPLY 41 / x29 42 / x2a 43 / x2b Response codes should all be ZERO. If byte 42 is NOT zero, an error occurred. Byte 42 will be the GRC or General Response Code. See ODVA manual for how to decode bytes following GRC 44 / x2c 45 / x2d 46 / x2e 47 / x2f 48 / x3 49 / x31 5 / x32 51 / x33 x1 PCCC addressing info notice 4-byte pieces swapped. 52 / x34 x4f PCCC CMD or d with x4 to indicate REPLY 53 / x35 PCCC STS if not zero, PCCC error, see DF1 manual 56 / x42 57 / x43???? PCCC TNS / Transaction Number should MATCH what you sent Quick Talking to ControlLogix 16-Oct-2 Page 8 of 8