GE Fanuc Automation Programmable Control Products

TCP/IP Ethernet Communications

for PACSystems
Users Manual, GFK-2224C
April 2005

GFL-002

Warnings, Cautions, and Notes as Used in this Publication

Warning
Warning notices are used in this publication to emphasize that hazardous voltages, currents, temperatures, or other conditions that could cause personal injury exist in this equipment or may be associated with its use. In situations where inattention could cause either personal injury or damage to equipment, a Warning notice is used.

Caution
Caution notices are used where equipment might be damaged if care is not taken.

Note
Notes merely call attention to information that is especially significant to understanding and operating the equipment. This document is based on information available at the time of its publication. While efforts have been made to be accurate, the information contained herein does not purport to cover all details or variations in hardware or software, nor to provide for every possible contingency in connection with installation, operation, or maintenance. Features may be described herein which are not present in all hardware and software systems. GE Fanuc Automation assumes no obligation of notice to holders of this document with respect to changes subsequently made. GE Fanuc Automation makes no representation or warranty, expressed, implied, or statutory with respect to, and assumes no responsibility for the accuracy, completeness, sufficiency, or usefulness of the information contained herein. No warranties of merchantability or fitness for purpose shall apply. The following are trademarks of GE Fanuc Automation, Inc.
Alarm Master CIMPLICITY CIMPLICITY 90ADS CIMSTAR Field Control GEnet Genius Helpmate Logicmaster Modelmaster Motion Mate PACSystems Proficy ProLoop PROMACRO PowerMotion PowerTRAC Series 90 Series Five Series One Series Six Series Three VersaMax VersaPoint VersaPro VuMaster Workmaster

Copyright 2005 GE Fanuc Automation North America, Inc. All Rights Reserved

Contents

Chapter 1

Introduction............................................................................................ 1-1
Other PACSystems Manuals ............................................................................................ 1-2 Ethernet Interfaces for PACSystems Controllers.............................................................. 1-3 PACSystems Ethernet Interface Communications Features ............................................ 1-4 Ethernet Interface Specifications.............................................................................. 1-4 Ethernet Interface Ports............................................................................................ 1-5 Station Manager ....................................................................................................... 1-5 Firmware Upgrades .................................................................................................. 1-5 Built-In Web Server .................................................................................................. 1-6 SRTP Client (Channels) ........................................................................................... 1-6 Ethernet Global Data (EGD)..................................................................................... 1-6 Ethernet Redundancy Operation ...................................................................................... 1-7 Effect of Redundancy Role Switching on Ethernet Communications ...................... 1-7 SRTP Server Operation in a Redundancy System .................................................. 1-8 SRTP Client Operation in a Redundancy System.................................................... 1-8 EGD Class 1 (Production & Consumption) in a Redundancy System ..................... 1-8 EGD Class 2 Commands in a Redundancy System ................................................ 1-9 WEB Server Operation in a Redundancy System.................................................... 1-9 FTP Operation in a Redundancy System................................................................. 1-9 SNTP Operation in a Redundancy System .............................................................. 1-9 Remote Station Manager Operation in a Redundancy System ............................. 1-10 IP Address Configuration in a Redundancy System .............................................. 1-10

Chapter 2

Installation and Startup ......................................................................... 2-1

Ethernet Interface Controls and Indicators ....................................................................... 2-2 Ethernet LEDs ................................................................................................................... 2-3 LAN LED Operation.................................................................................................. 2-3 STAT LED Operation................................................................................................ 2-4 EOK LED Operation ................................................................................................. 2-4 Ethernet Port LEDs Operation (100Mb and Link/Activity) ........................................ 2-4 Ethernet Restart Pushbutton............................................................................................. 2-4 Module Installation ............................................................................................................ 2-5 Installing an RX7i CPU with Embedded Ethernet Interface ..................................... 2-5 Installing a Rack-based Ethernet Interface Module ................................................. 2-6 Ethernet Port Connectors.................................................................................................. 2-7 Embedded Switch..................................................................................................... 2-7 Connection to a 10Base-T / 100Base Tx Network ................................................... 2-9 10Base-T/100Base Tx Port Pinouts ......................................................................... 2-9 Station Manager Port ...................................................................................................... 2-12 Port Settings ........................................................................................................... 2-12 Station Manager (RS-232) Port Pinout................................................................... 2-12 Verifying Proper Power-Up of the Ethernet Interface after Configuration....................... 2-13 Pinging TCP/IP Ethernet Interfaces on the Network....................................................... 2-14

GFK-2224C

iii

Contents
Pinging the Ethernet Interface from a UNIX Host or Computer Running TCP/IP Software ................................................................................................................. 2-14

Chapter 3

Configuration ......................................................................................... 3-1

Configuration Data ............................................................................................................ 3-2 Generating / Storing / Loading the Configuration..................................................... 3-2 Backup Configuration Data ...................................................................................... 3-2 Locally-Edited Configuration Data............................................................................ 3-2 Initial IP Address Assignment ........................................................................................... 3-3 Assigning a Temporary IP Address Using the Programming Software ................... 3-3 Assigning a Temporary IP Address Using BOOTP.................................................. 3-5 Assigning a Temporary IP Address Using Telnet .................................................... 3-6 Configuring the Ethernet Interface .................................................................................... 3-7 Configuring an Embedded Ethernet Interface .......................................................... 3-7 Configuring a Rack-based Ethernet Interface Module ............................................. 3-7 Ethernet Parameters (Settings Tab)......................................................................... 3-8 RS-232 Port (Station Manager) Tab....................................................................... 3-11 Configuring Ethernet Global Data ................................................................................... 3-12 Basic EGD Configuration........................................................................................ 3-12 Using Signatures in Ethernet Global Data.............................................................. 3-13 Configuring Ethernet Global Data Using the EGD Configuration Server ............... 3-14 Configuring Ethernet Global Data Without Using the EGD Configuration Server.. 3-21

Chapter 4

Ethernet Global Data ............................................................................. 4-1

Ethernet Global Data Operation........................................................................................ 4-2 The EGD Producer ................................................................................................... 4-2 EGD Consumers ...................................................................................................... 4-2 EGD Exchanges................................................................................................................ 4-3 The Content of an Ethernet Global Data Exchange................................................. 4-3 The Data Ranges (Variables) in an Ethernet Global Data Exchange ...................... 4-4 Valid PLC Memory Types for Ethernet Global Data................................................. 4-4 Planning Exchanges................................................................................................. 4-5 Using Ethernet Global Data in a Redundancy System ............................................ 4-5 Sending an Ethernet Global Data Exchange to Multiple Consumers ............................... 4-6 Multicasting Ethernet Global Data............................................................................ 4-6 Broadcasting Ethernet Global Data.......................................................................... 4-7 Ethernet Global Data Timing............................................................................................. 4-8 EGD Synchronization ............................................................................................... 4-8 Configurable Producer Period for an EGD Exchange.............................................. 4-9 Consumer Update Timeout Period........................................................................... 4-9 Timestamping of Ethernet Global Data Exchanges ........................................................ 4-11 SNTP Operation ..................................................................................................... 4-12 Effect of PLC Modes and Actions on EGD Operations................................................... 4-14 Monitoring Ethernet Global Data Exchange Status ........................................................ 4-15 Exchange Status Word Error Codes ...................................................................... 4-16

iv

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Contents
Chapter 5 Programming EGD Commands ............................................................ 5-1
Using EGD Commands in a Redundancy System ................................................... 5-1 COMMREQ Format for Programming EGD Commands .................................................. 5-2 COMMREQ Status for the EGD Commands .................................................................... 5-3 COMMREQ Status Values ....................................................................................... 5-3 Read PLC Memory (4000) ................................................................................................ 5-4 Read PLC Memory Command Block ....................................................................... 5-4 Write PLC Memory (4001) ................................................................................................ 5-8 Write PLC Memory Command Block........................................................................ 5-8 Read EGD Exchange (4002) .......................................................................................... 5-11 Write EGD Exchange (4003)........................................................................................... 5-14 Write EGD Exchange Command Block.................................................................. 5-14 Masked Write to EGD Exchange (4004) ......................................................................... 5-17 Masked Write EGD Exchange Command Block .................................................... 5-17 Masked Write to EGD Exchange Bit Mask and Data Bits ...................................... 5-20

Chapter 6

Programming SRTP Channel Commands ........................................... 6-1

SRTP Channel Commands............................................................................................... 6-2 Channel Operations.................................................................................................. 6-2 Aborting and Re-tasking a Channel ......................................................................... 6-2 Monitoring the Channel Status ................................................................................. 6-3 SRTP Channel Commands in a Redundant System ............................................... 6-5 Executing a Channel Command............................................................................... 6-6 COMMREQ Format for Programming Channel Commands............................................. 6-7 The COMMREQ Command Block: General Description.......................................... 6-8 Establish Read Channel (2003) ...................................................................................... 6-10 Establish Write Channel (2004) ...................................................................................... 6-14 Send Information Report (2010)...................................................................................... 6-18 Abort Channel (2001) ...................................................................................................... 6-21 Retrieve Detailed Channel Status (2002) ....................................................................... 6-22 Monitoring the Detailed Channel Status Words ..................................................... 6-24 Programming for Channel Commands ........................................................................... 6-25 COMMREQ Example ............................................................................................. 6-25 Sequencing Communications Requests ................................................................ 6-28 Managing Channels and TCP Connections ........................................................... 6-28 Use Channel Re-Tasking To Avoid Using Up TCP Connections ........................ 6-29 Client Channels TCP Resource Management ....................................................... 6-30 SRTP Application Timeouts ................................................................................... 6-30 Monitoring Channel Status.............................................................................................. 6-31 Format of the COMMREQ Status Word ................................................................. 6-31 Differences between Series 90 and PACSystems SRTP Channels............................... 6-32

Chapter 7

Modbus TCP........................................................................................... 7-1

Modbus TCP Server.......................................................................................................... 7-2

GFK-2224C

Contents

Contents
Modbus TCP Server Connections ............................................................................ 7-2 Modbus Conformance Classes ................................................................................ 7-2 Server Protocol Services .......................................................................................... 7-2 Station Manager Support ......................................................................................... 7-2 Reference Mapping ........................................................................................................... 7-3 Modbus Reference Tables ....................................................................................... 7-3 Address Configuration .............................................................................................. 7-5 Modbus Function Codes ................................................................................................... 7-6

Chapter 8

Network Administration ........................................................................ 8-1

IP Addressing .................................................................................................................... 8-2 IP Address Format for Network Classes A, B, C...................................................... 8-2 IP Addresses Reserved for Private Networks .......................................................... 8-3 Multicast IP Addresses ............................................................................................. 8-3 Loopback IP Addresses............................................................................................ 8-3 Gateways .......................................................................................................................... 8-4 Networks Connected by a Gateway ......................................................................... 8-4 Subnets ............................................................................................................................. 8-5 Subnet Addressing and Subnet Masks .................................................................... 8-5 Example: Network Divided into Two Subnets .......................................................... 8-6

Chapter 9

RX7i PLC Monitoring Via the Web........................................................ 9-1

System Requirements .............................................................................................. 9-1 WEB Server Operation in a Redundant System ...................................................... 9-2 Standard Web Pages ............................................................................................... 9-2 RX7i Home Page .............................................................................................................. 9-3 Reference Tables Viewer Page ........................................................................................ 9-4 Selecting Reference Table Data .............................................................................. 9-5 Saving Reference Table Settings............................................................................. 9-5 Display Formats........................................................................................................ 9-6 PLC Fault Table Viewer Page........................................................................................... 9-7 I/O Fault Table Viewer Page ........................................................................................... 9-10 Downloading PLC Web Pages........................................................................................ 9-11 FTP Connect and Login.......................................................................................... 9-11 Changing the Password ......................................................................................... 9-12 Web Page File Transfer.......................................................................................... 9-13 Viewing the RX7i PLC Web Pages ................................................................................. 9-14

Chapter 10

Diagnostics .......................................................................................... 10-1

Diagnostic Tools Available for Troubleshooting.............................................................. 10-3 States of the Ethernet Interface ...................................................................................... 10-4 EOK LED Blink Codes for Hardware Failures................................................................. 10-6 PLC Fault Table .............................................................................................................. 10-7 PLC Fault Table Descriptions................................................................................. 10-8

vi

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Contents
Monitoring the Ethernet Interface Status Bits ............................................................... 10-10 Monitoring the FT Output of the COMMREQ Function Block. ...................................... 10-13 Monitoring the COMMREQ Status Word ...................................................................... 10-14 Major Error Codes in the COMMREQ Status Word ............................................. 10-15 Minor Error Codes for Major Error Codes 05H (at Remote Server PLC) and 85H (at Client PLC) ........................................................................................................... 10-16 Minor Error Codes for Major Error Code 11H (at Remote Server PLC)............... 10-18 Minor Error Codes for Major Error Code 90H (at Client PLC).............................. 10-21 Minor Error Codes for Major Error Code A0H (at Client PLC) ............................. 10-23 Using the EGD Management Tool ................................................................................ 10-24 Installing the EGD Management Tool .................................................................. 10-24 Launching the EGD Management Tool ................................................................ 10-24 Monitoring EGD Devices ...................................................................................... 10-25 Monitoring Status of Ethernet Global Data for a Device ...................................... 10-26 Troubleshooting Common Ethernet Difficulties............................................................. 10-30 COMMREQ Fault Errors....................................................................................... 10-30 PLC Timeout Errors.............................................................................................. 10-31 Application Timeout Errors ................................................................................... 10-32 EGD Configuration Mismatch Errors .................................................................... 10-33 Station Manager Lockout under Heavy Load ....................................................... 10-33 PING Restrictions ................................................................................................. 10-33 SRTP Connection Timeout................................................................................... 10-34 Sluggish Programmer Response after Network Disruption.................................. 10-34 EGD Command Session Conflicts ....................................................................... 10-34 SRTP Request Incompatibility with Existing Host Communications Toolkit Devices or Other SRTP Clients .............................................................................................. 10-35 COMMREQ Flooding Can Interrupt Normal Operation........................................ 10-35 Accelerated EGD Consumption Can Interfere with EGD Production................... 10-35

Appendix A

Configuring Advanced User Parameters .............................................A-1

Format of the Advanced User Parameters File.................................................................A-3 Advanced User Parameter Definitions ..............................................................................A-4

GFK-2224C

Contents

vii

Contents

viii

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter Introduction

1
This chapter includes basic information about Ethernet Interfaces for the PACSystems family of controllers. It describes features of the Ethernet Interfaces in both conventional and redundancy systems. The rest of this manual provides instructions for installing and applying the PACSystems Ethernet Interfaces: Chapter 2, Installation describes user features and basic installation procedures for a PACSystems Ethernet Interface. Chapter 3, Configuration describes assigning a temporary IP address, configuring the Ethernet interface, configuring Ethernet Global Data, and setting up the RS-232 port for Local Station Manager operation. Chapter 4, Ethernet Global Data describes basic Ethernet Global Data operation for a PACSystems Ethernet Interface. Chapter 5, EGD Commands describes a set of commands that can be used in the application program to read and write PLC data or Ethernet Global Data exchange data over the network. Chapter 6, Programming SRTP Channel Commands describes how to implement PLC to PLC communications over the Ethernet network using SRTP Channel commands. Chapter 7, Modbus TCP describes the implementation of the Modbus/TCP Server feature for the PACSystems family of products. Chapter 8, Network Administration discusses how devices are identified on the network and how data is routed among devices. Chapter 9, RX7i PLC Monitoring Via the Web describes the Web browser feature provided by a PACSystems RX7i CPU with Embedded Ethernet. Chapter 10, Diagnostics describes diagnostic techniques for a PACSystems Ethernet Interface. This chapter also lists COMMREQ Status codes. Appendix A, Configuring Advanced User Parameters describes optional configuration of internal operating parameters used by the Ethernet interface. For most applications, the default Advanced User Parameters should not be changed.
GFK-2224C 1-1

Other PACSystems Manuals

The manuals listed below provide more information about the PACSystems family of products.

PACSystems RX7i Users Manual, GFK-2222 PACSystems RX7i Racks, Modules, and Power Supplies Users Manual, GFK-2223 PACSystems RX3i Racks, Modules, and Power Supplies Users Manual, GFK-2314 PACSystems Redundancy Manual GFK-2308 Station Manager for PACSystems Controllers, GFK-2225 PACSystems RX7i User's Guide to Integration of VME Modules, GFK-2235 PACSystems RX7i C Toolkit Users Guide, GFK-2259 Genius Bus Controller Users Manual, GFK-2017 CIMPLICITY Machine Edition Logic Developer-PLC Getting Started, GFK-1918 Installation Requirements for Conformance to Standards, GFK-1179

In addition to these manuals, datasheets and update documents describe individual modules and product revisions. The most recent PACSystems documentation is available online at www.gefanuc.com. The Infolink for PLC CD Set of documentation for GE Fanuc PLC products is updated periodically. It can be ordered as part number IC690CDR002.

1-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Ethernet Interfaces for PACSystems Controllers

A PACSystems Ethernet Interface enables a PACSystems controller to communicate with other PACSystems equipment and with Series 90 and VersaMax controllers. The Ethernet Interface provides TCP/IP communications with other PLCs, host computers running the Host Communications Toolkit or CIMPLICITY software, and computers running the TCP/IP version of the programming software. These communications use the GE Fanuc SRTP and Ethernet Global Data (EGD) protocols over a four-layer TCP/IP (Internet) stack. The Ethernet Interface has SRTP server capability. As a server, the Ethernet Interface responds to requests from devices such as PLC programming software, a Host computer running an SRTP application, or another PLC acting as a client.
Ethernet Cable
Network Connection Network Connection

Ethernet Interface Host Computer or Control Device running a Host Communications Toolkit

Ethernet Interface

Ethernet Interface Computer Running Programming SoftwareTCP/IP Ethernet

PACSystems and Series 90 PLCS

The PACSystems RX7i product family includes two types of Ethernet Interfaces: embedded and rack-based. The embedded Ethernet Interface is an integral part of RX7i CPU models IC698CPE010, IC698CPE020, and IC698CRE020. The rack-based Ethernet Module plugs into a single-width slot in an RX7i PLC rack. Both types of Interfaces are configured using the CIMPLICITY Machine Edition PLC programming software. In addition to the Ethernet interface within an RX7i CPU module, up to three additional Ethernet Modules (for a total of four Ethernet interfaces) can be installed in an RX7i PLC CPU rack.

GFK-2224C

Chapter 1 Introduction

1-3

PACSystems Ethernet Interface Communications Features

Full PLC programming and configuration services Periodic data exchange using Ethernet Global Data (EGD) EGD Commands to read and write PLC and EGD exchange memory over the network. TCP/IP communication services using SRTP Support for SRTP Client (Channels) Modbus TCP Server Redundant IP Addressing capability (with IC698CRE020 only). Basic remote PLC monitoring from a web browser (RX7i CPU Ethernet interface only) Comprehensive station management and diagnostic tools Extended PLC connectivity via IEEE 802.3 CSMA/CD 10Mbps and 100Mbps Ethernet LAN port connectors. Network switch that has Auto negotiate, Sense, Speed, and crossover detection. Direct connection to BaseT (twisted pair) network switch, hub, or repeater without an external transceiver. Protocol is stored in flash memory in the Ethernet interface and is easily upgraded through the CPU serial port. Communications with remote PLCs and other nodes reachable through routers. The gateway IP address must be configured. Internet access via web pages served up to standard web browsers, for the Ethernet interface embedded in the PACSystems CPU.

Ethernet Interface Specifications

Ethernet processor speed Connectors LAN Number of IP addresses Number of Ethernet Port Connectors Embedded Ethernet Switch Serial Port
1-4

200 MHz - Station Manager (RS-232) Port: 9-pin female D-connector - Two 10BaseT / 100BaseTX Ports: 8-pin female shielded RJ-45 IEEE 802.2 Logical Link Control Class I IEEE 802.3 CSMA/CD Medium Access Control 10/100 Mbps One Two, both are 10BaseT / 100BaseTX with auto-sensing RJ-45 connection. Yes Allows daisy chaining of Ethernet nodes. Station Mgr Port: RS-232 DCE, 1200 - 115200 bps.
GFK-2224C

TCP/IP Ethernet Communications for PACSystems April 2005

1 Ethernet Interface Ports

Each PACSystems Ethernet interface provides two auto-sensing 10Base T / 100Base TX RJ45 shielded twisted pair Ethernet ports for connection to either a 10BaseT or 100BaseTX IEEE 802.3 network. The port automatically senses the speed (10Mbps or 100Mbps), duplex mode (half duplex or full duplex) and cable (straight-through or crossover) attached to it with no intervention required.

Ethernet Media
The Ethernet Interface can operate directly on 10BaseT/100BaseTX media via its network ports.

10BaseT: 10BaseT uses a twisted pair cable of up to 100 meters in length between each
node and a switch, hub, or repeater. Typical switches, hubs, or repeaters support 6 to 12 nodes connected in a star wiring topology.

100BaseTX: 100BaseTX uses a cable of up to 100 meters in length between each node and
a switch, hub, or repeater. The cable should be data grade Category 5 unshielded twisted pair (UTP) or shielded twisted pair (STP) cable. Two pairs of wire are used, one for transmission, and the other for collision detection and receive. Typical switches, hubs, or repeaters support 6 to 12 nodes connected in a star wiring topology.

Station Manager
The built-in Station Manager function of the Ethernet Interface provides on-line supervisory access to the Ethernet Interface, through the Station Manager port or over the Ethernet cable. Station Manager services include:

An interactive set of commands for interrogating and controlling the station. Unrestricted access to observe internal statistics, an exception log, and configuration parameters. Password security for commands that change station parameters or operation. For remote Station Manager operation over the Ethernet network, the Ethernet Interface uses IP addressing. A PACSystems Ethernet Interface cannot send or receive remote Station Manager messages sent to a MAC address. Refer to the PACSystems TCP/IP Ethernet Communications Station Manager Manual, GFK2225 for complete information on the Station Manager.

Firmware Upgrades
PACSystems Ethernet interfaces receive their firmware upgrades indirectly from the PLC CPU using the WinLoader software utility. WInLoader is supplied with any updates to the Ethernet

GFK-2224C

Chapter 1 Introduction

1-5

1
Interface software. The user connects WinLoader to the PLC CPU serial port and specifies the target module by its Rack/Slot location in the PLC. For the CPU module, the embedded Ethernet interface firmware is upgraded along with the rest of the CPU firmware. WinLoader seamlessly upgrades first the CPU firmware and then the embedded Ethernet firmware without user intervention. Each Ethernet Interface modules firmware must be explicitly upgraded by specifying the rack and slot location of the module to the WinLoader utility.

Built-In Web Server

The embedded RX7i CPU Ethernet Interface provides Web Server capability. Each IC698 Ethernet interface supports World Wide Web access via FTP and HTTP to allow web pages to be stored and maintained on the Ethernet interface and served up via the web to standard web browsers. GE Fanuc provides a standard API so that you can generate customized web pages that display desired PLC data in a desired format. You store the web pages to the Ethernet interface via FTP. A basic set of predefined web pages in English are provided; they include a home page, Reference Table data, PLC Fault Table, and I/O Fault Table. Rackbased Ethernet Interface modules do not provide Web Server capability.

SRTP Client (Channels)

SRTP channels can be set up in the PLC application program. SRTP supports COMMREQdriven channel commands to establish new channels, abort existing channels, and retrieve the status of an existing channel. The PACSystems Ethernet interface supports up to 32 simultaneous SRTP Client connections. SRTP Client allows the PACSystems PLC to initiate data transfer with other SRTP-capable devices on the network.

Ethernet Global Data (EGD)

Each PACSystems CPU supports up to 255 simultaneous Ethernet Global Data (EGD) exchanges. EGD exchanges are configured using the programmer and stored into the PLC. Both Produced and Consumed exchanges can be configured. PACSystems Ethernet Interfaces support both selective consumption of EGD exchanges and EGD exchange production and consumption to the broadcast IP address of the local subnet. The PACSystems Ethernet interface can be configured to use SNTP to synchronize the timestamps of produced EGD exchanges. Beginning with PACSystems Release 2.00, PACSystems Ethernet interfaces implement the capabilities of a Class 1 and Class 2 device. COMMREQ-driven EGD Commands can be used in the application program to read and write data into PACSystems PLCs or other EGD Class 2 devices.

1-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Ethernet Redundancy Operation

The Redundant IP feature of the Ethernet Interface allows a single IP address called the Redundant IP address to be assigned to two Ethernet modules. The two modules are in two different PLCs that are configured as a redundant system. The Redundant IP Address is configured in addition to the normal unique (direct) IP address of each interface. Use of this feature requires a CRE020 PLC CPU. Only one of the two Ethernet interfaces that share the Redundant IP address may use the Redundant IP address at any time; this is the active unit. When commanded by its PLC CPU, this Ethernet interface activates the Redundant IP address and starts responding to the Redundant IP address in addition to its direct IP address. The active unit continues responding to the Redundant IP address until it is commanded to deactivate the Redundant IP or until the Ethernet interface determines that it has lost communications with the PLC CPU. The other unit (the backup unit) does not initiate communications or respond on the network using the Redundant IP address. It can only use the Redundant IP address if it is commanded by its CPU to become the active unit. Both the active and backup unit may continue to use their individual direct IP addresses, permitting programmer connection to the active or backup PLC at any time.
Redundant System

Direct IP
Programmer

PLC A

Addresses

PLC B

Redundant IP Address

Remote host (HMI, PLC, etc.)

Effect of Redundancy Role Switching on Ethernet Communications

When a redundancy role-switch occurs, Ethernet communications switch to the backup unit, which has no knowledge of any communication state at the previously-active unit. The application must include logic to detect loss of communication during a redundancy role switch and to then reinitiate communication. To remote hosts on the network, the redundant system is viewed as a single PLC with high reliability; the remote host neither knows nor cares which PLC is the active unit. By using the Redundant IP address, the remote host always communicates with the active unit. When a redundancy role switch occurs, the formerly-active PLC gives up ownership of the Redundant IP address and takes down all connection-oriented communications currently using the Redundant IP address. The applications in the redundant system and remote hosts must
GFK-2224C Chapter 1 Introduction 1-7

1
reestablish any such communications; the new Redundant IP connections will use the newly active PLC. The programmer can still communicate directly with each PLC in the redundant system (for example, to store new logic or configuration) using the direct IP address of each Ethernet Interface.

SRTP Server Operation in a Redundancy System

Only the active unit maintains SRTP Server connections at the Redundant IP address and is able to respond to SRTP requests. The backup unit does not respond to the Redundant IP address. When an Ethernet interface changes from active to backup state, it takes down all SRTP Server connections and their underlying TCP connections that use the Redundant IP address. Both the active and backup units maintain SRTP Server connections at the direct IP address for network communication with the programmer. Other remote hosts should use the Redundant IP address when communicating to a redundant system. Existing SRTP Server connections at the direct IP address are not disturbed when the Ethernet interface switches between active and backup states.

SRTP Client Operation in a Redundancy System

Only the active unit establishes and maintains SRTP Client connections (channels). The backup unit does not initiate any SRTP Client operations. If SRTP Client operations are attempted, a COMMREQ error status is returned to the local logic program. When the Ethernet interface changes from active to backup state, it takes down all SRTP Client connections and their underlying TCP connections. Because it can take some time to take down a TCP connection, the redundant system should reserve a spare SRTP Client connection for each connection using the Redundant IP address. That will prevent temporary resource problems when establishing new SRTP Client connections to the new active unit while the previous connections to the old active unit are being taken down.

EGD Class 1 (Production & Consumption) in a Redundancy System

Only the active unit produces Ethernet Global Data exchanges to the network. The backup unit does not produce EGD exchanges. When the active Ethernet interfaces changes to backup, it stops production of all EGD exchanges. When configured for Redundant IP operation, the active and backup Ethernet interfaces should be configured to consume EGD exchanges via multicast host groups or the local subnet broadcast address. This permits both the active and backup units to receive the latest data from the network. Unicast operation is not recommended. The backup unit does not consume any unicast exchanges at the Redundant IP address.
1-8 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

1 EGD Class 2 Commands in a Redundancy System

Remote hosts should use the Redundant IP address when communicating to a redundant system. Only the active unit responds to EGD commands. The backup unit does not respond to the Redundant IP address. When the active Ethernet interface changes to backup, any EGD command currently in process over the Redundant IP address is ended. When configured for Redundant IP operation, only the active unit sends EGD commands on the network. If the backup unit tries to initiate any EGD commands, a COMMREQ error status is returned to its application program. When the active Ethernet interfaces changes to backup, any EGD commands in process are ended. Although not recommend, EGD commands may be issued to the direct IP address. Both the active and backup units will respond to EGD commands received at the direct IP address.

WEB Server Operation in a Redundancy System

Only the active unit processes Web Server requests at the Redundant IP address and responds to web page requests. The backup unit does not respond to the Redundant IP address. When the active Ethernet interface changes to backup, it takes down all Web Server connections and their underlying TCP connections. The Web Server maintains its underlying TCP connection only long enough to process each web page request; a new TCP connection is opened, used, and closed for each subsequent web page display or update. So unless a web page change or update is requested during the redundancy role switch, the operation of the Redundant IP address is transparent to the Web remote browser. Any web page request in process over the Redundant IP when a role switch occurs is terminated. Although not recommended, the remote browser may issue Web Server requests to the direct IP address. Both the active and backup units respond to Web server requests received at the direct IP address. Remote web browsers are expected to use the Redundant IP address when communicating to a redundant system.

FTP Operation in a Redundancy System

FTP operations are used to transfer setup and configuration data to the Ethernet interface, not for communication with the actual PLC application. Therefore, FTP operations should only be performed using the direct IP address.

SNTP Operation in a Redundancy System

A PACSystems Ethernet Interface can operate as an SNTP client only, so it only receives broadcast time messages from an SRTP Server on the network. SNTP operation is unaffected by the current Ethernet redundancy state or by redundancy role switches.

GFK-2224C

Chapter 1 Introduction

1-9

Remote Station Manager Operation in a Redundancy System

The remote Station Manager should respond to the direct IP address regardless of whether the unit is active or backup, or whether or not Redundant IP is configured. Only the active unit responds to remote Station Manager commands at the Redundant IP address. The backup unit does not respond to the Redundant IP address. (Station Manager responses from the Redundant IP address can be misleading because it is difficult to determine which Ethernet interface is actually responding.)

IP Address Configuration in a Redundancy System

Redundancy systems should explicitly configure both the direct IP address and the Redundant IP address. Do not setup the direct IP address via BOOTP. The Redundant IP address must be configured on the same local sub-network as the direct IP address and gateway IP address (if used).

1-10

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter Installation and Startup

2
This chapter describes the Ethernet Interfaces user features and basic installation procedures:

Ethernet Interface Controls and Indicators Ethernet LEDs Ethernet Restart Pushbutton Module Installation Ethernet Port Connectors

Embedded Switch Connection to a 10Base T / 100Base Tx Network

Station Manager Port Powering Up the Ethernet Interface After Configuration Pinging TCP/IP Ethernet Interfaces on the Network

Features of the embedded CPU Ethernet Interface and the rack-based Ethernet Interface Module are the same unless noted otherwise.

GFK-2224C

2-1

Ethernet Interface Controls and Indicators

The Ethernet Interface provides: 1. Seven light emitting diode (LED) indicators

StaMgr

Ethernet Module OK (EOK) LAN Online (LAN) Status (STAT) Two Ethernet network activity LEDS (LINK) Two Ethernet network speed LEDS (100)
10/100 ENET A1 10/100 ENET A2 EOK LAN STAT

2. Ethernet Restart Pushbutton 3. Two 10BaseT/100BaseTX Ethernet Network Port Connectors. There is only one interface to the network (only one Ethernet address and only one IP address). 4. Station Manager (RS-232) Serial Port Features of the embedded CPU Ethernet Interface and the rack-based Ethernet Interface Module are the same unless noted otherwise.

100 LINK

100 LINK

ETHERNET RESTART

2-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Ethernet LEDs
The EOK, LAN, and STAT LEDs indicate the state and status of the Ethernet Interface. LED State
On Blinking Off

Indicates Performing Diagnostics

EOK LAN STAT EOK LAN STAT EOK

Fast Blink Off Off Slow Blink Off Off Slow Blink*

Waiting for Ethernet configuration from CPU Waiting for IP Address

LAN On/Traffic/Off STAT Slow Blink* (* EOK and STAT blink in unison) EOK LAN STAT EOK LAN STAT EOK LAN On On/Traffic/Off On/Off Blink error code Off Off Slow Blink* Slow Blink* Operational

Hardware failure. See chapter 8 for blink code definitions. Software Load

STAT Slow Blink* (* All LEDs blink in unison; pattern same for awaiting or performing load)

LAN LED Operation

The LAN LED indicates access to the Ethernet network. During normal operation and while waiting for an IP address, the LAN LED blinks when data is being sent or received over the network directed to or from the Ethernet interface. It remains on when the Ethernet interface is not actively accessing the network but the Ethernet physical interface is available and one or both of the Ethernet ports is operational. It is off otherwise unless software load is occurring.

GFK-2224C

Chapter 2 Installation and Startup

2-3

STAT LED Operation

The STAT LED indicates the condition of the Ethernet interface in normal operational mode. If the STAT LED is off, an event has been entered into the exception log and is available for viewing via the Station Manager interface. The STAT LED is on during normal operation when no events are logged. In the other states, the STAT LED is either off or blinking and helps define the operational state of the module.

EOK LED Operation

The EOK LED indicates whether the module is able to perform normal operation. This LED is on for normal operation and flashing for all other operations. When a hardware or unrecoverable runtime failure occurs, the EOK LED blinks a two-digit error code identifying the failure. For a list of blink codes and their meanings, see chapter 8.

Ethernet Port LEDs Operation (100Mb and Link/Activity)

Each of the two Ethernet ports (Ports 1A and 1B) has two LED indicators, 100 and LINK. The 100 LED indicates the network data speed (10 or 100 Mb/sec). This LED is lit if the network connection at that network port is 100 Mbps. The LINK LED indicates the network link status and activity. This LED is lit when the link is physically connected. It blinks when traffic is detected at that network port. Traffic at the port does not necessarily mean that traffic is present at the Ethernet interface, since the traffic may be going between ports of the switch.

Ethernet Restart Pushbutton

This pushbutton is used to manually restart the Ethernet firmware without power cycling the entire system. It is recessed to prevent accidental operation.

LED Operation during Restart

When the Ethernet firmware is manually restarted by the Ethernet pushbutton in any state, the EOK, LAN and STAT LEDs are briefly turned on in unison as an LED test. These three LEDs are turned on for second and are then turned off when the firmware is restarted. The Ethernet port LEDs are not affected by a manual restart of the Ethernet firmware. The LED test is performed only upon a manual pushbutton restart; there is no LED test when the Station Manager initiates a restart.

2-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Module Installation
For general information about module and system installation, or if the installation requires CE Mark compliance, refer to the PACSystems RX7i Hardware Installation Manual, GFK-2223 or the PACSystems RX3i Hardware Installation Manual, GFK-2314.

Installing an RX7i CPU with Embedded Ethernet Interface

Warning
Do not insert or remove modules with power applied. This could cause the CPU to Stop, damage the module, or result in personal injury.

1. Record the 12-digit hexadecimal MAC Address from the printed label located on the rear wall of CPU battery compartment. The label is visible when the battery is removed from its compartment. (The battery does not need to be disconnected to temporarily remove it Battery Compartment from the compartment.) 2. Connect the battery to either of the battery connectors on the module.
Three-cell Battery Pack

3. Put the toggle switch in the STOP position. 4. Make sure that rack power is off. 5. Install the CPU module in slot 1 of rack 0. Press the module firmly in place, but do not force the board. Tighten the screws on the top and bottom tabs. 6. Connect one or both of the Ethernet ports on the Ethernet Interface to the network. 7. Turn on power to the PACSystems rack. 8. Set the PLC to Stop mode via the Run/Stop switch or the programming software.
MAC Label located on rear wall of battery compartment

GFK-2224C

Chapter 2 Installation and Startup

2-5

Installing a Rack-based Ethernet Interface Module

1. Record the 12-digit hexadecimal MAC Address from the printed label on the Ethernet Interface. The label is visible only with module out of the rack. 2. Be sure the rack power is OFF. 3. Slide the module into the slot for which it was configured in the system. 4. Press the board firmly in place, but do not force the board. Tighten the screws on the top and bottom tabs. 5. Connect one or both of the network ports on the Ethernet Interface to the Ethernet network. 6. Turn on power to the PACSystems rack. 7. Set the PLC to Stop mode via the Run/Stop switch or the programming software.
MAC Address Label

2-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Ethernet Port Connectors

The Ethernet Interface has two Ethernet port connectors, each of which supports both 10Base-T and 100Base-Tx operation using either full duplex or half duplex operation. These 8-pin RJ-45 connectors are used to connect the Ethernet Interface to a hub, repeater, switch, or other Ethernet device.

Embedded Switch
The two Ethernet port connectors are controlled by an embedded network switch in the module. The module has only one interface to the network (one Ethernet address and one IP address).
PACSystems Ethernet Interface
Ethernet Processor Ethernet MAC

10/100 Network Switch

Port 1A

Port 1B

For simple installations, the embedded switch allows devices to be connected without additional components.
Operator Interface PLC PLC Personal Computer

It is possible to daisy-chain PLCs together without additional components, but that should be done with great care. Power loss or reset at an Ethernet interface causes loss of communication to any devices downstream from that Ethernet interface in the daisy chain. Restarting the Ethernet interface (via the Ethernet Restart pushbutton, for example) disrupts daisy chain communication.

GFK-2224C

Chapter 2 Installation and Startup

2-7

2
Each switch port auto-negotiates (by default) to the correct link speed and duplex mode for the device connected to the other end of the link. Each port operates independently, so devices at two different speeds and/or duplex modes may be attached to the two ports. Each port also automatically detects the attached cable and will work properly with either straightthrough or crossover cables (by default).

Caution
The two Ethernet ports on the Ethernet Interface must not be connected, directly or indirectly, to the same device. The connections in an Ethernet network based on twisted pair cabling must form a tree and not a ring, otherwise duplication of packets and network overload may occur.

Caution
The IEEE 802.3 standard strongly discourages the manual configuration of duplex mode for a port (as would be possible using Advanced User Parameters). Before manually configuring duplex mode for an Ethernet Interface port using advanced user parameters (AUP), be sure that you know the characteristics of the link partner and are aware of the consequences of your selection. Setting both the speed and duplex AUPs on an IC698 Ethernet Interface port will disable the ports auto-negotiation function. If its link partner is not similarly manually configured, this can result in the link partner concluding an incorrect duplex mode. In the words of the IEEE standard: Connecting incompatible DTE/MAU combinations such as full duplex mode DTE to a half duplex mode MAU, or a full-duplex station (DTE or MAU) to a repeater or other half duplex network, can lead to severe network performance degradation, increased collisions, late collisions, CRC errors, and undetected data corruption.

Note: If both speed and duplex mode of an Ethernet interface port are forced using the Advanced User Parameters file, that port will no longer perform automatic cable detection. This means that if you have the Ethernet interface port connected to an external switch or hub port you must use a crossover cable. If you have the Ethernet interface port connected to the uplink port on an external switch or hub, or if you have the Ethernet interface port directly connected to another Ethernet device, you must use a normal cable.

2-8

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

2 Connection to a 10Base-T / 100Base Tx Network

Either shielded or unshielded twisted pair cable may be attached to a port. The 10BaseT/100Base Tx twisted pair cables must meet the applicable IEEE 802 standards. Category 5 cable is required for 100BaseTX operation. Each Ethernet port automatically senses whether it is connected to a 10BaseT or 100BaseTX network, half-duplex or full-duplex. (The automatic negotiation of speed and/or duplex mode can be explicitly overridden using Advanced User Parameter settings).

10Base-T/100Base Tx Port Pinouts

Pin Number 1* 2 3 4 5 6 7 8 Signal TD+ TD RD+ NC NC RD NC NC Description Transmit Data + Transmit Data Receive Data + No connection No connection Receive Data No connection No connection

* Pin 1 is at the bottom of the Ethernet port connector as viewed from the front of the module.

Note: Pinouts are provided for troubleshooting purposes only. 10Base-T/100Base-Tx cables are readily available from commercial distributors. GE Fanuc recommends purchasing rather than making 10Base-T/100Base-Tx cables.

GFK-2224C

Chapter 2 Installation and Startup

2-9

Connection Using a Hub/Switch/Repeater

Connection of the Ethernet Interface to a 10Base-T or 100Base-Tx network is shown below.

Hub/Switch/Repeater

10/100

10/100

Ethernet Interface

To Other Network Devices

10BaseT/100Base Tx Twisted Pair Cable

2-10

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Direct Connection to the PACSystems Ethernet Interface

Connection of Ethernet devices directly to the Ethernet Interface is shown below:

10/100

10/100

Ethernet Interface

Other Ethernet devices such as PCs, Ethernet Interfaces on other PLCs, Operator Interfaces

10BaseT/100Base Tx Twisted Pair Cable

GFK-2224C

Chapter 2 Installation and Startup

2-11

Station Manager Port

Each PACSystems Ethernet interface provides a dedicated RS-232 serial port for local Station Manager use. This nine-pin D connector accepts a standard straight-through nine-pin RS-232 serial cable to connect to a standard AT-style RS-232 port. The following cable is available from GE Fanuc: IC200CBL001 Cable, CPU Programming

Port Settings
The serial (COM) port of the terminal or computer that is connected to the Ethernet Interface must use the same communications parameters as the Ethernet Interface. The default values for the Station Manager port are 9600 bps, 8 bits, no parity, and 1 stop bit. If the Ethernet Interface is configured with default values for this port, or the Ethernet Interface has not been configured, use these default values. If the Ethernet Interface is configured with non-default values for this port, use those values for the serial port settings of the terminal or computer.

Station Manager (RS-232) Port Pinout

Pin No 1* 2 3 4 5 6 7 8 9 Signal DCD TX RX DSR GND DTR CTS RTS RI OUT IN OUT IN Direction IN OUT IN IN Description Data Carrier Detect Transmit Data Receive Data Data Set Ready Signal Ground Data Terminal Ready Clear to Send Ready to Send Ring Indicator

* Pin 1 is at the bottom right of the Station Manager port connector as viewed from the front of the module.

2-12

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Verifying Proper Power-Up of the Ethernet Interface after Configuration

After configuring the Interface as described in the next chapter, turn power OFF to the CPU for 35 seconds, then turn the power back ON. This starts a series of diagnostic tests. The EOK LED will blink indicating the progress of power-up. The Ethernet LEDs will have the following pattern upon successful power-up. At this time the Ethernet Interface is fully operational and on-line. LED EOK LAN STAT On On, Off, or blinking, depending on network activity On Ethernet Interface Online

If a problem is detected during power-up, the Ethernet Interface may not transition directly to the operational state. If the Interface does not transition to operational, refer to Diagnostics, chapter 8 for corrective action.

GFK-2224C

Chapter 2 Installation and Startup

2-13

Pinging TCP/IP Ethernet Interfaces on the Network

PING (Packet InterNet Grouper) is the name of a program used on TCP/IP networks to test reachability of destinations by sending them an ICMP echo request message and waiting for a reply. Most nodes on TCP/IP networks, including the PACSystems Ethernet Interface, implement a PING command. You should ping each installed Ethernet Interface. When the Ethernet Interface responds to the ping, it verifies that the interface is operational and configured properly. Specifically it verifies that acceptable TCP/IP configuration information has been downloaded to the Interface.

Pinging the Ethernet Interface from a UNIX Host or Computer Running TCP/IP Software
A ping command can be executed from a UNIX host or computer running TCP/IP (most TCP/IP communications software provides a ping command) or from another Ethernet Interface. When using a computer or UNIX host, you can refer to the documentation for the ping command, but in general all that is required is the IP address of the remote host as a parameter to the ping command. For example, at the command prompt type:
ping 10.0.0.1

Determining if an IP Address is Already Being Used

Note: This method does not guarantee that an IP address is not duplicated. It will not detect a device that is configured with the same IP address if it is temporarily off the network. It is very important not to duplicate IP addresses. To determine if another node on the network is using the same IP address: 1. Disconnect your Ethernet Interface from the LAN. 2. Ping the disconnected Interfaces IP address. If you get an answer to the ping, the chosen IP address is already in use by another node. You must correct this situation by assigning unique IP addresses.

2-14

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter Configuration

Before you can use the Ethernet Interface, you must configure it using Machine Edition Logic Developer-PLC software. The configuration process for a PACSystems Ethernet Interface includes:

Assigning a temporary IP address for initial network operation, such as connecting the programmer to download the hardware configuration. Configuring the characteristics of the Ethernet interface. Configuring Ethernet Global Data (if used). (Optional, not required for most systems). Setting up the RS-232 port for Local Station Manager operation. This is part of the basic Ethernet Interface configuration. (Optional, not required for most systems). Configuring advanced parameters. This requires creating a separate ASCII parameter file that is stored to the PLC with the hardware configuration. The Ethernet Interface has a set of default Advanced User Parameter values that should only be changed in exceptional circumstances by experienced users. The Advanced User Parameters definitions and configuration are described in appendix A. (Optional) Setting up the PLC for Modbus/TCP Server operation. See chapter 7 for information about configuring Modbus/TCP Server operation.

This chapter discusses only the configuration of the PACSystems Ethernet Interface. Information about overall system configuration is available in other PACSystems documentation and in the Logic Developer online help.

GFK-2224C

3-1

Configuration Data
The PACSystems PLC is configured exclusively by the Machine Edition PLC Logic Developer-PLC programmer. The Programmer can be connected over the Ethernet network. For initial programmer connection, an initial IP address must be manually assigned to the Ethernet interface as described next in this chapter. The PACSystems PLC does not support autoconfiguration.

Generating / Storing / Loading the Configuration

The PACSystems Ethernet interfaces use several types of configuration data: Ethernet Configuration, optional Ethernet Global Data Configuration, and optional Advanced User Parameter (AUP) Configuration. All of these configuration parameters are generated at the programmer, stored from the programmer to the PLC CPU as part of the hardware configuration Store sequence and may be loaded from the PLC CPU into the programmer as part of the Configuration Load sequence. The optional AUP file must be manually generated with a text editor and then imported into the programmer. The programmer then stores any AUP files to the PLC within the Configuration Store operation. Once stored to the PLC, the PACSystems main CPU maintains the configuration data over power cycles.

Backup Configuration Data

The PACSystems Ethernet interface also saves a backup copy of the most recent Ethernet Configuration and AUP Configuration in non-volatile memory for use when the PLC is cleared. (Ethernet Global Data configuration is maintained only in the PLC CPU.) The PACSystems Ethernet interfaces maintain the backup configuration data in nonvolatile memory without battery power. (A PLC Configuration Clear does not affect the backup configuration data within the Ethernet Module.) When the PLC configuration was not stored from the programmer, the Ethernet Module uses its backup configuration data if valid. If that data is invalid or has never been configured, factory default configuration values are used.

Locally-Edited Configuration Data

If the PLC configuration was not stored from the programmer, the CHSOSW and CHPARM Station Manager commands can be used to locally edit Ethernet configuration or AUP configuration data. These Station Manager commands are not active if the PLC configuration has been stored from the programmer. Locally edited configuration changes cannot be retrieved into the PLC and loaded to the programmer. Locally edited configuration changes are always overwritten when a PLC configuration is stored into the PLC from the programmer.

3-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Initial IP Address Assignment

Each PACSystems Ethernet Interface comes from the factory with a default IP address (0.0.0.0). Because this default address is not valid on any Ethernet network, an initial IP address must be assigned for initial network operation, such as connecting the programmer to download the first hardware configuration. The initial IP address must be selected for proper operation with your network and application; see your network administrator for the proper initial IP address value. One way to assign the initial IP address is via the CHSOSW command from a local seriallyconnected Station Manager terminal. See PACSystems TCP/IP Communications Station Manager Manual, GFK-2225, for details. Alternately, an IP address can be set using the Set IP method if the PLC is not in a RUN state, even if the module already has a valid configured IP Address. If the module has the factory default IP Address 0.0.0.0, a temporary IP address can be set using BOOTP over the Ethernet network, if a BOOTP server is present. Both temporary IP address assignment methods are described here.

Assigning a Temporary IP Address Using the Programming Software

To initiate Ethernet communications with the programmer, you first need to set up a temporary IP address. After the programmer is connected, the actual IP address for the Ethernet interface (as set up in the hardware configuration) should be downloaded to the PLC. The temporary IP address remains in effect until the Ethernet interface is restarted, power-cycled or until the hardware configuration is downloaded or cleared.

To use the Set Temporary IP Address utility, the PLC CPU must not be in RUN mode. IP address assignment over the network will not be processed until the CPU is stopped and is not scanning outputs. The current user logged on to the PC running the Set Temporary IP Address utility must have full administrator privileges. The Set Temporary IP Address utility can be used if communications with the networked PACSystems target travel across network switches and hubs. It does not work if communications travel through a router. The target must be located on the same sub-network (subnet) as the computer running the Set Temporary IP Address utility. The sub-network is specified by the computers subnet mask and the IP addresses of the computer and the PACSystems Ethernet Interface.

GFK-2224C Chapter 3 Configuration

3-3

3
To set the IP address, you need the MAC address of the Ethernet Interface. The MAC address is located on a label on the module, as shown in chapter 2, Installation. Connect the PACSystems Ethernet Interface to the Ethernet network. 1. In the Project tab of the Navigator, right-click the PACSystems target. Choose Offline Commands, then Set Temporary IP Address. The Set Temporary IP Address dialog box appears. 2. In the Set Temporary IP Address dialog box, do the following:

Specify the MAC address of the Ethernet Interface. In the IP Address to Set box, specify the temporary IP address you want to assign to the Ethernet Interface. If the computer has multiple Ethernet network interfaces, select the Enable Network Interface Selection check box and specify the network interface on which the PACSystems Ethernet Interface being set up is located.

3. When the fields are properly configured, click the Set IP button. 4. The Set Temporary IP Address utility verifies that the specified IP address is not already in use, then it sets the target Ethernet Interface to the specified IP address. Finally, the utility verifies that the target Ethernet Interface responds at the selected IP address. Any error or successful completion is reported. These operations may take up to a minute.

Cautions
The temporary IP address set by the Set Temporary IP Address utility is not retained through a power cycle. To set a permanent IP Address, you must set configure the target's IP Address and download the hardware configuration to the PACSystems target. The Set Temporary IP Address utility can assign a temporary IP address even if the target Ethernet Interface has previously been configured to a non-default IP address. (This includes overriding an IP address previously configured by the programmer.) Use this IP Address assignment mechanism with care.

3-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

3 Assigning a Temporary IP Address Using BOOTP

When the PACSystems Ethernet Interface receives the default IP address (0.0.0.0), either from hardware configuration or from internal backup configuration, it attempts to obtain a temporary IP address from a BOOTP server on the Ethernet network. The Ethernet Interface acts as a BOOTP client. The Ethernet Interface issues a BOOT Request to the network. If any BOOTP server on the network recognizes the Ethernet Interface, that server will return a BOOT Reply containing an IP address (and optionally a subnet mask and gateway IP address) to the requesting Ethernet Interface. Typically, the BOOTP server must be manually configured with the MAC address and IP address (and possibly other information such as subnet mask and gateway) for each supported client device. Each supported client must be identified by its globally unique MAC address. The Ethernet Interface s MAC address is specified on its MAC Address Label as described in chapter 2, Installation. The BOOTP server must not be separated from the PACSystems Ethernet Interface by a router. BOOTP uses broadcast messages, which typically do not pass through routers. Consult your network administrator for more details.

Caution
The temporary IP address set by BOOTP is not retained through a power cycle. To set a permanent IP Address, you must configure the Ethernet Interfaces IP Address at the programmer and download the hardware configuration to the PLC.

Redundancy systems using should explicitly configure both the direct IP address and the Redundant IP address. For redundancy operation, do not setup the direct IP address via BOOTP.

GFK-2224C Chapter 3 Configuration

3-5

Assigning a Temporary IP Address Using Telnet

The temporary IP address assignment performed by the programmers Set Temporary IP Address utility can be performed manually from a computers DOS command window if the programming software is not available. This method uses an attempted Telnet connection to transfer the IP address, even though the PACSystems target Ethernet Interface does not support normal Telnet operation.

Caution
The Telnet method can assign a temporary IP address whether or not the Ethernet Interface already has in IP address, even if the Ethernet interface has been previously configured to a non-default IP address. (This includes overriding an IP address previously configured by the programming software.) Use this IP Address assignment mechanism with care.

To temporarily set the IP address over the network, the PLC CPU must not be running. IP address assignment over the network will not be processed until the CPU is stopped and is not scanning outputs. 1. Obtain the Ethernet Interfaces MAC address from its MAC Address Label as shown in chapter 2, Installation. 2. On the computer, open a standard DOS command window. Associate the desired IP address for the Ethernet Interface with the MAC address of the Ethernet Interface using the following method. In the DOS command window,enter:
> ARP s ip_address mac_address

for ip_address enter the IP address being assigned to the Ethernet interface, and for mac_address enter the MAC address of the Ethernet interface. 3. Issue a Telnet command to the IP address (ip_address) being assigned to the Ethernet interface via the following command:
> telnet ip_address 1

(This command is always sent to port 1.) This Telnet command will fail, but the IP address provided with the Telnet command will be passed to the Ethernet interface and will be temporarily activated. The IP address assigned over the network remains in effect until the Ethernet interface is restarted, power-cycled or until the configuration is downloaded or cleared. Once connected, the intended IP address should be permanently downloaded to the Ethernet interface via the hardware configuration data.

3-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Configuring the Ethernet Interface

This section describes how to configure the parameters of an Embedded or Rack-based PACSystems Ethernet Interface.

Configuring an Embedded Ethernet Interface

1. In the Project tab of the Navigator, expand the PACSystems Target, the hardware configuration, and the main rack (Rack 0). 2. Expand the CPU slot (Slot 1). The Ethernet Interface daughterboard is displayed as Ethernet. 3. Right click the daughterboard slot and choose Configure. The Parameter Editor window displays the Ethernet Interface parameters. 4. To display the Ethernet Global Data component, right-click the PLC icon. Select Add Component and then Ethernet Global Data. 5. Select the desired tab, then click in the appropriate Values field.

Configuring a Rack-based Ethernet Interface Module

1. In the Project tab of the Navigator, expand the PACSystems Target, the hardware configuration, and the main rack (Rack 0). 2. Right click an empty slot and choose Add Module. The Module Catalog opens. 3. Click the Communications tab, select the IC698ETM001 module (for RX7) or IC695ETM001 module (for RX3i) and click OK. The Ethernet module is placed in the rack and its parameters are displayed in the Parameter Editor window. 4. To display the Ethernet Global Data component, right-click the PLC icon. Select Add Component and then Ethernet Global Data.

GFK-2224C Chapter 3 Configuration

3-7

3
5. Select the desired tab, then click in the appropriate Values field. (To edit parameters of a module that is already configured in the rack, right click the slot containing the module and choose Configure.)

Ethernet Parameters (Settings Tab)

Parameters Configuration Mode Adapter Name Use BOOTP for IP Address IP Address Subnet Mask Gateway IP Address Name Server IP Address Maximum Web Connections Maximum FTP Connections Network Time Sync Status Address Length Redundant IP Redundant IP Address I/O Scan Set Values TCP/IP 0.1.0 False 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 2 2 None %I0001 80 Enable 0.0.0.0 1

Configuration Mode: This is fixed as TCP/IP. Adapter Name: This is automatically generated based upon the rack/slot location of the Ethernet interface. Use BOOTP for IP Address: This selection specifies whether the Ethernet must obtain its working IP address over the network via BOOTP. When set to False (= do not use BOOTP), the IP Address value must be configured (see IP Address parameter, below). When set to True, the IP Address parameter is forced to 0.0.0.0 and becomes non-editable. IP Address: These values should be assigned by the person in charge of your network (the network administrator). TCP/IP network administrators are familiar with these parameters. It is important that these parameters are correct, otherwise the Ethernet Interface may be unable to communicate on the network and/or network operation may be corrupted. It is especially important that each node on the network is assigned a unique IP address.
3-8 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

3
If you have no network administrator and are using a simple isolated network with no gateways, you can use the following range of values for the assignment of local IP addresses: 10.0.0.1 First Ethernet interface 10.0.0.2 Second Ethernet interface 10.0.0.3 Third Ethernet interface . . . . . . 10.0.0.255 Programmer TCP or host Also, in this case, set the subnet mask, and gateway IP address to 0.0.0.0. Note: If the isolated network is connected to another network, the IP addresses 10.0.0.1 through 10.0.0.255 must not be used and the subnet mask, and gateway IP address must be assigned by the network administrator. The IP addresses must be assigned so that they are compatible with the connected network. Name Server IP Address:: This parameter must be set to 0.0.0.0 Max Web Server Connections: (Available only when the Ethernet Interface supports web server operation.)The maximum number of web server connections. This value corresponds to the number of TCP connections allocated for use by the web server, rather than the number of web clients. Valid range is 0 through 16. Default is 2. Max FTP Server Connections: This value corresponds to the number of TCP connections allocated for use by the FTP server, rather than the number of FTP clients. Each FTP client uses two TCP connections when an FTP connection is established. Valid range is 0 through 16. Default is 2. Note: The sum of Max Web Server Connections and Max FTP Server Connections must not exceed 16 total connections. Network Time Sync: Selection of the method used to synchronize the real-time clocks over the network. The choices are None (for no network time synchronization) and SNTP (for synchronization to remote SNTP servers on the network). See Simple Network Time Protocol (SNTP) in chapter 4, Ethernet Global Data, for more information. Status Address: The Status Address is the reference memory location for the Ethernet Interface status data. The Ethernet Interface will automatically maintain 16 LAN Interface Status (LIS) bits in this location and 64 Channel Status bits in this location for a total of 80 bits. The Status address can be assigned to valid %I, %Q, %R, %AI, %AQ or %W memory. The default value is the next available %I address. See chapter 10, Diagnostics, for definitions of the LAN Interface Status (LIS) portion of the Ethernet Status data. The meaning of the Channel Status portion of the Ethernet Status depends upon the type of operation for each channel. See chapter 6 for the meaning of the Channel Status bits for SRTP channels operation.

GFK-2224C Chapter 3 Configuration

3-9

3
Note: Do not use the 80 bits configured as Ethernet Status data for other purposes or data will be overwritten. Length: This is the total length of the Ethernet Interface status data. This is automatically set to either 80 bits (for %I and %Q Status address locations) or 5 words (for %R, %AI, %AQ and %W Status address locations). Redundant IP: Selects whether Redundant IP operation is Enabled or Disabled. This parameter is available only when the PLC CPU supports Redundancy operation. When this parameter is set to Enabled, the Redundant IP address must be entered via the Redundant IP Address parameter, below. The default value is False. Redundant IP Address: An optional IP Address that will be shared with another device on the network in a Redundant System. Both devices must use the same subnet mask. This parameter is available only when the Redundant IP parameter (above) is set to Enabled. This Redundant IP Address defaults to 0.0.0.0, which is not a valid IP address; a valid Redundant IP address must be explicitly configured. See chapter 1, Introduction, for more information about Ethernet redundancy. This IP address is assigned in addition to the devices primary IP address. I/O Scan Set: Specifies the I/O scan set to be assigned to the Ethernet Interface. Scan sets are defined in the CPUs Scan Sets tab. The valid range is 1 through 32; the default value is 1.

3-10

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

3 RS-232 Port (Station Manager) Tab

These parameters are for the RS-232 Station Manager serial port. These defaults should be used for most applications.

Parameters Baud Rate Parity Flow Control Stop Bits 9600 None None One

Values

Baud Rate: Data rate (bits per second) for the port. Choices are 1200, 2400, 4800, 9600, 19.2k, 38.4k, 57.6k, 115.2k. The default value is 9600. Parity: Type of parity to be used for the port. Choices are None, Even, or Odd; the default value is None. Flow Control: Type of flow control to be used for the port. Choices are None or Hardware. (The Hardware flow control is RTS/CTS crossed). The default value is None. Stop Bits: The number of stop bits for serial communication. Choices are One or Two; the default value is One.

GFK-2224C Chapter 3 Configuration

3-11

Configuring Ethernet Global Data

For more information about Ethernet Global Data, see chapter 4. Ethernet Global Data can be configured in two ways. The most convenient way is to use the Ethernet Global Data server that is provided with the PLC programming software. This server holds the EGD configurations for all the devices in the EGD network. When the Configuration Server is used, the EGD configuration for the entire EGD network can be validated for accuracy before the configuration is stored into the devices of the network. This can greatly decrease the time needed to commission a network or implement changes in a network. EGD exchanges can also be configured without using the server. Both methods are described in this chapter. The choice of whether to use the Configuration Server can be made individually for each device.

Basic EGD Configuration

Whether or not the EGD Configuration Server is used, certain steps will need to be taken to use EGD. These steps are described below. If Ethernet Global Data does not appear as shown, rightclick the PLC icon (PLC1 in this example). Select Add Component and then select Ethernet Global Data. For each PLC: 1. In the PLC programming software, open the Project folder and expand the target node for the PLC. 2. To configure the Local Producer ID, right-click the Ethernet Global Data node and choose Properties. The Local Producer ID is shown in the properties Inspector window. This parameter must be unique on the network. The Local Producer ID is a 32-bit value that uniquely identifies this Ethernet Global Data device across the network. It can either be expressed as a dotted-decimal value in the same way an IP address value is specified or specified as an integer number. This value defaults to the IP address of the Ethernet Interface with the lowest rack/slot location in the system. The same Producer ID applies to all exchanges produced by this CPU, regardless of which Ethernet Interface is used to send the exchange to the network. While the form of the Producer ID is sometimes the same as that of an IP address and an IP address is used as its default value, the Producer ID is not an IP address. See Chapter 4, Ethernet Global Data, for more information on how the Producer ID is used.

3-12

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

3 Using Signatures in Ethernet Global Data

Ethernet Global Data signatures can be used to make sure that the format of the data from the producer matches that expected by the consumer. The EGD signature is a numeric value that has two parts: the major number and the minor number. The major number reflects the primary format of the data. The minor number reflects backward-compatible changes made to the Ethernet Global Data exchange (such as adding data to the end of the exchange). The primary format of the data is first established when the EGD exchange is defined. At that time the signature is assigned the value of 1.0. Any change that reorders, removes, renames or changes the type or offset of a variable in the exchange is a primary format change that causes the signature major number to be incremented. The signature major number must match between the producer and the consumer for the consumer to consume the data. The signature minor number is incremented when backward-compatible changes are made in the format of the produced data. Backward-compatible changes are made by adding data to unused areas of the exchange including adding data to the end of the exchange. After checking the signature major number, the consumer checks the signature minor number. If the signature minor number in a sample is greater than the signature minor number configured for the exchange in the consumer then the consumer can consume the data truncating any unexpected data at the end of the sample. The consumer can do this because the minor number change guarantees that only backward-compatible changes have been made in the format of the data. If the signature of a produced exchange is specified as zero, then consumers will not check it. If the signature of a consumed exchange is configured as zero, then any signature from a producer will be accepted and the data used if the length of the data exactly matches the expected length. Only the PACSystems RX7i and RX3i support non-zero signatures. All other targets force the signature for both produced and consumed exchanges to be zero. Use of signatures is enabled by default for new RX7i or RX3i projects and is disabled for other targets and for existing projects.

Configuring EGD Signatures

To select the signature option for a device, right-click the Ethernet Global Data node and choose Properties. The Use Signatures option is displayed in the properties Inspector window. This parameter may be set to True to enable signature support or to False to disable signature support in the device.

GFK-2224C Chapter 3 Configuration

3-13

Configuring Ethernet Global Data Using the EGD Configuration Server

The EGD Configuration Server is supplied with the Machine Edition software, but it is not automatically installed with Machine Edition. To use the EGD Configuration Server and its associated tools, the server must be installed on the computer as described below.

Installing the EGD Configuration Server

To install the EGD Configuration Server, go to the directory where the machine Edition software is installed and open the folder named EGD Installs. Select the file EgdCfgServerSetup.msi. Double-click on the file to install the EGD Configuration Server.

Configuring the EGD Configuration Server

To configure the Ethernet Global Data server in Machine Edition, click on the Options tab in the Navigator window. In the Machine Edition folder, select the EGD item to display the configuration options for the configuration server. For example:

Local Server Cache Path : This parameter sets the path to be used for caching data from the configuration server. This cache is used if the server becomes inaccessible (for example, if the server is on another machine and that machine is inaccessible due to loss of network communications). You can also choose to work offline from the server and use this cache. This mode of operation is explained below. Base Path : Typically this field should not be changed from the default of /EGD. This is the path portion of the URL used to get to the server. Host Name : The host name for the computer on which the configuration server runs. This can be specified as localhost if the server is on the local machine. Server Port : This parameter typically is left at the default of 7938. If changed, it must be changed on both the programming software and on the server. This value is not stored in the project but is stored in the computer. It will be used as the default by other projects created on that computer and by other tools such as the EGD Management Tool (see Chapter 8) that require access to the server.

3-14

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

3
Timeout : The number of milliseconds the programming software will wait for a reply from the server before deciding that the server is not going to respond. Configuration Server : This read-only parameter displays the value Located if the configuration server can be accessed and Unable to Locate if the server is not accessible. When using the configuration server, the producer of data normally defines the exchange. See below for a step-by-step description of defining an exchange in the producer. After the producer of the data defines the exchange, consumers may make use of the exchange. Each consumer selects the desired exchange from the list of produced exchanges and defines the local PLC memory to be used for the variables of interest from the exchange. Consumers can be resynchronized with any changes in the producer on request. Consistency between the producer and consumer(s) is verified during the build and validate process.

Enabling the use of the EGD Configuration Server for a Device

To enable the use of the configuration server for a device, right-click the Ethernet Global Data node and choose Properties. The Use Configuration Server option is displayed in the properties Inspector window. This parameter may be set to True to enable using the configuration server for the device or to False to not use the server. In some cases you may want to work offline from the configuration server for a while, for example when you want to work disconnected from the network and the configuration server is located on another computer. In this case, you can select the Work Offline parameter and set it to True. The programmer keeps a local copy or cache of the EGD configuration information at a configurable path. Setting this path to a location on the local machine and selecting Work Offline to True allows EGD configuration data to be updated using the cached information without accessing the server. Setting the Work Offline parameter to False and performing a Validate will synchronize the server with the data from the cache.

Network Names and Collections

In order to perform validation between producers and consumers, it is necessary to know whether the producer and the consumer are on the same network. The EGD Configuration Server and its validation libraries use the network name to perform this check. The validation assumes that two devices that have the same network name are connected to the same network. To set the network name, right-click the Ethernet Global Data node and choose Properties. The Network Name option is displayed in the properties Inspector window. This parameter may be set to the name of the network to which the device is connected. Setting up Collections for the EGD Management Tool The EGD Management Tool is an optional utility that can be used to provide a system-level look at all the Ethernet Global Data devices in a system. Installation and use of the EGD Management Tool are described in chapter 8.
GFK-2224C Chapter 3 Configuration 3-15

3
The EGD Management Tool can look at subsets of EGD devices, called collections. A collection is a logical grouping of EGD devices (for example a manufacturing cell or a machine). To make an EGD device part of a collection, right-click the Ethernet Global Data node and choose Properties. The Collection option is displayed in the Properties Inspector window. This parameter may be set to the name of the collection for the device (by default the collection for a device is the Machine Edition project name).

Configuring an Ethernet Global Data Exchange for a Producer

The information to be sent by the producer and the exchange details are defined in the Properties for each produced exchange. When an individual produced exchange is selected, the Properties Inspector window permits user configuration of the following information: Name Exchange ID Adapter Name Destination Type A name assigned for this exchange. Defaults to ProdExchX where X is a sequential number. A number that identifies a specific exchange to be sent by the producing device. The specific Ethernet Interface, identified by its rack and slot location within the producing PLC. Specifies whether the datas destination will be:

An IP address (Unicast) A Group ID (Multicast) All EGD nodes on the subnet (Broadcast). Choosing broadcast will cause the EGD packets to be received by any node on the network. This can impact performance if there are non-EGD devices on the network. Check with the systems network administrator if you are unsure about whether to use Broadcast.

Destination

Identifies the datas consuming device, based on the Destination Type selected above:

Produced Period

a dotted-decimal IP address if Destination Type is IP Address the groups ID (132) if Destination Type is Group ID the value 255.255.255.255 If Broadcast IP is the Destination Type.

The scheduled repetition period at which the data is produced on the network. Configure a value in the range of 0 or 23,600,000 (2 milliseconds to 1 hour). The value zero means data will be produced at the end of each PLC scan, but not less than 2 milliseconds from the previous production. Set the production period to the period at which the application needs the data in this exchange. Round this value up to the nearest 2 milliseconds. Fixed at always. In the PLC, production of EGD is controlled by the I/O state: when enabled, EGD production is enabled, and when disabled, EGD production is disabled. Not used.

Send Type

Reply Rate

3-16

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Configuring the Exchange Variables Double-clicking on the produced exchange opens a window for configuring the variables within the exchange. Each exchange has its own variable list. These variables contain the data that is produced to the network. Each variable contains the following information Offset (Byte.Bit) The location within the data area for this exchange where the start of the data for this variable is located. The offset is expressed as Byte.Bit, where Byte is a zero-based byte offset and Bit is a zero-based bit position within that byte. (Valid bit values are 0-7. Bit 0 is the least-significant bit within the byte; bit 7 the most significant.) The name defined for this variable. It may be an existing variable or it may be defined using the variable declaration facilities of the programmer such as the variable list in the Navigator. The PLC memory reference address that contains the start of the data for this variable. Not used for Produced exchange. Size of the data for this variable, expressed in units of the data type. Data type of the variable. An optional text description of this variable.

Variable

Ref Address Ignore Length Type Description

To add a new variable to the end of the exchange, click the Add button. This does not change the data offsets of any existing variables within that exchange. To insert a new variable among the existing variables, click on an existing variable. When you click the Insert button, a new variable will be created ahead of the selected existing variable. This changes the data offsets of all following variables in the exchange and will change the signature major number if you are using signatures. Once a new variable has been entered, double-click a data field within the row to edit that value. To delete an existing variable, click on the variable row and then click the Delete button. If you are using signatures, this will cause the signature major number to change. Up to 100 variables may be configured for an exchange. The sum of the length for all variables in the exchange must not exceed 1400 bytes. The total length of the exchange is displayed as Length (Bytes): above the variable list. A variable is automatically created for the local exchange status that is returned to the PLC logic application. The exchange status is not part of the produced exchange data and is not available to the network.

GFK-2224C Chapter 3 Configuration

3-17

3
Configuring an Ethernet Global Data Exchange for a Consumer
To create a new consumed exchange, right-click the Consumed Exchanges node and select New. A dialog box lists all produced exchanges in the EGD network that have been published to the EGD Configuration Server. Select the exchange to be consumed. Once selected, the exchange is populated with the variable, length, type and description information defined in the producer. The variable name consists of the target name, an underscore, and the variable name in the producer. (See below for information about name generation.) You must either enter a reference address or select ignore for each variable in the exchange. You must also assign an adapter name and a timeout for the exchange. With these steps, the configuration of the consumer is complete. When an individual consumed exchange is selected, the following parameters can be configured in the Properties Inspector window. Typically, only the adapter name and the update timeout need to be specified for the exchange and the reference address specified for the variables in the exchange. Changing any other values in a consumed exchange should only be done with expert help. Name A name assigned for this exchange. Defaults to the target name of the producer , an underscore, and the exchange ID in the producer. Changing this name may make resynchronization of the variable with the server impossible. The ID of the PLC producing the exchange. Producer ID is defined by the producer; changing here it may make resynchronization with the server impossible. Used only if the produced exchange has been configured with a Destination Type of Group ID. Group ID is defined by the producer; changing it here may make it impossible to consume the data from the producer. Identifies a specific data exchange to be received by the consuming device. Exchange ID is defined by the producer; changing it here may make resynchronization with the server impossible. The specific Ethernet Interface, identified by its rack and slot location within the consuming PLC. Not used. (Always displayed as 200 milliseconds; not editable.) A value in the range 0 to 3,600,000 milliseconds (1 hour). The Ethernet Interface will declare a refresh error if the first or subsequent packet of data does not arrive within this time. The Update Timeout should be at least double the producer period, and should allow for transient network delays. The default is 0 indicates no timeout. Resolution is in 2ms increments.

Producer ID

Group ID

Exchange ID

Adapter Name Consumed Period Update Timeout

3-18

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

3
Name Generation for Consumed Variables Consumed variables are created automatically. They are based on the variable name in the producer. The name consists of up to seven characters of the beginning of the target name of the producer followed by an underscore character _ followed by up to 21 characters of the beginning of the variable name of the variable in the producer. Since the PLC programming software allows names of up to 32 characters, it is possible that the generated name for a consumed variable will not be unique. This can occur when the target names of producers have the same first seven characters and variable names have the same first 21 characters. When the generated variable is not unique, the variable in the consumer has an underscore character and a two-digit number appended to it to make it unique. Synchronizing a Consumed Exchange with Changes in the Producer If a produced exchange is changed, it is necessary to reflect these changes in the consumers. This can be done very quickly with the EGD configuration server. Once the new definition of the produced exchange has been published to the server, select the consumed exchange in each consumer, right-click and select synchronize to server. The new definition of the produced exchange will be brought in from the server. Any variables that have been added to the producer must have reference addresses assigned if they are to be used or they must be selected as ignore. No other action is necessary in the consumer.

Validating the EGD for a Device

One advantage of using the EGD configuration server is the ability to validate the EGD configuration before downloading the configuration to the device. If you right-click on the Ethernet Global Data node in the Navigator, you will see a selection for Bind and Build. Selecting this menu item causes the EGD definitions for the target to be cross-checked against the definitions in the server. Each consumed exchange is compared to the produced exchange published by the producer and any discrepancies are noted (see above for how to correct any errors detected in the consumer). It is also possible, by selecting the menu item Unconsumed Data Report, to generate a report listing any variables in produced exchanges that are not being used by a consumer. Producing data that is not being consumed is not necessarily an error; the consumer may not be able to publish its information to the EGD configuration server or the application design may have chosen to publish data that is not needed immediately. However, each unconsumed variable may be an indication of an error or oversight in one or more consumers in the application.

GFK-2224C Chapter 3 Configuration

3-19

Looking at the Entire EGD Network

The EGD Management Tool can be used to display information about the entire EGD network both offline and online to that network. You can launch the EMT by right clicking on the Ethernet Global Data node in the Navigator and selecting Launch EGD Management Tool. The EGD Management Tool will come up in separate frame. It allows you to visualize, analyze and debug an EGD network. See Chapter 8, Diagnostics, for more information on the online capabilities of the EMT. Also see the EMT help for information about running the EMT.

Configuring EGD Devices Not Supported by the EGD Configuration Server

Some devices, for example, certain Ethernet NIUs cannot be configured using the EGD configuration server. Configuration tools for third-party devices that support Ethernet Global Data may not support the EGD configuration server. Rather than not using the server in applications that contain these devices, there is an alternative that allows the EGD configuration for such devices to be put into the server so that it can be used for consumption and validation in other devices. The programmer distribution includes a tool called the EGD Generic Device Editor. This tool allows you to describe the EGD configuration of a device and publish it to the EGD configuration server. Configuration tools for other devices can use the EGD configuration published by the EGD Generic Device Editor for consumption or validation purposes.

Installing the EGD Generic Device Editor

The EGD Generic Device Editor is not automatically installed when you install the Programmer. To install the GDE, look in the directory where you installed the programmer and you will find a subdirectory named EGD Installs. In that directory, you will find a file named EgdGenericEditorSetup.msi. Double-click on this file to install the EGD Generic Device Editor. Running the EGD Generic Device Editor Installing the EGD Generic Device Editor adds it to the Start Programs menu of the computers Windows system. You will find it under Programs - GE Industrial Systems-EGD Generic Editor The Windows help for this tool describes its operation.

3-20

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

3 Configuring Ethernet Global Data Without Using the EGD Configuration Server
If the EGD Configuration Server is not used, each Ethernet Global Data exchange must be configured in both the producer and the consumer. To add exchanges, expand the Ethernet Global Data node in the Project tab. Right click the Consumed Exchanges or the Produced Exchanges node and choose New. The new exchange appears under the selected list node. 1. For each Consumed and Produced Exchange, configure the parameters described in this section. 2. To specify the variable ranges for each exchange, right click the exchange and choose Configure Ranges. The EGD Variable Range Editor window opens.

GFK-2224C Chapter 3 Configuration

3-21

Configuring an Ethernet Global Data Exchange for a Producer

The information to be sent by the producer and the exchange details are defined in the Properties for each Produced exchange (also called a page). When an individual produced exchange is selected, the Properties inspector window permits user configuration of the following information: Name Exchange ID Adapter Name Destination Type A name assigned for this exchange. Defaults to ProdExchX where X is a sequential number. A number that identifies a specific exchange to be sent by the producing device. The specific Ethernet Interface, identified by its rack and slot location within the producing PLC. Specifies whether the datas destination will be:

An IP address (Unicast) A Group ID (Multicast) All EGD nodes on the subnet (Broadcast IP).

Destination

Identifies the datas consuming device, based on the Destination Type selected above:

Produced Period

a dotted-decimal IP address if Destination Type is IP Address the groups ID (132) if Destination Type is Group ID the value 255.255.255.255 If Broadcast IP is the Destination Type.

The scheduled repetition period at which the data is produced on the network. Configure a value in the range of 0 or 23,600,000 (2 milliseconds to 1 hour). The value zero means at the end of the next PLC scan, but not less than 2 milliseconds from the previous production. Set the production period to the period at which the application needs the data in this exchange. Round this value to the nearest 2 milliseconds. Fixed at always. In the PLC, production of EGD is controlled by the I/O state: when enabled, EGD production is enabled, and when disabled, EGD production is disabled. Not used.

Send Type

Reply Rate

3-22

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

3
Double-clicking on the produced exchange opens a window for configuring the variables within the exchange. Each exchange has its own variable list. These variables contain the data that is produced to the network. Each variable contains the following information: Offset (Byte.Bit) The location within the data area for this exchange where the start of the data for this variable is located. The offset is expressed as Byte.Bit, where Byte is a zero-based byte offset and Bit is a zero-based bit position within that byte. (Valid bit values are 0-7. Bit 0 is the least-significant bit within the byte; bit 7 the most significant.) The name defined for this variable. The PLC memory reference address that contains the start of the data for this variable. Not used for Produced exchange. Size of the data for this variable, expressed in units of the selected PLC reference memory type. Data type of the selected PLC reference memory type. (Automatically set up by the Ref Address selection.) An optional text description of this variable.

Variable Ref Address Ignore Length Type Description

To add a new variable to the end of the exchange, click the Add button. This does not change the data offsets of any existing variables within that exchange. To insert a new variable among the existing variables, click on an existing variable. When you click the Insert button, a new variable will be created ahead of the selected existing variable. This changes the data offsets of all following variables in the exchange. Once a new variable has been entered, double-click a data field within the row to edit that value. To delete an existing variable, click on the variable row and then click the Delete button. Up to 100 variables may be configured for an exchange. The sum of all variables in the exchange must not exceed 1400 bytes. The total length of the exchange (in bytes) is displayed as Length (Bytes): at the top of the exchange window above the variable list. A variable is automatically created for the required Status variable. This variable contains the local exchange status that is returned to the PLC logic application. The exchange status is not part of the produced exchange data and is not available to the network.

GFK-2224C Chapter 3 Configuration

3-23

Configuring an Ethernet Global Data Exchange for a Consumer

The exchange details are defined in the Properties for each Consumed exchange. When an individual consumed exchange is selected, the Properties inspector window permits user configuration of the following information:

Name Producer ID

A name assigned for this exchange. Defaults to ConsExchX where X is a sequential number. The PLC producing the exchange. This value, conventionally expressed as a dotted-decimal number, uniquely identifies the Ethernet Global Data device across the network. Used only if the produced exchange has been configured with a Destination Type of Group ID. This Group ID (1-32) must match that of the producer. Identifies a specific data exchange to be received by the consuming device. It must match the Exchange ID specified in the produced exchange. The specific Ethernet Interface, identified by its rack and slot location within the consuming PLC. Not used in PACSystems. (Always displayed as 200 milliseconds; not editable.) A value in the range 0 to 3,600,000 milliseconds (1 hour). The Ethernet Interface will declare a refresh error if the first or subsequent packet of data does not arrive within this time. The Update Timeout should be at least double the producer period, and should allow for transient network delays. The default is 0 indicates no timeout. Resolution is in 2ms increments.

Group ID Exchange ID Adapter Name Consumed Period Update Timeout

3-24

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Double-clicking on the consumed exchange opens a window for this exchange for configuring the variables within the exchange. Each exchange has its own variable list. These variables contain the data that is consumed from the network. Each variable contains the following information Offset (Byte.Bit) The location within the data area for this exchange where the start of this data for this variable is located. The offset is expressed as Byte.Bit, where Byte is a zero-based byte offset and Bit is a zero-based bit position within that byte. (Valid bit values are 0-7. Bit 0 is the least-significant bit within the byte; bit 7 the most significant.) The name defined for this variable. The PLC memory reference address that contains the start of the data for this variable. For consumed exchanges, %S memory types and override references are not allowed. (This field is non-editable when the Ignore selection is set to True.) Allows consumer to ignore this variable. Setting Ignore to True means this variable is not sent to the PLC reference table. Defaults to False. Size of the data for this variable, expressed in units of the selected PLC reference memory type. Data type of the selected PLC reference memory type. (Automatically setup by the Ref Address selection.) An optional text description of this variable.

Variable Ref Address

Ignore Length Type Description

To add a new variable to the end of the exchange, click the Add button. This does not change the data offsets of any existing variables within that exchange. To insert a new variable among the existing variables, click on an existing variable. When you click the Insert button, a new variable will be created ahead of the selected existing variable. This changes the data offsets of all following variables in the exchange. Once a new variable has been entered, double-click a data field within the row to edit that value. To delete an existing variable, click on the variable row and then click the Delete button. Up to 100 variables may be configured for an exchange. The sum of all variables in the exchange must not exceed 1400 bytes. The total length of the exchange (in bytes) is displayed as Length (Bytes): at the top of the exchange window above the variable list. A variable is automatically created for the required Status variable. This variable contains the local exchange status that is returned to the PLC logic application. The exchange status is not part of the consumed exchange data.

GFK-2224C Chapter 3 Configuration

3-25

3
A variable is automatically created for the optional Timestamp variable. This variable contains the timestamp of the last received data packet (generated when the exchange was produced) that is returned to the PLC logic application. Set the Ref Address to NOT USED to ignore the timestamp variable. Any consumed data variable may be ignored by setting the Ignore selection to True. See Selective Consumption, below. Note: If the total data length of a consumed exchange does not match the length of the produced exchange received from the network, PLC Faults and Ethernet exceptions will occur.

Selective Consumption
Not all data ranges within a produced exchange need to be consumed by each PLC. For example, a producer is producing an exchange consisting of a 4-byte floating point value, followed by a 2-byte integer, followed by a 2-byte analog value. If the consuming PLC wants to consume only the analog value and place it into %AI003, the consumer might be configured as shown below. Offset Variable 0.0 6.0 Var01 Ref Address Ignore Length Ignore %AI0003 True 6 1 Type Byte WORD Description Ignore float and integer

Note that where EGD signatures are not used the total length of the exchange must be the same in producer and consumer, even if the consumer is ignoring a portion of the exchange. Failure to configure any ignored bytes in the consumed exchange will result in exchange exception log and fault table entries, error status in the exchange status data, and no data being transferred for the exchange.

3-26

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter

Ethernet Global Data

4
This chapter describes basic Ethernet Global Data features for a PACSystems Ethernet Interface.

Ethernet Global Data Operation EGD Exchanges The Content of an EGD Exchange

The Data Ranges (Variables) in an EGD Exchange Valid Memory Types for Ethernet Global Data Planning Exchanges Using Ethernet Global Data in a Redundancy System

Sending an Ethernet Global Data Exchange to Multiple Consumers Multicasting Ethernet Global Data Broadcasting Ethernet Global Data

Ethernet Global Data Timing Configurable Producer Period for an EGD Exchange Consumer Update Timeout Period EGD Synchronization Timestamping for Ethernet Global Data Exchanges Effect of PLC Modes and Actions on EGD Operations

Valid PLC Memory Types for Ethernet Global Data Monitoring Ethernet Global Data Exchange Status
4-1

GFK-2224C

Ethernet Global Data Operation

Ethernet Global Data is data that is automatically sent from one Ethernet device to one or more others. Once Ethernet Global Data has been configured, the data is sent automatically during system operation. No program interaction is necessary to produce or consume the global data. The device that sends the Ethernet Global Data is called the producer. Each device that receives Ethernet Global Data is called a consumer. Each unique Ethernet Global Data message is called an exchange (also sometimes referred to as a page). An Ethernet Interface can be configured to both produce and consume Ethernet Global Data at the same time, using separate exchanges.
PLC1 - Producer PLC2 - Consumer

P
Exchange

C
Ethernet Network

The EGD Producer

The producer of an exchange periodically sends new samples of data from its local internal memory. The producer of an exchange is uniquely identified by its Producer ID. The Producer ID can be expressed as a dotted-decimal number (for example, 0.0.0.1). Even when expressed in IP address form, it is not used as an IP address. It is used to identify a particular PLC on the network. Since the Producer ID identifies only the PLC producing the exchange, it doesnt matter how many Ethernet Interfaces are installed in that PLC. When using the EGD configuration server, each PLC that transfers EGD must be assigned a Producer ID even if that PLC produces no exchanges. The Producer ID uniquely identifies each EGD device in the configuration server and must be present if the server is used.

EGD Consumers
A consumer is a device that will update its local internal memory based on the data in an exchange. The consumer is identified at the producer by an IP Address, a Group ID, or a Subnet Mask, depending on the Destination Type selected. The Consumed Exchange configuration allows selective consumption of a produced EGD exchange. The consumer takes in the whole exchange from the network but does not need to send all of the exchange to the PLC memory. This feature is called Selective Consumption. A Consumed Exchange can be set to ignore the data ranges (variables) that are not needed.
4-2 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

EGD Exchanges
Each exchange in EGD is identified by its Producer ID and Exchange ID. Up to 255 exchanges can be configured for a PACSystems Ethernet Interface. They can be divided into any combination of produced and consumed exchanges. Each exchange can be up to 1400 bytes in length. Different produced exchanges can include some or all of the same data even though the exchanges are produced at different rates and sent to different consumers. Consumed Exchanges should not duplicate where the data is put as variable conflicts will occur and data will be overwritten by the multiple exchanges

Caution
Ethernet Global Data is designed for simple, efficient communication of sampled data between devices. It is not intended for event notification where the possible loss of a sample of data would be significant.

Some EGD devices support the concept of an EGD page. An EGD page consists of one or more exchanges that are produced on the same schedule to the same destination. Pages remove the 1400 byte size limitation of EGD exchanges. Machine Edition does not currently show information about EGD pages, you will instead see the constituent exchanges for each page.

The Content of an Ethernet Global Data Exchange

Each Ethernet Global Data exchange is composed of one or more data ranges transmitted as a sequence of 1 to 1400 bytes of data. The data ranges are commonly called variables; they may be configured to correspond to PLC variables. The content of the data is defined for both the producer and consumers of the data. In this example, a producer sends an 11-byte exchange consisting of the current contents of %R00100 through %R00104 followed by the current contents of %I00257 through %I00264: Address %R00100 %I00257 Length 5 1 Type WORD BYTE Description Conveyor1 in PLC1 Conveyor1 limit switch in PLC1

The same exchange can be configured at each consumer to suit the needs of the application.

GFK-2224C

Chapter 4 Ethernet Global Data

4-3

The Data Ranges (Variables) in an Ethernet Global Data Exchange

The variables within an exchange are defined in the Ethernet Global Data configuration in hardware configuration. There can be:

Up to 100 data ranges per exchange. A length of 1 byte to 1400 bytes per exchange. The total size of an exchange is the sum of the data lengths of all of the data ranges configured for that exchange.

Different produced exchanges may share some or all of the same data ranges even if the exchanges are produced at different rates. A consumer does not have to consume all of the data from a produced exchange. A consumed exchange may be configured to ignore specified data ranges. (See Selective Consumption in chapter 3, Configuration.)

Valid PLC Memory Types for Ethernet Global Data

The PLC memory types listed below can be included in EGD exchanges.
Description %R %W %AI %AQ %I %Q %T %M %SA %SB %SC %S %G Register memory in word mode Word memory in word mode Analog input memory in word mode Analog output memory in word mode Discrete input memory in byte mode Discrete output memory in byte mode Discrete temporary memory in byte mode Discrete momentary memory in byte mode Discrete system memory group A in byte mode Discrete system memory group B in byte mode Discrete system memory group C in byte mode Discrete system memory in byte mode Discrete global data table in byte mode P-Producer C-Consumer P/C P/C P/C P/C P/C P/C P/C P/C P/C P/C P/C P P/C

Discrete point references such as %I or %Q are configured as Byte-Array, Word-Array, or Dword-Array variables. That means a variable with discrete point references must be defined in blocks of 8 points if it is defined as a Byte-Array, 16 points if Word-Array, and 32 points if Dword-Array. Discrete memory must be byte-aligned. Boolean type and Boolean-Array variables are not allowed.

4-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

4 Planning Exchanges
It is possible to configure more Ethernet Global Data than a PLC can transfer (especially on 10Mbit networks). If high levels of consumer timeouts occur in some or all of the consumed exchanges, the EGD load can be reduced by:

Increasing the production period (especially if the period is more frequent than double the minimum time in which the data is needed). Defining fewer exchanges, each with more data. Using EGD groups or broadcasting to subnets. Rather than producing a directed exchange to several destinations, a single exchange can contain all the data and each consumer can transfer only the data it needs from the exchange. Adding another Ethernet Interface module to the rack and spreading the EGD exchanges.

Using Ethernet Global Data in a Redundancy System

When configured for Redundant IP operation, only the active unit produces EGD exchanges to the network. The backup unit does not produce EGD exchanges. When the active Ethernet interfaces changes to backup, it stops production of all EGD exchanges. When configured for Redundant IP operation, the active and backup Ethernet interfaces should be configured to consume EGD exchanges via multicast host groups or the local subnet broadcast address. This permits both the active and backup units to receive the latest data from the network. Unicast operation is not recommended. The backup unit does not consume exchanges at the Redundant IP address.

GFK-2224C

Chapter 4 Ethernet Global Data

4-5

Sending an Ethernet Global Data Exchange to Multiple Consumers

There are two ways to send an EGD Exchange to multiple consumers at the same time: by Multicasting it to a predefined group of consumers or by Broadcasting it to all of the consumers on a subnet. Both methods allow many consumer devices to simultaneously receive the same data from one producing EGD device. If an exchange is Broadcast or Multicast, the same exchange must be configured at the producer and at each consumer. Each consumer can use all of the data or just a selected portion, as configured for the consumed exchanges. For more information about Multicasting and Broadcasting, refer to chapter 6, Network Administration.

Multicasting Ethernet Global Data

If more than one device on the network should consume a Global Data exchange, those devices can be set up as a group. The network can include up to 32 numbered groups. Groups allow each sample from the producer to be seen simultaneously by all consumers in the group. A device can belong to more than one group, as illustrated below.

Group 2
I0.0.0.1 I0.0.0.2

Group 1
I0.0.0.3 I0.0.0.4

Group 2
I0.0.0.5 I0.0.0.6 I0.0.0.7 I0.0.0.8

Each device in a group responds to the groups assigned ID number from 1 to 32.

4-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

4
Each Group ID corresponds to a Multicast (Class D) IP address reserved by the Internet authorities. The default Multicast IP addresses used by Ethernet Global Data are: Group ID 1 2 . . . 32 IP Address 224.0.7.1 224.0.7.2 . . . 224.0.7.32

Group Multicast IP Addresses used by Ethernet Global Data should not be changed unless the defaults would cause a network conflict. If necessary, they can be changed within the reserved range of multicast IP addresses (224.0.0.0 through 239.255.255.255). The change must be made using an Advanced User Parameter File.

Broadcasting Ethernet Global Data

The same Ethernet Global Data exchange can be sent to all of the consumers on a subnet by configuring the Produced Exchange to use a Destination Type of Broadcast. The Destination of that exchange then changes to the value 255.255.255.255. (The Ethernet Interface converts this value to the appropriate subnet broadcast mask for this network.) As with a Group ID, each consumer on the subnet can be configured to use some or all of the exchange.

GFK-2224C

Chapter 4 Ethernet Global Data

4-7

Ethernet Global Data Timing

The Ethernet Interface and PLC CPU share internal memory for Ethernet Global Data operations.
CPU SHARED MEMORY ETHERNET INTERFACE

INTERNAL MEMORY

NETWORK

In the producing PLC, the CPU updates its shared internal memory with a data sample when requested by its Ethernet Interface. The update affects the length of the PLC sweep only for that particular exchange; it has little effect on the PLC average sweep time. When the Ethernet Interfaces producer period expires, it produces the data sample from shared internal memory onto the network. In a consuming PACSystems PLC, shared internal memory is updated as soon as the Ethernet Interface gets a data sample from the network. There is no user-configurable consumer period. The CPU updates its reference tables from shared internal memory at the end of the sweep after it is notified by the Ethernet Interface that fresh data has arrived for a specific exchange. The data is made available to the application on the next PLC sweep after it is received. Some other types of Ethernet Interfaces implement a consumption period timer.

EGD Synchronization
Ethernet Global Data attempts to provide the most up-to-date process data, consistent with the configured schedule. The Ethernet interface maintains a timer for each produced exchange. When the timer for the exchange expires, the Ethernet interface requests that the data for the exchange be transferred from reference memory during the output scan portion of the CPU sweep. At the output portion of the sweep, the CPU puts the data into the shared memory. Once the data has been transferred by the CPU sweep, the Ethernet interface immediately formulates a sample and transfers the sample on the network. (If updated data is not available at the next production timer expiration, the Ethernet interface produces a sample containing the previous data to the network.) As soon as a sample for a consumed exchange is received, it is transferred to the CPU during the next input scan portion of the CPU sweep. The result of this scheduling method for Ethernet Global Data is a variability of up to one producer CPU sweep time in the interval between samples produced on the network. This
4-8 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

4
variability in the time between samples is present to assure that the most up-to-date data is being transferred. In general, it is not useful or necessary to configure the production period to be less than the CPU sweep time. If the producer period for an exchange is set lower than the CPU sweep time, the Ethernet interface will send a stale sample (a sample containing the same data as previously sent) at the configured interval. When the fresh CPU data becomes available at the end of the sweep, the Ethernet interface will immediately send another sample with the fresh data. The timer of the produced exchange is not reset when this sample is sent. This can result in more samples in the network than would be expected from the configured period.

Configurable Producer Period for an EGD Exchange

The Producer period for an EGD exchange can be 2 milliseconds to one hour. In the PLC, the Ethernet Interface attempts to produce the data at this interval. As explained above, the exchange production may vary from the configured interval by up to one production period or one producer CPU sweep period, which ever is smaller. Producer period is configurable in increments of 2 milliseconds. If the Producer Period is set to zero, production is scheduled every scan or every 2ms, whichever is slower. In a PLC with rapid scan times, scheduling a produced exchange at zero results in a very high load on the network and on the Ethernet Interface, which can degrade overall Ethernet performance. Scheduling multiple exchanges for a zero period in a PLC with a low scan time can result in the Ethernet Interface being unable to produce all the required data, and will also degrade SRTP communication.

Consumer Update Timeout Period

For each consumed exchange, an Update Timeout period can be configured. It determines how long the Ethernet Interface will wait for the starting or subsequent packet of data in the exchange before declaring a refresh error. The update timeout period for the consumer should be set to at least twice the producer period. At very small producer periods, the update timeout should also allow for network transfer variation. Otherwise, the PLC may occasionally falsely report refresh faults. Use zero for the update timeout period of a consumed exchange to disable timeout detection.

Producer Period Guidelines for PLCs

Do not produce and consume data faster than is required by your application. This reduces the load on the network and on the devices, providing capacity for other transfers.

GFK-2224C

Chapter 4 Ethernet Global Data

4-9

Timing Examples
The following illustrations show the relationship between the PLC output scan time, the produced exchange timer, and data samples on the network.

Example 1
Only one sample is produced on the network per producer period expiration. The variability between samples can be up to producer CPU sweep time.

Producer Period = 1.5 Times CPU Sweep Producer PLC Output Scan Ethernet Global Data Production Timer Expires Sample on Network

Example 2
More than one sample can be produced per producer period expiration and stale samples are produced to the network.
Producer Period = 2/3 Time of CPU Sweep Producer PLC Output Scan Ethernet Global Data Production Timer Expires Sample on Network

Stale Data is Produced

4-10

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Timestamping of Ethernet Global Data Exchanges

The PLC CPU adds a timestamp to each Ethernet Global Data Message it produces. The timestamp indicates when the data was transferred from the producing PLC's CPU to its Ethernet interface for transmission over the network. The timestamp is an 8-byte value representing the time elapsed since midnight, January 1, 1970. The first four bytes contain a signed integer representing seconds and the next four bytes contain a signed integer representing nanoseconds. This value can be examined to determine whether a packet received from the network has a new data sample or if it is the same data received previously.
CPU Ethernet interface

CPU time clock timestamp time clock

The PLC CPU obtains the timestamp data from the time clock in the Ethernet interface. The CPU only uses this timestamp for Ethernet Global Data exchanges. The timestamp from the Ethernet interface does not affect the time of the CPU's internal time clock.

EGD with timestamp

The time clock in the Ethernet Interface is synchronized to either the clock in the CPU or an external SNTP server on the network. Selection of the timestamp source for Ethernet Global Data is part of the basic configuration of the Ethernet Interface, as explained in chapter 3, Configuration.
PLC's Time Clock: If this source is configured, the Ethernet Interfaces built-in time clock is synchronized at power-up or at restart to the clock in the PLC CPU. The timestamp information produced by the PLC has a resolution of 100 microseconds. Because the time clocks in the PLCs on the network are not synchronized, EGD timestamps produced by different PLCs cannot be compared accurately.
CPU Ethernet interface

CPU time clock

CPU Time

timestamp

time clock

GFK-2224C

Chapter 4 Ethernet Global Data

4-11

4
SNTP Server's Time Clock: if this source is configured, the Ethernet Interfaces built-in clock is periodically synchronized to the clock on an SNTP server on the network. All Ethernet Interfaces configured to use SNTP will have updated, synchronized timestamps. Therefore, accurate timing comparisons between exchanged data can be made. If SNTP is used to perform network time synchronization, the timestamp information typically has 10 millisecond accuracy between PLCs on the same network.

CPU

Ethernet interface SNTP Time Server on Network

CPU time clock time clock

SNTP Time

timestamp

EGD with timestamp

SNTP Operation
In an SNTP system, a computer on the network (called an SNTP server) sends out a periodic timing message to all of the SNTP-capable Ethernet Interfaces on the network, which keep their internal clocks synchronized with this SNTP timing message. In a redundancy system. SNTP operation is unaffected by the current Ethernet redundancy state or by redundancy role switches. SNTP server dates before January 1, 1989 are not supported.

Normal SNTP Operation

The Ethernet Interface will synchronize to a remote SNTP time server after receiving two broadcast clock values within a 150-second period. The Station Manager can be used to view server status information.

Multiple SNTP Servers

To guard against loss of SNTP timing messages, multiple SNTP time servers can be tracked on a network. An Ethernet Interface can maintain timing information from up to four total SNTP time servers at a time. Each server assigns a stratum number that determines its priority. The message from the server with the lowest stratum number is used by the Ethernet
4-12 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

4
Interface until communication with that server is lost. Then the server with the next lowest stratum number becomes the server of choice and the Ethernet Interface synchronizes to it if it receives two of its timing messages within a 150-second period. A server is considered "lost" if more than 150 seconds elapse between timing messages.

Loss or Absence of SNTP Timing Signals

If an Ethernet Interface is configured for SNTP, but does not receive two timing messages from an SNTP network time server within a 150-second period, the following will happen:

A fault entry will be placed in the PLC Fault Table. A fault entry will be placed in the Ethernet Interface's exception log. This log can be read using the Station Manager. The Status word within a consumed exchange will indicate new data with a value of 3, instead of the normal 1 value, indicating that SNTP is selected, but the Ethernet Interface is not synchronized to an SNTP server. This Status word value can be obtained from the PLC register configured for the particular exchange.

Note: The SNTP error condition is considered the least important of all possible error codes. Therefore, if another error condition exists, its status code will appear in the Status word instead of the SNTP error code.

Upon loss or absence of synchronization, the Ethernet Interfaces built-in clock will operate as follows:

If the Ethernet Interface, after its last power-up/restart cycle, has never received an SNTP server's timing message, it will continue to use the PLC CPU's local clock value that it received at power-up/restart for its time base. If the Ethernet Interface has been synchronized to an SNTP server but lost its signal, it will use the most recently received SNTP time message as its time base.

The Ethernet Interface will continue supplying time values to the PLC CPU for timestamping, while it "listens" for SNTP timing messages from the network. If SNTP messages are received later, the Ethernet Interface will then synchronize to them

GFK-2224C

Chapter 4 Ethernet Global Data

4-13

Effect of PLC Modes and Actions on EGD Operations

The configuration and operation of Ethernet Global Data may be affected by the PLCs current mode and by certain PLC actions:

The normal PLC mode for EGD operation is RUN with Outputs enabled. In this PLC mode, Ethernet Global Data remains configured and exchanges are both produced and consumed. If the PLC mode is set to STOP with I/O disabled, the Producer ID remains configured, but production and consumption stop. Note that while consumed data is not transferred to the PLC memory in this mode, data from the network is still transferred to the shared memory so that the latest data is available immediately when the PLC transitions out of STOP with I/O disabled mode. If configuration is lost, the Ethernet Global Data configuration must be stored again.
PLC Mode or Action Producer ID remains configured Configuration-Based Exchanges continue to be Configured Produced Consumed

PLC Mode

RUN-Outputs Enabled RUN-Outputs Disabled RUN-SUSPEND I/O STOP-I/O Enabled STOP-I/O Disabled
PLC Action
1

YES YES YES YES YES YES YES YES Replaced NO YES YES
2

YES YES YES YES YES YES YES YES Replaced NO YES YES
2

YES NO NO YES NO YES * * NO *

3 3

YES YES NO YES NO YES * * NO3 NO *3 *3

RUN-Store Logic STOP-Store Logic STOP-Clear Logic STOP-Config Store STOP-Clear Config PLC Power Cycle Ethernet Interface Restart
* 1

NO *3

Production and consumption is controlled by the PLC Mode as described above. RUN-SUSPEND I/O refers to the SUSIO logic function. (The DOIO logic function does not affect EGD production or consumption.) Producer ID and exchange definitions are replaced. Producer ID and exchange states depend on the PLC mode and configuration prior to the action.
TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

2 3

4-14

Monitoring Ethernet Global Data Exchange Status

The Exchange Status word is used to store status information about an EGD exchange. A unique Exchange Status word location must be is configured for each exchange. The PLC writes status codes into the Exchange Status word whenever an exchange is transferred or a consumer timeout occurs The Exchange Status word is typically set to 1, indicating that when the period expired, there was no error condition. The application program can monitor for error conditions reported in the Exchange Status word by setting it to 0 once a non-zero value is written to it. The program should also monitor the LAN Interface OK Status bit (see chapter 8, Diagnostics) for each of the Ethernet Interfaces performing EGD. The Exchange Status word is invalid if the bit is 0. Note that when an EGD exchange message received from the network contains an invalid Protocol Version Number, the Ethernet Interface cannot decode the message in order to identify the exchange. In this case, the Exchange Status Word cannot be updated.

GFK-2224C

Chapter 4 Ethernet Global Data

4-15

Exchange Status Word Error Codes

The following table shows the error codes that can be written to the Exchange Status word in the Producer (P) and Consumer. The Exchange Status Word value for each exchange may be displayed via the STAT G Station Manager command. The Exchange Status Word values are displayed within parentheses.
Value (Dec.) P/C Error
No new status event has occurred. No error currently exists. No error, data consumed. SNTP error.

Description
Produced: Initial value until the first producer period refresh occurs. Consumed: The data has not been refreshed since the previous consumption scan and the consumer timeout has not expired. The exchange is producing data. This value should be ignored in the Output Disabled PLC modes. The data has been refreshed on schedule since the previous consumption. The Ethernet Interface in the producer is configured for network time synchronization, but is not synchronized to an SNTP server. The data was refreshed on schedule. During exchange configuration, an invalid configuration parameter was received by the Ethernet Interface or an error occurred in communication with the PLC CPU. The exchanges timeout period is configured to a non-zero value and the data has not been refreshed within the timeout period. The data has been refreshed since the previous consumption, but not within the timeout period. This status can be set during exchange configuration* if the Ethernet Interface detects that it cannot currently access a network. This temporary status can change if successful network access becomes possible. Local resources are not available to establish the exchange during exchange configuration*. The PLC Fault Table may provide more detail on the specific error. The data size of a consumed exchange does not match the exchange definition. The exchange is ignored.

P/C

1 1

P C

P/C

Specification error. Refresh timeout without data. Data after refresh timeout. IP Layer not currently initialized. Lack of resource error. Data size mismatch error

6 7

C C

10

P/C

12

P/C

14

Note: PACSystems does not support EGD exchange status values 16, 18, 22, 26, 28, and 30. These exchange status values were used in Series 90 products only. * Exchange configuration occurs when either 1) Hardware Configuration containing EGD is stored to the PLC, 2) a PLC containing EGD configuration powers up, or 3) an Ethernet Interface configured for EGD is restarted.

4-16

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter Programming EGD Commands

This chapter describes a set of commands that can be used in the application program to read and write data over the Ethernet network:

Read PLC Memory Write PLC Memory Read EGD Exchange Write EGD Exchange Masked Write to EGD Exchange

Using EGD Commands in a Redundancy System

When two Ethernet Interfaces are configured for Redundant IP operation (see chapter 1, Introduction, for more information), only the active unit sends or responds to EGD commands. The backup unit does not send or respond to the Redundant IP address. If the backup unit tries to send an EGD command, a COMMREQ error status is returned to its application program. If the active Ethernet interface changes to backup status, it takes down all RDS sessions that use the Redundant IP address. Any EGD command currently in process over the Redundant IP address when a role switch occurs is ended. Although not recommend, EGD commands may be issued to the direct IP address. Both the active and backup units will respond to EGD commands received at the direct IP address. (Remote hosts should use the Redundant IP address when communicating to a redundant system.)

GFK-2224C

5-1

COMMREQ Format for Programming EGD Commands

The EGD commands described in this chapter are sent using the Communications Request (COMMREQ) function. The Communications Request is triggered when the logic program passes power to the COMMREQ Function Block.
(Enable )------------(Command Block address) (Rack/Slot Location of the Ethernet Interface) (Task value) -

COMM REQ IN FT SYSID TASK

- CommReq Delivered - Function Faulted (logic)

For the EGD commands, the parameters of the COMMREQ are: Enable: Control logic for activating the COMMREQ Function Block. IN: The location of the Command Block. The Command Block contains the parameters of the COMMREQ request. It can be located at any valid address within a word-oriented memory area (%R, %AI, %AQ, %P, %L, or %W) in the PACSystems PLC. Parameters for the EGD commands are described on the following pages. SYSID: A hexadecimal word value that gives the rack (high byte) and slot (low byte) location of the Ethernet Interface. For example, an Ethernet Interface in rack zero, slot six would use the value 6 for this parameter. For the PACSystems CPU embedded Ethernet interface, enter the rack/slot location of the CPU module. TASK: For the PACSystems CPU embedded Ethernet interface, Task must be set to the value 65536 (10000H) to address the CPUs Ethernet daughterboard. For a PACSystems Ethernet module, Task must be set to zero. FT Output: The FT output is set if the PLC CPU is unable to deliver the COMMREQ to the Ethernet interface. When the FT output is set, the Ethernet Interface is unable to return a COMMREQ status word to the PLC logic application.

5-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

COMMREQ Status for the EGD Commands

Words 3 and 4 of every COMMREQ Command Block specify a memory type and location to receive status information about the execution of the command. Word 3 specifies the memory type for the COMMREQ status word. The memory types are listed in the table below: Type %R %AI %AQ %I %Q %T %M %G %W Value (Decimal) 8 10 12 16 70 18 72 20 74 22 76 56 86 196 Value (Hex.) 08H 0AH 0CH 10H 46H 12H 48H 14H 4AH 16H 4CH 38H 56H C4H Description Register memory (word mode) Analog input memory (word mode) Analog output memory (word mode) Discrete input memory (byte mode) Discrete input memory (bit mode) Discrete output memory (byte mode) Discrete output memory (bit mode) Discrete temporary memory (byte mode) Discrete temporary memory (bit mode) Discrete momentary internal memory (byte mode) Discrete momentary internal memory (bit mode) Discrete global data table (byte mode) Discrete global data table (bit mode) Word memory (word mode; limited to %W1%W65536)

Word 4 of the COMMREQ Command Block specifies the offset within the memory type selected. The status word address offset is a zero-based number. For example, if %R1 should be the location of the status word, you must specify a zero for the offset. The offset for %R100 would be 99 decimal. (When using %W memory, the maximum offset value that can be entered is 65535, signifying %W65536.)

COMMREQ Status Values

The Ethernet Interface reports the status of the COMMREQ back to the status location. See chapter 8, Diagnostics, for COMMREQ status values that may be reported for the EGD commands.

GFK-2224C

Chapter 5 Programming EGD Commands

5-3

Read PLC Memory (4000)

The Read PLC Memory command can be used to read memory locations from a remote PACSystems PLC. This command does not require configuration of a produced / consumed exchange in the PLCs. The Read PLC Memory command can only be sent to an individual IP Address; it cannot be sent to a Group ID (multicast).

Read PLC Memory Command Block

Word Offset Value Word 1 Length of command data block, including optional password data Word 2 0 Word 3 (See previous page) Word 4 0-based. Word 5 0 Word 6 0 Word 7 4000 (fa0H)) Word 8 Timeout, in milliseconds Word 9 Word 10, Word 11 Word 12 Word 13, Word 14 Word 15 Word 16 Word 17 Word 18 Word 21 Word 22 Word 23 end Local read buffer memory type Local read buffer reference table starting address Remote read location memory type Remote reference table read location starting address Remote reference table length (in remote memory units) Network address type Network address length IP Address of the remote PLC Password length, required Password, optional Description 16 plus number of words of optional password data. (See Word 22 description.) Always 0 (no-wait mode request) Memory type of COMMREQ Status Word Offset of COMMREQ Status Word Reserved Reserved Read PLC Memory command number. The maximum time to wait for a response, in 10millisecond increments. Default is 1000ms. A timeout must be specified. If 0 is entered, the default of 1000ms is used. Memory type for the data to be placed in the local PLC. 1-based offset in the local PLC Memory type from which data will be read in the remote PLC 1-based offset in the remote PLC Number of remote memory units to be read. Must be 1. Indicates an IP address will be used. Must be 4 for IP address. Group ID (multicast) is not permitted. Four integers, specified as one integer per word of the dotted-decimal IP address of the remote PLC. May not be a group IP address. Number of data bytes in the optional password. Must be set to 0 if a password is not included. Password data (optional). This is the optional password that may be required to access the remote server.

* Word 4 (COMMREQ status word address) is the only zero-based address in the Command Block. Only this value requires subtracting 1 from the intended address. (Word 7) EGD Command Number: Word 7 requests that a read PLC memory operation occur. If the command is processed successfully, it will result in PLC reference memory data being retrieved from the server to the client.

5-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

5
(Word 8) Read Command Timeout: Word 8 specifies the time (in milliseconds) the Ethernet Interface will wait for the command to complete before returning an error status in the COMMREQ status word. If the timeout is specified as zero, no timeout error will be reported. (Word 9) Local PLC - Memory Type: Words 9-11 specify the location in the local PLC where the Ethernet Interface will store data received from the remote PLC. Valid values for Word 9 are listed below. The amount of data to be transferred is specified by the number of memory units of the data read from the remote PLC (Word 15). Type %W * %R %AI %AQ %I %Q %T %M %SA %SB %SC %S %G

Value (Decimal) 196 8 10 12 16 70 18 72 20 74 22 76 24 78 26 80 28 82 30 84 56 86

Description Word memory (word mode) Register memory (word mode) Analog input memory (word mode) Analog output memory (word mode) Discrete input memory (byte mode) Discrete input memory (bit mode) Discrete output memory (byte mode) Discrete output memory (bit mode) Discrete temporary memory (byte mode) Discrete temporary memory (bit mode) Discrete momentary internal memory (byte mode) Discrete momentary internal memory (bit mode) Discrete system memory group A (byte mode) Discrete system memory group A (bit mode) Discrete system memory group B (byte mode) Discrete system memory group B (bit mode) Discrete system memory group C (byte mode) Discrete system memory group C (bit mode) Discrete system memory (byte mode) Discrete system memory (bit mode) Discrete global data table (byte mode) Discrete global data table (bit mode)

Read-only memory, cannot be written to. %W memory is supported on PACSystems clients and servers only.

(Words 10 - 11) Local PLC - Memory Starting Address: Words 10 and 11 determine the starting address in the local PLC in which the data from the remote PLC is to be stored. The value entered is the 32-bit offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 9. Word 10 contains the least significant 16 bits of the offset; word 11 contains the most significant 16 bits of the offset. This offset will be either in bits, bytes, or words depending on the mode specified. (For example, if Word 9=16 and Words 10,11 = 2, 0 then the starting address will be %I9.) Valid ranges of values depend on the PLCs memory ranges. The user is responsible for assuring that this area is large enough to contain the requested data without overwriting other application data.
GFK-2224C Chapter 5 Programming EGD Commands 5-5

5
(Word 12) Remote PLC - Memory Type: Words 1214 specify the memory type and starting address in the remote PLC from which the data is to be read. Valid values for Word 12 are listed above. (Words 13 - 14) Remote PLC - Memory Starting Address: Words 13,14 determine the starting address in the remote PLC from which the data is to be read. The value entered is the 32-bit offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 12. Word 13 contains the least significant 16 bits of the offset; word 14 contains the most significant 16 bits of the offset. This offset will be either in bits, bytes, or words depending on the mode specified (for example, if Word 12=16 and Words 13,14 =9, 0, then the starting address will be %I65). Valid ranges of values depend on the remote PLCs memory ranges. (Word 15) Remote PLC - Number of Memory Units: Word 15 specifies the amount of data to be transferred. The value entered is the number of memory units to be transferred, where the size of the remote PLC memory type (bit, byte, or word) is specified in Word 12. For example, if Word 12=16 and Word 15=4, then 4 bytes (32 bits) of %I memory will be transferred. For Read PLC Memory, the maximum length is 11200 bits, 1400 bytes, or 700 words of data. (Word 16) Remote PLC - Network Address Type: Word 16 specifies the format of the remote PLC address. Word 16 must contain the value 1. This indicates a dotted-decimal IP address expressed using a separate register for each decimal digit. (Word 17) Remote PLC - Network Address Length: Word 17 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block. Word 17 must contain 4. (Words 18 21) Remote PLC - IP Address: Words 1821 specify the four integers, one integer per word, of the dotted-decimal IP address of the remote PLC to be accessed. (Word 22) Remote PLC Password Length: Word 22 specifies the number of bytes of data in the optional password field of this COMMREQ. The maximum password length is 254 bytes. If a password is not included, word 22 must be set to 0.

Note
The total COMMREQ data block length in Word 1 must include the optional password data, expressed as a number of words. To convert the password length to a word value, simply add 1 to the byte value in Word 22 and divide the sum by 2.

5-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

5
Words 23 ) Remote PLC Password (Optional): Words 23 through the end of the COMMREQ Command Block specify optional password data to be passed to the remote server. The format and content of the password data is dependent upon the particular remote server.

Note
The Read PLC Memory command can only be sent to a GE Fanuc PLC server. For a GE Fanuc PLC server, the password data must contain a case-sensitive ASCII string of 0 to 7 characters followed by a terminating NULL character. The password string must have each pair of ASCII characters reversed within the PLC memory. For example, the password string MARY (M = 4DH, A = 41H, R = 52H, Y = 59H) would have 414DH in the first word, 5952H in the second word, and 0000H in the third word (the terminating NULL character) The password length in Word 22 would be 0005H. (The password data occupies 3 words, so the COMMREQ Data Block length in Word 1 would be 16+3 = 19 words.)

GFK-2224C

Chapter 5 Programming EGD Commands

5-7

Write PLC Memory (4001)

The Write PLC Memory command can be used to write memory locations to one remote PACSystems PLC. Use of this command does not require a configured produced / consumed exchange in the PLCs.

Write PLC Memory Command Block

Word Offset Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Value Length of command data block, including optional password data 0 (See table on page 5-3) 0-based. 0 0 4001 (fa1H) Timeout, in milliseconds Description 16 plus number of words of optional password data. (See Word 22 description.) Always 0 (no-wait mode request) Memory type of COMMREQ Status Word Offset of COMMREQ Status Word Reserved Reserved Write PLC Memory command number. The maximum time to wait for a response, in 10millisecond increments. Default is 1000ms. A timeout must be specified. If 0 is entered, the default of 1000ms is used. Memory type for the data that will be written, in the local PLC. 1-based offset in the local PLC. Memory type into which data will be written in the remote PLC(s) 1-based offset in the remote PLC

Word 9 Word 10, Word 11 Word 12 Word 13, Word 14 Word 15 Word 16 Word 17 Word 18 Word 21 Word 22 Word 23 end

Local write buffer memory type Local write buffer reference table starting address Remote write location memory type Remote reference table write location starting address Write Length Network address type Network address length

0 to 1400 bytes, 0 to 700 words. Must be 1. Indicates an IP address will be used. Must be 4 for IP address. Group ID (multicast) is not permitted. IP Address of the remote PLC Four integers, specified as one integer per word of the dotted-decimal IP address of the remote PLC. May not be a group IP address. Password length, required Number of data bytes in the optional password. Must be set to 0 if a password is not included. Password, optional Password data (optional). This is the optional password that may be required to access the remote server.

* Word 4 (CRS word address) is the only zero-based address in the Command Block. Only this value
requires subtracting 1 from the intended address.

5-8

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

(Word 7) EGD Command Number: Word 7 requests that a write PLC memory operation occur. If the command is processed successfully, it will result in PLC reference memory data being sent from the server to the client. (Word 8) Write Command Timeout: Word 8 specifies the time (in milliseconds) that the Ethernet Interface will wait for the command to complete before returning an error status in the COMMREQ status word. If the timeout value is specified as zero, no timeout error will be reported. (Word 9) Local PLC - Memory Type: Words 9-11 specify the location in the local PLC where the Ethernet Interface will get the data to be written to the remote PLC. Valid values for Word 9 are listed in the description of Read PLC Memory Command. The amount of data to be transferred is specified by the number of memory units of the data written to the remote PLC (Word 15). (Words 10 - 11) Local PLC - Memory Starting Address: Words 10 and 11 determine the starting address in the local PLC from which the data is to be written to the remote PLC. The value entered is the 32-bit offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 9. Word 10 contains the least significant 16 bits of the offset; word 11 contains the most significant 16 bits of the offset. This offset will be either in bits, bytes, or words depending on the mode specified. (For example, if Word 9=16 and Words 10,11 = 2, 0 then the starting address will be %I9.) Valid ranges of values depend on the PLCs memory ranges. (Word 12) Remote PLC - Memory Type: Words 1214 specify the memory type and starting address in the remote PLC where data is to be written. Valid values for Word 12 are listed above. (Words 13 - 14) Remote PLC - Memory Starting Address: Words 13,14 determine the starting address in the remote PLC where data is to be written. The value entered is the 32-bit offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 12. Word 13 contains the least significant 16 bits of the offset; word 14 contains the most significant 16 bits of the offset. This offset will be either in bits, bytes, or words depending on the mode specified (for example, if Word 12=16 and Words 13,14 =9, 0, then the starting address will be %I65). Valid ranges of values depend on the remote PLCs memory ranges. (Word 15) Remote PLC - Number of Memory Units: Word 15 specifies the amount of data to be transferred. The value entered is the number of memory units to be transferred, where the size of the remote PLC memory type (bit, byte, or word) is specified in Word 12. For example, if Word 12=16 and Word 15=4, then 4 bytes (32 bits) of %I memory will be transferred. For Write PLC Memory, the maximum length is 11200 bits, 1400 bytes, or 700 words of data. If a password is specified, the data length is decreased by the password length plus 8 bytes.

GFK-2224C

Chapter 5 Programming EGD Commands

5-9

5
(Word 16) Remote PLC - Network Address Type: Word 16 specifies the format of the remote PLC address. Word 16 must contain the value 1. This indicates a dotted-decimal IP address expressed using a separate register for each decimal digit. (Word 17) Remote PLC - Network Address Length: Word 17 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block. Word 17 must contain 4. (Words 18 21) Remote PLC - IP Address: Words 1821 specify the four integers, one integer per word, of the dotted-decimal IP address of the remote PLC to be accessed. (Word 22) Remote PLC Password Length: Word 22 specifies the number of bytes of data in the optional password field of this COMMREQ. The maximum password data length is 254 bytes. If a password is not included, word 22 must be set to 0.

Note
The total COMMREQ data block length in Word 1 must include the optional password data, expressed as a number of words. To convert the password length to a word value, simply add 1 to the byte value in Word 22 and divide the sum by 2.

(Words 23 ) Remote PLC Password (Optional): Words 23 through the end of the COMMREQ Command Block specify optional password data to be passed to the remote server. The format and content of the password data is dependent upon the particular remote server.

Note
The Write PLC Memory command can only be sent to a GE Fanuc PLC server. For a GE Fanuc PLC server, the password data must contain a case-sensitive ASCII string of 0 to 7 characters followed by a terminating NULL character. The password string must have each pair of ASCII characters reversed within the PLC memory. For example, the password string MARY (M = 4DH, A = 41H, R = 52H, Y = 59H) would have 414DH in the first word, 5952H in the second word, and 0000H in the third word (the terminating NULL character) The password length in Word 22 would be 0005H. (The password data occupies 3 words, so the COMMREQ Data Block length in Word 1 would be 16+3 = 19 words.)

5-10

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Read EGD Exchange (4002)

The Read EGD Exchange command can be used to read some or all of a configured Ethernet Global Data exchange from either the producer or the consumer. This command identifies the data to be read using its configured Producer ID and Exchange ID. It can then read the content of the data for the exchange, directly from the producer or consumer device memory. This command can be sent to PACSystems PLCs and to other EGD Class 2 devices. In a PACSystems PLC, reading an EGD exchange reads the PLC reference memory locations configured to be transferred at the specified offset in the exchange. Thus current process data will be read, not the data that was transferred last in the exchange.

Read EGD Exchange Command Block

Word Offset Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Value Length of command data block, including optional password data 0 (See table on page 5-3) 0-based. 0 0 4002 (fa2H) Timeout, in milliseconds Description 19 plus number of words of optional password data. (See Word 25 description.) Always 0 (no-wait mode request) Memory type of COMMREQ Status Word Offset of COMMREQ Status Word Reserved Reserved Read EGD Exchange command number. The maximum time to wait for a response, in 10millisecond increments. Default is 1000ms. A timeout must be specified. If 0 is entered, the default of 1000ms is used. Memory type for the data, in the local PLC. 1-based offset EGD Exchange signature. This should be 0 for PLCs. EGD Producer ID EGD Exchange ID Byte offset (0-based) in the exchange that should be read. Number of bytes to be read in the range 0 to 1400 bytes. Must be 1. Indicates that an IP address will be used. Must be 4 for IP address. Group ID (multicast) is not permitted. Four integers, specified as one integer per word of the dotted-decimal IP address of the remote PLC. May not be a group IP address. Number of data bytes in the optional password. Must be set to 0 if a password is not included. Password data (optional). This is the optional password that may be required to access the remote server.

Word 9 Local read buffer memory type Word 10, 11 Local read buffer reference table starting address Word 12 Remote signature Word 13, 14 Remote Producer ID Word 15, 16 Remote Exchange ID Word 17 Remote Exchange Offset Word 18 Word 19 Word 20 Word 21 to Word 24 Word 25 Word 26 end Read length Network address type Network address length IP Address of the remote PLC Password length, required Password, optional

* Word 4 (COMMREQ status word address) is the only zero-based address in the Command Block. Only this value requires subtracting 1 from the intended address.
GFK-2224C Chapter 5 Programming EGD Commands 5-11

5
(Word 7) EGD Command Number: Word 7 requests that a read EGD exchange operation occur. If the command is processed successfully, it will result in data from a specified EGD exchange being read from the client to the server. (Word 8) Read Command Timeout: Word 8 specifies the time (in milliseconds) that the Ethernet Interface will wait for the command to complete before returning an error status in the COMMREQ status word. If the timeout value is specified as zero, a timeout of 1000 msec (= 1.000 sec) is used. (Word 9) Local PLC - Memory Type: Words 9-11 specify the location in the local PLC where the Ethernet Interface will get the data to be read from the remote EGD device. Valid values for Word 9 are listed in the description of Read PLC Memory Command. The amount of data to be transferred is specified by the Exchange Data Length (Word 18). (Words 10 - 11) Local PLC - Memory Starting Address: Words 10 and 11 determine the starting address in the local PLC where data is to be read from the remote EGD exchange. The value entered is the 32-bit offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 9. Word 10 contains the least significant 16 bits of the offset; word 11 contains the most significant 16 bits of the offset. This offset will be either in bits, bytes, or words depending on the mode specified. (For example, if Word 9=16 and Words 10,11 = 2, 0 then the starting address will be %I9.) Valid ranges of values depend on the PLCs memory ranges. The user is responsible for assuring that this area is large enough to contain the requested data without overwriting other application data. (Word 12) Remote EGD exchange Exchange Signature: Words 12 contains the 16-bit exchange signature value to be compared at the remote EGD device. For remote PLCs, the exchange signature should ordinarily be set to 0. (Words 13 - 14) Remote EGD exchange Producer ID: Words 13 and 14 contains the 32bit Producer ID of the desired exchange at the remote EGD device. Word 13 contains the least significant 16 bits of the Producer ID; word 14 contains the most significant 16 bits. (Words 15 - 16) Remote EGD exchange Exchange ID: Words 15 and 16 contains the 32bit Exchange ID of the desired exchange at the remote EGD device. Word 15 contains the least significant 16 bits of the Exchange ID; word 16 contains the most significant 16 bits. (Word 17) Remote EGD exchange Exchange Data Offset: Word 17 contains the 0-based byte offset of the data to be read from the data portion of the exchange at the remote EGD device. (Word 18) Remote EGD exchange Exchange Data Length: Word 18 contains the length (in bytes) of the exchange data to be read from the remote EGD device. The exchange data length may not exceed 1400 bytes.

5-12

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

5
(Word 19) Remote Server - Network Address Type: Word 19 specifies the format of the remote PLC address. Word 19 must contain the value 1. This indicates a dotted-decimal IP address expressed using a separate register for each decimal digit. (Word 20) Remote Server - Network Address Length: Word 20 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block. Word 20 must contain 4. (Words 21 24) Remote Server - IP Address: Words 2124 specify the four integers, one integer per word, of the dotted-decimal IP address of the remote PLC to be accessed. (Word 25) Remote Server Password Length: Word 25 specifies the number of bytes of data in the optional password field of this COMMREQ. The maximum password length is 254 bytes. If a password is not included, word 25 must be set to 0.

Note
The total COMMREQ data block length in Word 1 must include the optional password data, expressed as a number of words. To convert the password length to a word value, simply add 1 to the byte value in Word 25 and divide the sum by 2.

(Words 26 ) Remote Server Password (Optional): Words 26 through the end of the COMMREQ Command Block specify optional password data to be passed to the remote server. The format and content of the password data is dependent upon the particular remote server.

Note
The Read EGD Exchange command can be sent to various servers. For a GE Fanuc PLC server, the password data must contain a case-sensitive ASCII string of 0 to 7 characters followed by a terminating NULL character. The password string must have each pair of ASCII characters reversed within the PLC memory. For example, the password string MARY (M = 4DH, A = 41H, R = 52H, Y = 59H) would have 414DH in the first word, 5952H in the second word , and 0000H in the third word (the terminating NULL character) The password length in Word 22 would be 0005H. (The password data occupies 3 words, so the COMMREQ Data Block length in Word 1 would be 19+3 = 22 words.)

GFK-2224C

Chapter 5 Programming EGD Commands

5-13

Write EGD Exchange (4003)

The Write EGD Exchange command can be used to write portions of a configured Ethernet Global Data exchange in a remote producer node. EGD protocol prohibits writing to a consumed exchange. . This command identifies the exchange to be written using its configured Producer ID and Exchange ID. It can then write the content of that data directly to the device memory. This command can be sent to PACSystems PLCs and to other EGD Class 2 devices. In a PACSystems PLC, writing an EGD exchange modifies the PLC reference memory locations configured for transfer at the specified offset in the exchange. Thus current process data will be updated, not the data that was transferred last in the exchange.

Write EGD Exchange Command Block

Word Offset Value Word 1 Length of command data block, including optional password data Word 2 0 Word 3 (See table on page 5-3) Word 4 0-based. Word 5 0 Word 6 0 Word 7 4003 (fa3H) Word 8 Timeout, in milliseconds Word 9 Word 10, Word 11 Word 12 Word 13, Word 14 Word 15, Word 16 Word 17 Word 18 Word 19 Word 20 Word 21 to Word 24 Word 25 Word 26 end Local write buffer memory type Local write buffer reference table starting address Remote signature Remote Producer ID Remote Exchange ID Remote Exchange Offset Write length Network address type Network address length IP Address of the remote PLC Password length, required Password, optional Description 19 plus number of words of optional password data. (See Word 25 description.) Always 0 (no-wait mode request) Memory type of COMMREQ Status Word Offset of COMMREQ Status Word Reserved Reserved Write EGD Exchange command number. The maximum time to wait for a response, in 10-millisecond increments. Default is 1000ms. A timeout must be specified. If 0 is entered, the default of 1000ms is used. Memory type for the data, in the local PLC. 1-based offset EGD Exchange signature. This should be 0 for PLCs. EGD Producer ID EGD Exchange ID Byte offset (0-based) in the exchange that should be read. Number of bytes to be written in the range 0 to 1400 bytes. Must be 1. Indicates an IP address will be used. Must be 4 for IP address. Group ID (multicast) is not permitted. Four integers, specified as one integer per word of the dotted-decimal IP address of the remote PLC. May not be a group IP address. Number of data bytes in the optional password. Must be set to 0 if a password is not included. Password data (optional). This is the optional password that may be required to access the remote server.

* Word 4 (COMMREQ status word address) is the only zero-based address in the Command Block. Only this value requires subtracting 1 from the intended address.
5-14 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

5
(Word 7) EGD Command Number: Word 7 requests that a write EGD exchange operation occur. If the command is processed successfully, it will result in data for a specified EGD exchange being written from the client to the server. (Word 8) Write Command Timeout: Word 8 specifies the time (in milliseconds) that the Ethernet Interface will wait for the command to complete before returning an error status in the COMMREQ status word. If the timeout value is specified as zero, a timeout of 1000 msec (= 1.000 sec) is used. (Word 9) Local PLC - Memory Type: Words 9-11 specify the location in the local PLC where the Ethernet Interface will get the data to write to the remote EGD device. Valid values for Word 9 are listed in the description of Read PLC Memory Command. The amount of data to be transferred is specified by the Exchange Data Length (Word 18). (Words 10 - 11) Local PLC - Memory Starting Address: Words 10 and 11 determine the starting address in the local PLC from which data is to be written to the remote EGD exchange. The value entered is the 32-bit offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 9. Word 10 contains the least significant 16 bits of the offset; word 11 contains the most significant 16 bits of the offset. This offset will be either in bits, bytes, or words depending on the mode specified. (For example, if Word 9=16 and Words 10,11 = 2, 0 then the starting address will be %I9.) Valid ranges of values depend on the PLCs memory ranges. (Word 12) Remote EGD exchange Exchange Signature: Words 12 contains the 16-bit exchange signature value to be compared at the remote EGD device. For remote PLCs, the exchange signature should ordinarily be set to 0. (Words 13 - 14) Remote EGD exchange Producer ID: Words 13 and 14 contains the 32bit Producer ID of the desired exchange at the remote EGD device. Word 13 contains the least significant 16 bits of the Producer ID; word 14 contains the most significant 16 bits. (Words 15 - 16) Remote EGD exchange Exchange ID: Words 15 and 16 contains the 32bit Exchange ID of the desired exchange at the remote EGD device. Word 15 contains the least significant 16 bits of the Exchange ID; word 16 contains the most significant 16 bits. For the Write EGD Command, the exchange at the remote device must be a Produced exchange. (Word 17) Remote EGD exchange Exchange Data Offset: Word 17 contains the 0-based byte offset of the data to be overwritten in the data portion of the exchange at the remote EGD device. (Word 18) Remote EGD exchange Exchange Data Length: Word 18 contains the length (in bytes) of the exchange data to be written to the remote EGD device. The exchange data length may not exceed 1400 bytes. (Word 19) Remote Server - Network Address Type: Word 19 specifies the format of the remote PLC address. Word 19 must contain the value 1. This indicates a dotted-decimal IP address expressed using a separate register for each decimal digit.
GFK-2224C Chapter 5 Programming EGD Commands 5-15

5
(Word 20) Remote Server - Network Address Length: Word 20 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block. Word 20 must contain 4. (Words 21 24) Remote Server - IP Address: Words 2124 specify the four integers, one integer per word, of the dotted-decimal IP address of the remote PLC to be accessed. (Word 25) Remote Server Password Length: Word 25 specifies the number of bytes of data in the optional password field of this COMMREQ. The maximum password length is 254 bytes. If a password is not included, word 25 must be set to 0.

Note
The total COMMREQ data block length in Word 1 must include the optional password data, expressed as a number of words. To convert the password length to a word value, simply add 1 to the byte value in Word 25 and divide the sum by 2.

(Words 26 ) Remote Server Password (Optional): Words 26 through the end of the COMMREQ Command Block specify optional password data to be passed to the remote server. The format and content of the password data is dependent upon the particular remote server.

Note
The Write EGD Exchange command can be sent to various servers. For a GE Fanuc PLC server, the password data must contain a case-sensitive ASCII string of 0 to 7 characters followed by a terminating NULL character. The password string must have each pair of ASCII characters reversed within the PLC memory. For example, the password string MARY (M = 4DH, A = 41H, R = 52H, Y = 59H) would have 414DH in the first word, 5952H in the second word , and 0000H in the third word (the terminating NULL character) The password length in Word 22 would be 0005H. (The password data occupies 3 words, so the COMMREQ Data Block length in Word 1 would be 19+3 = 22 words.)

5-16

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Masked Write to EGD Exchange (4004)

The Masked Write to EGD Exchange command can be used to write one or more bits in a single byte of a configured Ethernet Global Data exchange in a remote producer node. EGD protocol prohibits writing to a consumed exchange. This command can be sent to PACSystems PLCs and to other EGD Class 2 devices. In a PACSystems PLC, writing an EGD exchange modifies the PLC reference memory locations configured to be transferred at the specified offset in the exchange. Thus current process data will be updated, not the data that was transferred last in the exchange.

Masked Write EGD Exchange Command Block

Word Offset Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12, 13 Word 14, 15 Word 16 Word 17 Word 18 Value Length of command data block, including optional password data 0 (See table on page 5-3) 0-based. 0 0 4004 (fa4H) Timeout, in milliseconds Bit mask, set bit to be written to 1, rest to 0 Write 0 or 1 to selected bit. Remote signature Remote Producer ID Remote Exchange ID Remote Exchange Offset Network address type Network address length Description 17 plus number of words of optional password data. (See Word 17 description.) Always 0 (no-wait mode request) Memory type of COMMREQ Status Word Offset of COMMREQ Status Word Reserved Reserved Masked Write to EGD Exchange command number. The maximum time to wait for a response, in 10-millisecond increments. Default is 1000ms. A timeout must be specified. If 0 is entered, the default of 1000ms is used. The bit mask selects the individual bit to be written. The most significant bytes of Word 9 and Word 10 are ignored. Value to set the bit selected by the bit mask in Word 9. EGD Exchange signature. This should be 0 for PLCs. EGD Producer ID EGD Exchange ID Byte offset (0-based) in the exchange that should be read.

Must be 1. Indicates an IP address will be used. Must be 4 for IP address. Group ID (multicast) is not permitted. Word 19 to IP Address of the remote Four integers, specified as one integer per word of the Word 22 PLC dotted-decimal IP address of the remote PLC. May not be a group IP address. Word 23 Password length, Number of data bytes in the optional password. Must be set required to 0 if a password is not included. Word 24 end Password, optional Password data (optional). This is the optional password that may be required to access the remote server.

* Word 4 (COMMREQ status word address) is the only zero-based address in the Command Block. Only this value requires subtracting 1 from the intended address.

GFK-2224C

Chapter 5 Programming EGD Commands

5-17

5
(Word 7) EGD Command Number: Word 7 requests that a masked write EGD exchange operation occur. If the command is processed successfully, it will result in a data bit for a specified EGD exchange being written from the client to the server. (Word 8) Masked Write Command Timeout: Word 8 specifies the time (in milliseconds) that the Ethernet Interface will wait for the command to complete before returning an error status in the COMMREQ status word. If the timeout value is specified as zero, a timeout of 1000 msec (= 1.000 sec) is used. (Word 9) Bit Mask: Words 9 10 specify the individual data to be written to the remote EGD exchange. The usage of the Bit Mask and Data are described in Masked Write to EGD Exchange Bit Mask and Data Bits, below. Word 9 contains a bit mask that identifies a bit or bits within a data byte. The mask bit corresponding to each data bit to be written is set to 1; all other bits are set to 0. (Word 10) Data: Word 10 contains the data byte that contains the bit or bits to be written to the remote EGD exchange. The individual data bits to be written are in the same position as the 1 bits in the Bit Mask (Word 9). (Word 11) Remote EGD exchange Exchange Signature: Words 11 contains the 16-bit exchange signature value to be compared at the remote EGD device. For remote PLCs, the exchange signature should ordinarily be set to 0. (Words 12 - 13) Remote EGD exchange Producer ID: Words 12 and 13 contains the 32bit Producer ID of the desired exchange at the remote EGD device. Word 12 contains the least significant 16 bits of the Producer ID; word 13 contains the most significant 16 bits. (Words 14 - 15) Remote EGD exchange Exchange ID: Words 14 and 15 contains the 32bit Exchange ID of the desired exchange at the remote EGD device. Word 14 contains the least significant 16 bits of the Exchange ID; word 15 contains the most significant 16 bits. For the Masked Write EGD Command, the exchange at the remote device must be a Produced exchange. (Word 16) Remote EGD exchange Exchange Data Offset: Word 16 contains the 0-based byte offset of the single data byte data containing the bit or bits to be overwritten in the data portion of the exchange at the remote EGD device. (Word 17) Remote Server - Network Address Type: Word 17 specifies the format of the remote PLC address. Word 17 must contain the value 1. This indicates a dotted-decimal IP address expressed using a separate register for each decimal digit. (Word 18) Remote Server - Network Address Length: Word 18 specifies the length in words of the remote PLC IP address in this COMMREQ Command Block. Word 18 must contain 4. (Words 19 22) Remote Server - IP Address: Words 1922 specify the four integers, one integer per word, of the dotted-decimal IP address of the remote PLC to be accessed.

5-18

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

5
(Word 23) Remote Server Password Length: Word 23 specifies the number of bytes of data in the optional password field of this COMMREQ. The maximum password length is 254 bytes. If a password is not included, word 23 must be set to 0.

Note
The total COMMREQ data block length in Word 1 must include the optional password data, expressed as a number of words. To convert the password length to a word value, simply add 1 to the byte value in Word 23 and divide the sum by 2.

(Words 24 ) Remote Server Password: Words 24 through the end of the COMMREQ Command Block specify optional password data to be passed to the remote server. The format and content of the password data is dependent upon the particular remote server.

Note
The Masked Write to EGD Exchange command can be sent to various servers. For a GE Fanuc PLC server, the password data must contain a case-sensitive ASCII string of 0 to 7 characters followed by a terminating NULL character. The password string must have each pair of ASCII characters reversed within the PLC memory. For example, the password string MARY (M = 4DH, A = 41H, R = 52H, Y = 59H) would have 414DH in the first word, 5952H in the second word , and 0000H in the third word (the terminating NULL character) The password length in Word 22 would be 0005H. (The password data occupies 3 words, so the COMMREQ Data Block length in Word 1 would be 17+3 = 20 words.)

GFK-2224C

Chapter 5 Programming EGD Commands

5-19

Masked Write to EGD Exchange Bit Mask and Data Bits

Word 9 of the Masked Write command contains the bit mask. The most significant byte of Word 9 is ignored. In the least significant byte, any bits set to 1 will be written to the remote producer. The equivalent bit of Word 10 of the Masked Write command contains the bit state to be written, 1 or 0. The most significant byte of Word 10 is also ignored. For example:
Bit to be written at the selected Remote Exchange Offset

Word 9 (mask)

Most Significant Byte

Word 10 (data)

Most Significant Byte

State to set the masked bit

5-20

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter Programming SRTP Channel Commands

This chapter describes how to implement PLC to PLC communications over the Ethernet network using SRTP Channel commands:

SRTP Channel Commands

Channel Operations Aborting and Re-tasking a Channel SRTP Channel Commands in a Redundant System Executing a Channel Command

COMMREQ Format for Programming Channel Commands Establish Read Channel Establish Write Channel Send Information Report Abort Channel Retrieve Detailed Channel Status

Programming for Channel Commands COMMREQ Example Sequencing Communications Requests Managing Channels and TCP Connections Use Channel Re-Tasking to Avoid using up TCP Connections Client Channels TCP Resource Management SRTP Application Timeouts

Monitoring Channel Status Differences between Series 90 and PACSystems SRTP Channels

GFK-2224C

6-1

SRTP Channel Commands

The SRTP Channel commands are a set of client PLC commands that can be used to communicate with a server PLC. A Channel command can establish a channel to execute multiple periodic reads or writes with a single initiation of a COMMREQ function. A Channel command can also be used to execute a single read or write. There are five Channel commands:

Establish Read Channel Establish Write Channel Send Information Report Abort Channel Retrieve Detailed Channel Status

Up to 32 channels (132) can be established by a PACSystems Ethernet Interface. Channels can be individually monitored from the application program.

Channel Operations
Channel commands are based on the concept of periodic data transfers. The client (local) PLC uses a single COMMREQ function to establish a channel (connection) to a server (remote) PLC and to request that specific data be periodically transferred between the PLCs. The Ethernet Interface automatically manages the establishment of communications and the periodic data transfer. Parameters in the Command Block specify the frequency and direction of the transfer, and the memory locations in the client and server to be used in the transfer.

Aborting and Re-tasking a Channel

There are four ways a channel can be aborted: 1. When the PLC CPU is stopped, all channels in use are aborted automatically. 2. A channel (or all channels) can be aborted by issuing an Abort Channel command. 3. A channel in use can be re-tasked by issuing an establish command for its channel number. This aborts the previous channel operation and then performs the new channel operation. 4. A channel is also automatically aborted if a fatal error occurs.

6-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

6 Monitoring the Channel Status

The Ethernet Interface status bits occupy a single block of memory. The memory location is specified during configuration of the Ethernet Interface. The status bits are updated in the CPU once each PLC scan by the Ethernet Interface. These bits are generally used to prevent initiation of a COMMREQ function when certain errors occur or to signal a problem on an established channel. The first 16 bits of the block are the LAN Interface Status (LIS) bits. The next 64 bits are the Channel Status bits (2 for each channel). Unless the LAN Interface OK bit is set (Status Bit 16), the other status bits are invalid. Status Bits 1 2 3 4 5 6 7-8 9 1012 13 14 15 16 17 18 ... 79 80 Port 1A full duplex Port 1A 100Mbps Port 1B full duplex Port 1B 100 Mbps Reserved Redundant IP active (RX7i only) Reserved Any Channel Error (error on any channel) Reserved LAN OK Resource problem Module Overtemperature (RX3i only) LAN Interface OK Data Transfer - Channel 1 Channel Error - Channel 1 ... Data Transfer - Channel 32 Channel Error - Channel 32 Brief Description

The LAN Status bits (bits 1 16) are described in chapter 10, Diagnostics. They monitor the health of the Ethernet Interface itself. Bit 16, LAN Interface OK Bit: This bit is set to 1 by the Ethernet Interface each PLC scan. If the Ethernet Interface cannot access the PLC, the CPU sets this bit to 0. When this bit is 0, all other Ethernet Interface Status bits are invalid.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-3

Channel Status Bits

The Channel Status bits provide runtime status information for each communication channel. Each channel has two status bits; the meaning of the channel status bits depends upon the type of communication performed on that channel. SRTP channels operation provides two Channels Status bits for each SRTP channel, a Data Transfer bit and a Channel Error bit. Bits 17, 19, 21 ... 79, Data Transfer Bit: Typically, a channel is used to perform repetitive reads or writes. The Data Transfer bit pulses ( 0 1 0) each time there is a successful read or write. This can be an indicator to the ladder program to move the most recent data to another location. The Data Transfer bit is not closely synchronized in time with the transfer. The bit indicates only whether a transfer has occurred during the preceding read or write period. A rising edge on the bit indicating that a transfer has completed successfully does not guarantee that the next transfer has not begun or completed. After an Establish Channel command, the COMMREQ status word is always updated before the Data Transfer bit is set to 1. The Data Transfer bit for a channel is not meaningful until the Ethernet Interface updates the COMMREQ status word. Do not use data received from a server until the COMMREQ status word confirming the Read command for that channel is 1 and the Data Transfer bit goes to 1. Bits 18, 20, 22 ... 80, Channel Error Bit: This bit (normally 0) is the primary indicator for an error on a channel. It indicates any channel error, fatal or non-fatal. It does not necessarily indicate that the channel is idle. A Channel Error bit is not meaningful until after the Ethernet Interface updates the COMMREQ status word confirming the Read or Write command for that channel. For an Establish Channel command, the COMMREQ status word is updated before the Channel Error bit is set to 1. A Channel Error bit is set to 1 when an error is detected on the channel. It is set to 0 when the channel is initially established and if the channel resumes normal operation after a transient error condition subsides. The Channel Error bit is also set to 0 when the channel is aborted by an Abort Channel command or when the PLC CPU transitions from RUN to STOP. In the case of an Establish Channel command, the COMMREQ status word is always updated before the Channel Error bit is set to 1. If this bit indicates an error, initiate the Abort command and then reinitiate the Read or Write command. If the error persists, initiate the Retrieve Detailed Channel Status command to find out if the channel is idle, and possibly why it is idle. The status code may change between

6-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

6
the time the Channel Error bit indicates an error and the time the Retrieve Detailed Channel Status command retrieves the code.

SRTP Channel Commands in a Redundant System

When configured for Redundant IP operation (see chapter 1 for more information), only the active unit establishes and maintains the SRTP Client connections used for the Channel commands. The backup unit does not perform any SRTP Client operations. If SRTP Client operation is attempted, a COMMREQ error status is returned to the local logic program. When the Ethernet interface changes from active to backup state, it takes down all SRTP Client connections and their underlying TCP connections. Because it can take some time to take down a TCP connection, the Redundant system should reserve a spare SRTP Client connection for each connection using the Redundant IP address. That will prevent temporary resource problems when establishing new SRTP Client connections to the new active unit while the previous connections to the old active unit are being taken down.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-5

Executing a Channel Command

The figure below shows how a Communications Request carries out a Channel command; in this case, Establish Read Channel.
Domain of a TCP connection Domain of a channel
Client PLC CPU PLC Backplane Client Ethernet Interface Server Ethernet Interface

Domain of a remote server

PLC Backplane

LAN

Server CPU

Power flows to COMMREQ in ladder program Command Block sent to Interface Verify Command Block and set up channel to server PLC Read Request Read Request Data Data Data Return COMMREQ Status (CRS) Word to CPU Pulse Data Transfer bit Read Request Data Data Data Transfer pulse received . . . Data Data Transfer pulse received Pulse Data Transfer bit . . . Read Request Data Pulse Data Transfer bit Read Request Data Data Data

COMMREQ Status Word Data Transfer pulse received

Read Request Data Data

1.

The command starts when there is power flow to a COMMREQ function in the client PLC. At this time, the Command Block data is sent from the PLC CPU to the Ethernet Interface. For the Establish Read Channel command, the COMMREQ status word is returned immediately if the Command Block is invalid. If the syntax is correct, the COMMREQ status word is returned after the first significant event: upon failure to establish a channel correctly and in a timely manner or upon the first successful transfer of data. After the channel is successfully set up to the server PLC, the Ethernet Interface performs the periodic reads as specified in the Command Block.

2.

3.

6-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

COMMREQ Format for Programming Channel Commands

The Channel commands described in this chapter are sent using the Communications Request (COMMREQ) function. The Communications Request is triggered when the logic program passes power to the COMMREQ Function Block.
(Enable )------------(Command Block address) (Rack/Slot Location of the Ethernet Interface) (Task value) -

COMM REQ IN FT SYSID TASK

- CommReq Delivered - Function Faulted (logic)

For the Channel Commands, the parameters of the COMMREQ are: Enable: Control logic for activating the COMMREQ Function Block. IN: The location of the Command Block. It can be any valid address within a word-oriented area of (%R, %AI, %AQ, %P, %L, or %W). SYSID: A hexadecimal word value that gives the rack (high byte) and slot (low byte) location of the Ethernet Interface. For the PACSystems CPU embedded Ethernet interface, enter the rack/slot location of the CPU module.
Rack 0 3 2 4 Slot 4 4 9 2 Hex Word Value 0004H 0304H 0209H 0402H

TASK: For the PACSystems Ethernet module, Task must be set to zero. For the PACSystems CPU embedded Ethernet interface, Task must be set to the value 65536 (10000H) to address the CPUs Ethernet daughterboard.

Caution
Entering an incorrect TASK value may cause the Ethernet Interface to fail.

FT Output: The FT output is set if the PLC CPU (rather than the Ethernet Interface) detects that the COMMREQ fails. In this case, the other status indicators are not updated for this COMMREQ.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-7

6 The COMMREQ Command Block: General Description

When the COMMREQ function is initiated, the Command Block is sent from the PLC CPU to the Ethernet Interface. The Command Block contains the details of a Channel command to be performed by the Interface. The address in CPU memory of the Command Block is specified by the IN input of the COMMREQ Function Block. It can be any valid address within a word-oriented area of memory (%R, %AI, %AQ, %P, %L, or %W). The Command Block is set up using an appropriate programming instruction, such as a BLOCK MOVE or DATA INIT COMM). The Command Block has the following structure: Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Words 7 and up Data Block Length (words) WAIT/NOWAIT Flag COMMREQ status word Memory Type COMMREQ status word Address Offset Reserved Reserved Data Block (Channel Command Details)

(Word 1) Data Block Length: This is the length in words of the Data Block portion of the Command Block. The Data Block portion starts at Word 7 of the Command Block. The length is measured from the beginning of the Data Block at Word 7, not from the beginning of the Command Block. The correct value for each command, and the associated length of each command, is specified in the next section. (Word 2) WAIT/NOWAIT Flag: Must be set to zero for TCP/IP Ethernet Communications.

6-8

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

6
COMMREQ Status Word: The Ethernet Interface updates the COMMREQ status word to show success or failure of the command. Command words 3 and 4 specify the PLC memory location of the COMMREQ status word. (COMMREQ Status Word values are described in chapter 9.) (Word 3) COMMREQ Status Word Memory Type: This word specifies the memory type for the COMMREQ status word. The memory types are listed in the table below:
Type %R %AI %AQ %I %Q %T %M %G Value (Decimal) 8 10 12 16 70 18 72 20 74 22 76 56 86 Value (Hex.) 08H 0AH 0CH 10H 46H 12H 48H 14H 4AH 16H 4CH 38H 56H Description Register memory (word mode) Analog input memory (word mode) Analog output memory (word mode) Discrete input memory (byte mode) Discrete input memory (bit mode) Discrete output memory (byte mode) Discrete output memory (bit mode) Discrete temporary memory (byte mode) Discrete temporary memory (bit mode) Discrete momentary internal memory (byte mode) Discrete momentary internal memory (bit mode) Discrete global data table (byte mode) Discrete global data table (bit mode)

%W

196

C4H

Word memory (word mode; limited to %W1%W65536)

(Word 4) COMMREQ Status Word Address Offset: This word contains the offset within the memory type selected. The status word address offset is a zero-based number. For example, if you want %R1 as the location of the COMMREQ status word, you must specify a zero for the offset. The offset for %R100 would be 99 decimal. Note, however, that this is the only zero-based field in the Channel commands. (When using %W memory, the maximum offset value that can be entered is 65535, signifying %W65536.) (Word 5): Reserved. Set to zero. (Word 6): Reserved. Set to zero. (Words 7 and up) Data Block: The Data Block defines the Channel command to be performed.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-9

Establish Read Channel (2003)

The Establish Read Channel command requests that a channel be associated with a remote PLC and that data from the remote PLC be transferred (periodically) to the local PLC. The Command Block specifies the period, the number of reads from the server (remote PLC) to perform, and the timeout allowed in waiting for each transfer to complete. The first read is performed immediately, regardless of the period specified.

Example Command Block

Establish a channel (Channel 5) to a remote PLC at IP address 10.0.0.1. Return the COMMREQ Status word to %R10. Read remote PLC registers %R50%R57 to local PLC registers %R100%R107. Repeat the read 10 times, once every 7 seconds, with a timeout of 500 ms for each read.
Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Word 15 Word 16 Word 17 Word 18 Word 19 Word 20 Word 21 Word 22 Word 23 Word 2427 Word 2831 Dec 00017 00000 00008 00009 00000 00000 02003 00005 00010 00003 00007 00050 00008 00100 00008 00050 00008 00001 00004 00010 00000 00000 00001 (Hex) (0011) (0000) (0008) (0009) (0000) (0000) (07D3) (0005) (000A) (0003) (0007) (0032) (0008) (0064) (0008) (0032) (0008) (0001) (0004) (000A) (0000) (0000) (0001) Length of Channel command Data Block (1725 words) Always 0 (no-wait mode request) Memory type of COMMREQ status word (%R) COMMREQ status word address minus 1 (%R10)* Reserved Reserved Establish Read Channel command number Channel number (5) Number of read repetitions (read 10 times) Time unit for read period (3=seconds) Number of time units for read period (every 7 seconds) Timeout for each read (500 ms) Local PLC - Memory type at which to store data (%R) Local PLC - Starting address at which to store data (%R100) Remote PLC - Memory type from which to read data (%R) Remote PLC - Starting address from which to read data (%R50) Remote PLC - Number of memory units (8 registers) Remote PLC - Network Address type (IP Address) Remote PLC - Network Address length in words (4) Remote PLC - Register 1 of IP address (10) Remote PLC - Register 2 of IP address (0) Remote PLC - Register 3 of IP address (0) Remote PLC - Register 4 of IP address (1) Remote PLC - Program Name (needed for access to remote %P or %L) (zero-terminated and padded) Remote PLC - Program Block (needed for access to remote %L) (zero-terminated and padded)

The term local PLC is used here to identify the client PLCthe PLC that initiates the communications request. The term remote PLC is used here to identify the server PLCthe PLC that responds to the communications request.

* Word 4 (COMMREQ status word address) is the only zero-based address in the Command Block. Only this value requires subtracting 1 from the intended address. (Word 7) Channel Command Number: Word 7 requests that a read channel be set up. If the command is processed successfully, it will result in attempting the specified number of transfers from the server to the client.
6-10 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

6
(Word 8) Channel Number: Word 8 specifies the channel to be used for the read. This value must be in the range of 132. If the channel number is out of range, a command error indication will be placed in the COMMREQ Status word. If the channel number is the same as a channel already in use, the channel will be retasked to perform this new command. (Word 9) Number of Read Repetitions: Word 9 specifies the number of reads to be performed before automatically completing the communications request and closing the channel. If this value is set to 1, only a single read will be issued. If this value is set to 0, reads will be issued continuously on the requested period until the channel is aborted. (Word 10) Time Unit for Read Period: Words 1011 together define how often the read is to be performed (read period). Word 10 specifies the time unit such as seconds or minutes for the read period. Word 11 specifies the number of those units. The choices for the time units are shown below.
Value 1 2 3 4 5 Meaning hundredths of seconds tenths of seconds seconds minutes hours (10 ms) (100 ms)

Note: If Time Unit Value is 5 (hours), then the maximum usable value of Number of Time Units is 5965. (Word 11) Number of Time Units for Read Period: Word 11 specifies the number of time units for the read period. The read period is in effect even when the Channel command is setup to issue a single read. Example Read Period Calculation: If Word 10 contains a value of 3 specifying seconds as the time unit and Word 11 contains a value of 20, then the read period is 20 seconds. A Channel command set up to issue a single read can have only one pending read transfer. A read will normally be issued at the start of each read period. If the pending read transfer has not completed during the read period, the Channel Error bit and Detailed Channel Status words will be set to indicate a non-fatal period error. The pending transfer can still complete after the period error occurs. For Channel commands set up to issue multiple reads, the next read transfer will be issued only after the pending read transfer completes. If the Number of Time Units is zero, a subsequent transfer will be issued as soon as the previous transfer completes. In this case, no period errors can occur. (Word 12) Timeout for Each Read: Word 12 specifies the time (in hundredths of a second) the Ethernet Interface will wait for a read transfer to complete before setting the Channel Error bit and Detailed Channel Status words to indicate a non-fatal timeout error. The transfer can still complete even after a timeout occurs. As a result, an application can choose what to do if one occurs. If the timeout value is specified as zero, no timeout errors will be reported.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-11

6
For most applications a timeout is not needed because the read period acts as a timeout. (Word 12 should be zero for no timeout). However, there are two circumstances in which specifying a timeout is recommended: When the number of time units (Word 11) is zero, so that a subsequent transfer will be issued as soon as the previous transfer completes and no period errors are reported. In this case a timeout value can be specified so that timeout errors will be reported by the Channel Error bit. When the read period is very long (minutes or hours). In this case a shorter timeout value can be specified so the application doesnt have to wait for the read period to expire before taking action. (Word 13) Local PLC - Memory Type: Words 1314 specify the location in the local PLC where the Ethernet Interface will store data received from the remote PLC. Valid values for Word 13 are listed below. The amount of data to be transferred is specified by the number of memory units of the data read from the remote PLC (Word 17).
Type %L* %P* %W
%R %AI %AQ %I %Q %T %M %SA %SB %SC %S %G

Value (Decimal) 0 4 196

8 10 12 16 70 18 72 20 74 22 76 24 78 26 80 28 82 30 84 56 86

Description
Program Block Local register memory (word mode)

Program register memory (word mode) Word memory (word mode; max address %W65535)
Register memory (word mode) Analog input memory (word mode) Analog output memory (word mode) Discrete input memory (byte mode) Discrete input memory (bit mode) Discrete output memory (byte mode) Discrete output memory (bit mode) Discrete temporary memory (byte mode) Discrete temporary memory (bit mode) Discrete momentary internal memory (byte mode) Discrete momentary internal memory (bit mode) Discrete system memory group A (byte mode) Discrete system memory group A (bit mode) Discrete system memory group B (byte mode) Discrete system memory group B (bit mode) Discrete system memory group C (byte mode) Discrete system memory group C (bit mode) Discrete system memory (byte mode) Discrete system memory (bit mode) Discrete global data table (byte mode) Discrete global data table (bit mode)

Read-only memory, cannot be written to. Can only be accessed in the Remote PLC %W memory is supported by PACSystems clients and servers only.

(Word 14) Local PLC - Memory Starting Address: Word 14 determines the starting address in the local PLC in which the data from the remote PLC is to be stored. The value entered is the offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 13. This offset will be either in bits, bytes, or words depending on the
6-12 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

6
mode specified (for example, if Word 13=16 and Word 14=2, then the starting address will be %I9). Valid ranges of values depend on the PLCs memory ranges. The user is responsible for assuring that this area is large enough to contain the requested data without overwriting other application data. (Word 15) Remote PLC - Memory Type: Words 1516 specify the memory type and starting address in the remote PLC from which the data is to be read. Valid values for Word 15 are listed above. If %P memory is used, you must specify a Program name in Words 2427. If %L memory is used, you must specify a Program name in Words 24 27 and a Program Block name in Words 2831. (Word 16) Remote PLC - Memory Starting Address: Word 16 determines the starting address in the remote PLC from which the data is to be read. The value entered is the offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 15. This offset will be either in bits, bytes, or words depending on the mode specified (for example, if Word 15=16 and Word 16=9, then the starting address will be %I65). Valid ranges of values depend on the remote PLCs memory ranges. (Word 17) Remote PLC - Number of Memory Units: Word 17 specifies the amount of data to be transferred. The value entered is the number of memory units to be transferred, where the size of a memory unit is a bit, byte, or word as specified in Word 15. For example, if Word 15=16 and Word 17=4, then 4 bytes (32 bits) of %I memory will be transferred. A maximum of 16384 bits, 2048 bytes, or 1024 words of data can be specified. (Word 18) Remote PLC - Network Address Type: Word 18 specifies the format of the remote PLC address. Word 18 must contain the value 1. This indicates a dotted-decimal IP address expressed using a separate register for each decimal digit. (Word 19) Remote PLC - Network Address Length: Word 19 specifies the length in words of the remote PLC IP address. Word 19 must contain 4. (Words 20 23) Remote PLC - IP Address: Words 2023 specify the four integers, one integer per word, of the dotted-decimal IP address of the remote PLC to be accessed. (Words 2427) Remote PLC - Program Name: Words 2427 specify the case-sensitive, zero-terminated and padded program name (also called task name, which can be found through the PROG Station Manager command on the server Ethernet Interface) to be used with access to remote %P or %L memory. These words are required only for access to such memory and will be ignored if the Memory Type field is not %P or %L. See Note below. (Words 2831) Remote PLC - Program Block Name: Words 2831 specify the case-sensitive, zero-terminated and padded program block name (which can be found in the program block declaration in the server ladder program) to be used with access to remote %L memory. These words are required only for access to such memory and will be ignored if the Memory Type field is not %P or %L. Note: The Program Name (Words 2427) and Program Block Name (Words 2831) must have each pair of ASCII characters reversed within the PLC memory. For example, the name MARY (M = 4DH, A = 41H, R = 52H, Y = 59H) would have 414DH in the first word and 5952H in the second word.
GFK-2224C Chapter 6 Programming SRTP Channel Commands 6-13

Establish Write Channel (2004)

The Establish Write Channel command requests that a channel be connected to a remote PLC and that data from the local PLC be transferred (periodically) to the remote PLC. The Command Block specifies the period, the number of writes to the server (remote PLC) to perform, and the timeout allowed in waiting for each transfer to complete. The first write is performed immediately, regardless of the period specified.

Example Command Block

Establish a write channel (Channel 6) to a remote PLC at IP address 10.0.0.1. Return the COMMREQ Status word to %R10. Write local PLC registers %R50%R57 to remote PLC registers %R100%R107. Repeat the write indefinitely, once every 7 seconds, with a timeout of 500 ms for each write.
Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Word 15 Word 16 Word 17 Word 18 Word 19 Word 20 Word 21 Word 22 Word 23 Word 2427 Word 2831 Dec 00017 00000 00008 00009 00000 00000 02004 00006 00000 00003 00007 00050 00008 00050 00008 00100 00008 00001 00004 00010 00000 00000 00001 (Hex) (0011) (0000) (0008) (0009) (0000) (0000) (07D4) (0006) (0000) (0003) (0007) (0032) (0008) (0032) (0008) (0064) (0008) (0001) (0004) (000A) (0000) (0000) (0001) Length of Channel command Data Block (1725 words) Always 0 (no-wait mode request) Memory type of COMMREQ status word (%R) COMMREQ status word address minus 1 (%R10) * Reserved Reserved Establish Write Channel command number Channel number (6) Number of write repetitions (write indefinitely) Time unit for write period (3=seconds) Number of time units for write period (every 7 seconds) Timeout for each write (500 ms) Local PLC - Memory type from which to write data (%R) Local PLC - Starting address from which to write data (%R50) Remote PLC - Memory type at which to store data (%R) Remote PLC - Starting address at which to store data (%R100) Remote PLC - Number of memory units (8 registers) Remote PLC - Network Address type (IP address) Remote PLC - Network Address length in words (4) Remote PLC - Register 1 of IP address (10) Remote PLC - Register 2 of IP address (0) Remote PLC - Register 3 of IP address (0) Remote PLC - Register 4 of IP address (1) Remote PLC - Program Name (needed for access to remote %P or %L) (zero-terminated and padded) Remote PLC - Program Block (needed for access to remote %L) (zero-terminated and padded)

The term local PLC is used here to identify the client PLCthe PLC that initiates the communications request. The term remote PLC is used here to identify the server PLCthe PLC that responds to the communications request.

* Word 4 (COMMREQ status word address) is the only zero-based address in the Command Block. Only this value requires subtracting 1 from the intended address. (Word 7) Channel Command Number: Word 7 requests that a write channel be set up. If the command is processed successfully, it will result in attempting the specified number of transfers from the client to the server.
6-14 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

6
(Word 8) Channel Number: Word 8 specifies the channel to be used for the write. This value must be in the range of 132. If the channel number is out of range, a command error indication will be placed in the COMMREQ Status word. If the channel number is the same as a channel already in use, the channel will be re-tasked to perform this new command. (Word 9) Number of Write Repetitions: Word 9 specifies the number of writes to be performed before automatically completing the communications request and closing the channel. If this value is set to 1, only a single write will be issued. If this value is set to 0, writes will be issued on the requested period until the channel is aborted. (Word 10) Time Units for Write Period: Words 1011 together define how often the write is to be performed (write period). Word 10 specifies the time unit such as seconds or minutes for the write period. Word 11 specifies the number of those units. The choices for the time units are: Value 1 2 3 4 5 Meaning hundredths of seconds tenths of seconds seconds minutes hours (10 ms) (100 ms)

(Word 11) Number of Time Units for Write Period: Word 11 specifies the number of time units for the write period. The write period is in effect even when the Channel command is setup to issue a single write. Example Write Period Calculation: If Word 10 contains a value of 3 specifying seconds as the time unit and Word 11 contains a value of 20, then the write period is 20 seconds. A Channel command set up to issue a single write can have only one pending write transfer. A write will normally be issued at the start of each write period. If the pending write transfer has not completed during the write period, the Channel Error bit and Detailed Channel Status words will be set to indicate a non-fatal period error. The pending transfer can still complete after the period error occurs. For Channel commands set up to issue multiple writes, the next write transfer will be issued only after the pending write transfer completes. If the Number of Time Units is zero, a subsequent transfer will be issued as soon as the previous transfer completes. In this case, no period errors are reported by the Channel Error bit. (Word 12) Timeout for Each Write: Word 12 specifies the time (in hundredths of a second) the Ethernet Interface will wait for a write transfer to complete before setting the Channel Error bit and Detailed Channel Status bits to indicate a non-fatal timeout error. The transfer can still complete even after a timeout occurs. As a result, an application can choose what to do if one occurs. If the timeout value is specified as zero, no timeout errors will be reported.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-15

6
For most applications a timeout is not needed because the write period acts as a timeout. (Word 12 should be zero for no timeout.) However, there are two special circumstances in which specifying a timeout is recommended: When the number of time units (Word 11) is zero, so that a subsequent transfer will be issued as soon as the previous transfer completes and no period errors are reported. In this case a timeout value can be specified so that timeout errors will be reported by the Channel Error bit. When the write period is very long (minutes or hours). In this case a shorter timeout value can be specified so the application doesnt have to wait for the write period to expire before taking action. (Word 13) Local PLC - Memory Type: Words 1314 specify the location in the local PLC where the Ethernet Interface will get the data to be written to the remote PLC. Valid values for Word 13 are listed in the description of Establish Read Channel. The amount of data to be transferred is specified by the number of memory units of the data written to the remote PLC (Word 17). (Word 14) Local PLC - Memory Starting Address: Word 14 determines the starting address in the local PLC from which the data is to be written. The value entered is the offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 13. This offset will be in bits, bytes, or words depending on the mode specified (for example, if Word 13=16 and Word 14=2, then the starting address will be %I9). Valid ranges of values depend on the PLCs memory ranges. (Word 15) Remote PLC - Memory Type: Words 1516 specify the memory type and starting address in the remote PLC where the data is to be written. Valid values for Word 15 are listed under Establish Read Channel. If %P memory is used, you must specify a Program name in Words 2427. If %L memory is used, you must specify a Program name in Words 2427 and a Program Block name in Words 2831. (Word 16) Remote PLC - Memory Starting Address: Word 16 determines the starting address in the remote PLC where the data is to be written. The value entered is the offset (1based) from the beginning of PLC memory for the memory type and mode specified in Word 15. This offset will be either in bits, bytes, or words depending on the mode specified (for example, if Word 15=16 and Word 16=9, then the starting address will be %I65). Valid ranges of values depend on the remote PLCs memory ranges. (Word 17) Remote PLC - Number of Memory Units: Word 17 specifies the amount of data to be transferred. The value entered is the number of memory units to be transferred, where the size of a memory unit is either a bit, byte, or word as specified in Word 15. For example, if Word 15=16 and Word 17=4, then 4 bytes (32 bits) of %I memory will be transferred. The user is responsible for assuring that this area is large enough to contain the requested data without overwriting other application data. A maximum of 16384 bits, 2048 bytes, or 1024 words of data can be specified.
6-16 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

6
(Word 18) Remote PLC - Network Address Type: Word 18 specifies the format of the remote PLC address. Word 18 must contain the value 1, indicates a dotted-decimal IP address expressed using a separate register for each decimal digit. (Word 19) Remote PLC - Network Address Length: Word 19 specifies the length in words of the remote PLC IP address. Word 19 must contain 4. (Words 2023) Remote PLC - IP Address: Words 2023 specify the four integers, one integer per word, of the dotted-decimal IP address of the remote PLC to be accessed. (Words 2427) Remote PLC - Program Name: Words 2427 specify the case-sensitive, zero-terminated and padded program name (also called task name, which can be found through the PROG Station Manager command on the server Ethernet Interface) to be used with access to remote %P or %L memory. These words are required only for access to such memory and will be ignored if the Memory Type field is not %P or %L. (Words 2831) Remote PLC - Program Block Name: Words 2831 specify the casesensitive, zero-terminated and padded program block name (which can be found in the program block declaration in the server ladder program) to be used with access to remote %L memory. These words are required only for access to such memory and will be ignored if the Memory Type field is not %P or %L. The Program Name (Words 2427) and Program Block Name (Words 2831) must have each pair of ASCII characters reversed within the PLC memory. For example, the name MARY (M = 4DH, A = 41H, R = 52H, Y = 59H) would have 414DH in the first word and 5952H in the second word.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-17

Send Information Report (2010)

The Send Information Report COMMREQ requests that a particular block of memory within the PLC CPU reference tables be transferred periodically from an Ethernet Interface to a host application SRTP server. The Command Block specifies the repetition period, the number of transfers to the server to perform, and the timeout allowed in waiting for each transfer to complete. The first send is performed immediately, regardless of the period specified.

Example Command Block

Establish a channel (Channel 7) to a remote Host application server at IP address 10.0.0.1. Return the COMMREQ Status word to %R10. Send local PLC registers %R50%R57 to remote host. Repeat the send 10 times, once every 7 seconds, with a timeout of 500ms for each transfer.
Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Word 9 Word 10 Word 11 Word 12 Word 13 Word 14 Word 15 Word 16 Word 17 Word 18 Word 19 Word 20 Word 21 Word 22 Word 23 Dec 00017 00000 00008 00009 00000 00000 02010 00007 00010 00003 00007 00050 00008 00050 00008 00000 00000 00001 00004 00010 00000 00000 00001 (Hex) (0011) (0000) (0008) (0009) (0000) (0000) (07DA) (0007) (000A) (0003) (0007) (0032) (0008) (0032) (0008) (0000) (0000) (0001) (0004) (000A) (0000) (0000) (0001) Length of Send Information Report Data Block (17 words) Always 0 (nowait mode request) Memory type of COMMREQ status word (%R) COMMREQ status word address minus 1 (%R10)* Reserved Reserved Send Information Report Channel command number Channel number (7) Number of repetitions (send 10 times) Time unit for send period (3=seconds) Minimum interval between host accesses (every 7 seconds) Timeout on each individual transfer response (500 ms) Local PLC - Memory type from which to send data (%R) Local PLC - Starting address from which to send data (%R50) Local PLC - Number of memory units (8 registers) Reserved Reserved Remote Network Address type (IP Address) Remote Network Address length in words (4) Remote Host - Register 1 of IP address (10) Remote Host - Register 2 of IP address (0) Remote Host - Register 3 of IP address (0) Remote Host - Register 4 of IP address (1)

The term local PLC is used here to identify the client PLCthe PLC that initiates the communications request. The term SRTP Server is used here to identify the Host server.

* Word 4 (COMMREQ status word address) is the only zero-based address in the Command Block. Only this value requires subtracting 1 from the intended address.

(Word 7) Channel Command Number: Word 7 requests that a Send Information Report channel be set up. If the command is processed successfully, it will result in attempting the specified number of transfers from the client to the server.

6-18

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

6
(Word 8) Channel Number: Word 8 specifies the channel to be used for the send. This value must be in the range of 132. If the channel number is out of range, a command error indication is placed in the COMMREQ status word. If the channel number is the same as a channel already in use, the channel is re-tasked to perform this new command. (Word 9) Number of Send Repetitions: Word 9 specifies the number of transfers to be performed before automatically completing the communications request and closing the channel. If this value is set to 1, only a single transfer will be issued. If this value is set to 0, transfers will be issued on the requested period until the channel is aborted. (Word 10) Time Unit for Send Period: Words 10-11 together define how often the transfer is to be performed (transfer period). Word 10 specifies the time unit such as seconds or minutes for the send period. Word 11 specifies the number of those units. The choices for the time units are shown below.
Value
1 2 3 4 5

Meaning
hundredths of seconds (10 ms) tenths of seconds (100 ms) seconds minutes hours

(Word 11) Number of Time Units for Send Period: Word 11 specifies the number of time units for the send period. The send period is in effect even when the Channel command is set up to issue a single send. A Channel command set up to issue a single send can have only one pending send transfer. Example Send Period Calculation: If Word 10 contains a value of 3 specifying seconds as the time unit and Word 11 contains a value of 20, the send period is 20 seconds. A send is normally issued at the start of each send period. If the pending transfer has not completed during the send period, the Channel Error bit and Detailed Channel Status words are set to indicate a non-fatal period error. The pending transfer can still complete after the period error occurs. For Channel commands set up to issue multiple sends, the next transfer is issued only after the pending transfer completes. If the Number of Time Units is zero, a subsequent transfer is issued as soon as the previous transfer completes. In this case, no period errors are reported by the Channel Error bit. (Word 12) Timeout for Each Send: Word 12 specifies the time (in hundredths of a second) the Ethernet Interface will wait for a send transfer to complete before setting the Channel Error bit and Detailed Channel Status bits to indicate a non-fatal timeout error. The transfer can still complete even after a timeout occurs. As a result, an application can choose what to do if one occurs. If the timeout value is specified as zero, no timeout errors will be reported.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-19

6
For most applications a timeout is not needed because the send period acts as a timeout. (Word 12 should be zero for no timeout.) However, there are two circumstances where a timeout is recommended:

If number of time units (Word 11) is zero, so that a subsequent transfer is issued as soon as the previous transfer completes and no period errors are reported. In this case a timeout value can be specified so that timeout errors will be reported by the Channel Error bit. If the send period is very long (minutes or hours). In this case a shorter timeout value can be specified so the application doesnt have to wait for the send period to expire before taking action.

(Word 13) Local PLC - Memory Type: Words 1314 specify the location in the local PLC where the Ethernet Interface will get the data to be written to the remote SRTP server. Valid values for Word 13 are listed for Establish Read Channel. (Word 14) Local PLC - Memory Starting Address: Word 14 determines the starting address in the local PLC from which the data is to be sent. The value entered is the offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 13. This offset can be in bits, bytes, or words depending on the mode specified (for example, if Word 13=16 and Word 14=2, the starting address will be %I9). Valid ranges of values depend on the PLCs memory ranges. (Word 15) Local PLC - Number of Memory Units: Word 15 specifies the amount of data to be transferred. The value entered is the number of memory units to be transferred, where the size of a memory unit is a bit, byte, or word as specified in Word 13. For example, if Word 13=16 and Word 15=4, then 4 bytes (32 bits) of %I memory will be transferred. A maximum of 16384 bits, 2048 bytes, or 1024 words of data can be specified. (Word 16) Reserved: Word 16 is reserved and should contain the value zero. (Word 17) Reserved: Word 17 is reserved and should contain the value zero. (Word 18) Remote Host - Network Address Type: Word 18 specifies the format of the remote hosts address. Word 18 must contain the value 1, which indicates a dotted-decimal IP address expressed using a separate register for each decimal digit. (Word 19) Remote Host - Network Address Length: Word 19 specifies the length in words of the remote hosts IP address. Word 19 must contain 4. (Words 2023) Remote Host - IP Address: Words 2023 specify the four integers, one integer per word, of the dotted-decimal IP address of the remote host to be accessed.

6-20

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Abort Channel (2001)

The Abort Channel command immediately disconnects an active channel from its remote PLC, and closes the channel. The Channel Transfer bit, the Channel Error bit, and the Detailed Channel Status words for the channel are set to zero.

Example Command Block

Abort Channel 5. Return the COMMREQ Status word to %R10.
Word 1 Word 2 Word 3 Word 4 Word 5 Word 6 Word 7 Word 8 Dec 00002 00000 00008 00009 00000 00000 02001 00005 (Hex) (0002) (0000) (0008) (0009) (0000) (0000) (07D1) (0005) Length of Channel command Data Block (2 words) Always 0 (no-wait mode request) Memory type of COMMREQ status word (%R) COMMREQ status word address minus 1 (%R10) (0-based) Reserved Reserved Abort Channel command number Channel number 5

(Word 7) Channel Command Number: This command parameter requests that a channel be aborted. If the command is processed successfully, it terminates processing on the channel by the time success is indicated in the COMMREQ status word. (Word 8) Channel Number: The channel number specifies the channel to be disconnected (132 ). As a convenient way to abort all channels, if the channel number parameter is 1 (FFFFH), all channels in use are aborted. It is not an error to abort all channels if there are none in use. Neither is it an error to abort an idle channel. Note: For the Abort Channel and Retrieve Detailed Channel Status commands, no actual data is transmitted on the network. Communication occurs between the client PLC CPU and the local Ethernet Interface only. For these commands, the actual function is performed locally within the Ethernet Interface and then the COMMREQ Status word is sent immediately to the CPU.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-21

Retrieve Detailed Channel Status (2002)

The Retrieve Detailed Channel Status command requests that the current Detailed Channel Status words are returned for a channel. The Detailed Channel Status words contain an active/inactive channel indicator and the last channel error codes seen. These two words of detailed status supplement the information available in the COMMREQ Status word and the Channel Status bits. The command has no effect on the value of the Channel Status bits. The Detailed Channel Status words are updated every time the status of the channel changes. If the channel is operating with a fast repetition period, the status words may change faster than the ladder executes the COMMREQ to retrieve them. If that happens, some status values could be missed by the application program.

Example Command Block

Retrieve detailed channel status for Channel 5. Store the Detailed Channel Status words to Registers %R100%R101. Return the COMMREQ status word to %R10.
Word 1 Word 2 Word 3 Word 4 Word 5 The term local PLC is Word 6 used here to identify the Word 7 client PLCthe PLC Word 8 that initiates the Word 9 communications Word 10 Dec 00004 00000 00008 00009 00000 00000 02002 00005 00008 00100 (Hex) (0004) (0000) (0008) (0009) (0000) (0000) (07D2) (0005) (0008) (0064) Length of Channel command Data Block (4 words) Always 0 (no-wait mode request) Memory Type of COMMREQ status word (%R) COMMREQ status word address minus 1 (%R10)* Reserved Reserved Retrieve Detailed Channel Status Command number Channel number 5 Local PLC - Memory type to store Detailed Chan. Stat. (%R) Local PLC - Starting address (%R100)

request.

* Word 4 (COMMREQ status word address) is the only zero-based address in the Command Block. Only this value requires subtracting 1 from the intended address.

(Word 7) Channel Command Number: The command parameter in Word 7 requests that Detailed Channel Status words be returned. The Detailed Channel Status words are written to the location specified in Words 9 and 10. The COMMREQ status word indicates successful completion of the command. If the specified channel is not currently in use, the latest status is returned.

6-22

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

6
(Word 8) Channel Number: The channel number in Word 8 specifies the channel (1 32) whose status is to be read. (Word 9) Local PLC - Memory Type: Words 9 and 10 specify the starting point in the client CPU memory where the Detailed Channel Status words are to be written. The length of the transfer is always 2 words. (Word 10) Local PLC - Memory Starting Address: Word 10 determines the starting address to store the Detailed Channel Status data. The value entered is the offset (1-based) from the beginning of PLC memory for the memory type and mode specified in Word 9. This offset is in bits, bytes, or words depending on the mode specified (for example, if Word 9=16 and Word 10=2, then the starting address will be %I9). Valid ranges of values depend on the PLCs memory ranges. Make sure this area can contain the 2 words of data without overwriting other application data. Note: For the Abort Channel and Retrieve Detailed Channel Status commands, no actual data is transmitted on the network. Communication occurs between the client PLC CPU and the local Ethernet Interface only. For these commands, known as local commands, the actual function is performed locally within the Ethernet Interface and then the COMMREQ Status word is sent immediately to the CPU.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-23

Monitoring the Detailed Channel Status Words

The Detailed Channel Status words (DCS words) are returned from the Ethernet Interface to the CPU in response to a Retrieve Detailed Channel Status command from the application program. The first two Detailed Channel Status bytes report status and errors in the same format as the COMMREQ Status word. See the list of error codes in chapter 9. The second word of the DCS words indicates when the channel is active. If a channel error is indicated (by the Channel Error bit) after the channel is established, the first word of the DCS words contains an error code indicating the cause of the error. The second word of the DCS words indicates whether the channel is active or idle. The Detailed Channel Status words are updated in the Ethernet Interface every time the status of the channel changes. If the channel is operating with a fast repetition period, the status words may change faster than the ladder executes the COMMREQ to retrieve them. Therefore, some status values may be missed by the program logic. The DCS words location is specified in the Retrieve Detailed Channel Status Command. The contents of these status words are defined below. The initial value of the Detailed Channel Status words is all zeros. DCS words are reset to zero when:

The Ethernet Interface is powered up or restarted The CPU transitions from STOP to RUN A channel abort COMMREQ aborts the channel

Format of the Detailed Channel Status Words (DCS Words)

Display the DCS status words in hexadecimal form to differentiate the high and low bytes.
DCS Word in Hex Format Word 2 Word 1 High Low 0000 Channel Active (0001 = channel active, 0000 = channel not active) Minor Error Codes (high byte) Success and Major Error Codes (low byte) 00 00

6-24

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Programming for Channel Commands

The COMMREQ function for a Channel command must be initiated by a one-shot. That will prevent the COMMREQ from being executed each CPU scan, which would overrun the capability of the Ethernet Interface and possibly require a manual restart. Checking certain status bits before initiating a COMMREQ function is also important. In particular, the LAN Interface OK bit should be used as an interlock to prevent execution of the COMMREQ when the Ethernet Interface is not operational. After initiating a COMMREQ on a channel, no further COMMREQs should be issued to that channel until a non-zero COMMREQ status word has been returned to the program from the Ethernet Interface. Every ladder program should do the following before initiating a COMMREQ function. 1. Initiate the COMMREQ function with a one-shot. This prevents sending the same COMMREQ Command Block more than once. 2. Include at least the LAN Interface OK bit in the LAN Interface Status Word as an interlock contact for the COMMREQ function. 3. Zero the word location you specify for the COMMREQ status word and FT Outputs of the COMMREQ function block before the COMMREQ function is initiated. 4. Move the command code and parameters for the Channel command into the memory location specified in the IN input of the COMMREQ Function Block before the COMMREQ function is initiated. An example ladder program segment on the next page illustrates these points.

COMMREQ Example
In the example logic that follows, the input values for the Block Move Functions are taken from the Establish Read Channel (2003) command Example 1 in this chapter. Nicknames are used in this example to make the ladder program easier to follow. LANIFOK is bit 16 of the LAN Interface Status bits. All other nicknames can be assigned as needed.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-25

6-26

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

6
Rung # 1: Input LANIFOK (bit 16 of the LAN Interface Status bits) monitors the health of the Ethernet Interface. If it is OK to send a COMMREQ, the LAN_OK coil is ON. LAN_OK is used as an interlock for Rungs 36. Rung # 2: Input BEGREAD triggers READREQ, which enables execution of the MOVE and COMMREQ functions. READREQ is a one-shot (Positive Transition) coil, activating once when BEGREAD transitions from OFF to ON. Rung # 3: The MOVE WORD function moves a zero to the COMMREQ status word referenced in the Command Block (see rung #4). This clears the COMMREQ status word. This rung also resets the FT output coil of the COMMREQ Function Block in rung #6. It is vital that the COMMREQ status word be cleared and the COMMREQ fault output coil be cleared each time before initiating a COMMREQ function. Rungs # 45: The BLKMV INT functions set up the COMMREQ Command Block contents. When these rungs are activated, the constant operands are moved into the memory beginning at the address indicated in the instruction. The constant operands in this example are defined in the Establish Read Channel Example in this chapter. Rung # 6: The COMMREQ Function Block.

The IN field points to the starting location of the Command Block parameters (%R00301 in this example). The SYSID field of the COMMREQ function block defines the rack and slot of the Ethernet Interface to receive the command data. This is a hexadecimal word value that gives the rack (high byte) and slot (low byte) location of the Ethernet Interface module. In the example ladder diagram shown, the first three number places (from left to right) are zeros and are not displayed; only the last number, 4, appears. This indicates rack 0, slot 4. The TASK field of the COMMREQ function block indicates which mailbox task ID to use for the specified rack and slot. This value should always be 21 decimal (0015H). The FT output (energizes the FAULT coil in this example) is turned ON (set to 1) if there were problems preventing the delivery of the Command Block to the Ethernet Interface. In this case, the other status indicators are not updated for this COMMREQ

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-27

Sequencing Communications Requests

If the Ethernet Interface receives Command Blocks from the PLC CPU faster than the Interface can process them, the Interface will log an exception event 08, Entry 2=0024H and will log the PLC Fault Table entry: Backplane Communications with PLC Fault; Lost Request Only one COMMREQ function per channel can be pending at one time. A COMMREQ function is pending from the time it is initiated in the ladder program until its COMMREQ status word has been updated to a non-zero value by the Ethernet Interface. If the PLC CPU attempts to send COMMREQs to the Ethernet interface faster than the Ethernet interface can receive them, the FT output of the COMMREQ function block will be set and the CPU will generate the following entry in the PLC Fault Table: Mailbox queue full Comm_req aborted The PLC logic program should send retry the COMMREQ after a short delay.

Managing Channels and TCP Connections

In Certain Conditions TCP Connections Can Be Totally Consumed

When you issue a COMMREQ to establish a read or write channel, a TCP connection is created, the transfer(s) are made, then upon completion of all the transfers, the TCP connection is terminated. It takes time to create and to terminate these connections. If an application is constructed so that it rapidly and repeatedly establishes a channel with only one repetition (one transfer), the available TCP connections for the Ethernet Interface may be totally consumed. A snapshot of the state of the TCP connections would show some of them being created, some being terminated, and some active, but none available. If the logic for issuing COMMREQs is constructed so it does the following, all available TCP connections can quickly be used up:

The number of repetitions (Word 9 in an Establish Read or Write Channel COMMREQ) is set to 1, and A new COMMREQ is issued repeatedly and immediately upon completion of the prior one.

6-28

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

6 Use Channel Re-Tasking To Avoid Using Up TCP Connections

TCP connections can be used up if each successive COMMREQ is directed to the same target device (same IP address). In this case, it is better to establish a channel with the target device once, leave it active, then re-task the channel, even if data transfers take place infrequently. This method will use only one TCP connection. An additional advantage of re-tasking is that the time and network traffic required to create a channel and its associated TCP connection are not incurred each time a data transfer is required. The disadvantages to re-tasking are:

While the TCP connection is open, it is unavailable to the rest of your application, and The active TCP connection uses up network bandwidth because the active TCP connection generates a small amount of ongoing periodic network traffic.

How To Re-Task a Channel

1. For Establish Read/Write Channel Commands, set the number of repetitions (COMMREQ Word 9) to 2 and set the read/write period (COMMREQ Words 10 and 11) to be longer than the expected time between transfers. For example, if you expect to transfer data about once per minute, set the read/write period to about two minutes. This will cause a TCP connection to be created and held open for two minutes. 2. Set up the ladder program to: A. Issue the first COMMREQ and wait for the first transfer to complete, which will be indicated when the COMMREQ Status (CRS) word is changed to 1. B. Then before the read/write period expires (at which time the second and final transfer is sent and the TCP connection is dropped), issue the next COMMREQ with the same parameters as specified in step 1. This will re-task the channel to use the existing TCP connection instead of opening a new one, and will send another data transfer restarting the timer for the read/write period. Repeat step 2B for each successive data transfer desired.

GFK-2224C

Chapter 6 Programming SRTP Channel Commands

6-29

Client Channels TCP Resource Management

There is a period of time that the OS Network stack hangs on to the TCP resources associated with a connection after it is closed. It applies to the initiator of the close, which is almost always the client side. This time is referred to as the TCP Linger Period. Once the TCP Linger Period expires (60 seconds in the current OS implementation), the TCP resources are released. Application developers using client channels need to be aware of this behavior when designing their logic. There are a finite number of TCP resources allocated to client channels, and if channel connections are brought up and down so fast that these resources are depleted, then the application may have to wait until a TCP resource frees up in order to establish another client channel (a COMMREQ Status of 0xA890 is returned if no TCP resources are currently available; application should wait and retry again). SRTP Client Channels provides features that help the user preserve TCP connections. These include a period time where one can establish an SRTP Channel and specify the channel to run at a given interval, or run as fast a possible. One can also specify a number of iterations, or run forever. Additionally, SRTP Channels allows channel re-tasking of an active channel to the same remote device, where the parameters of an active channel, such as changing the channel command type (Read/Write), number of repetitions, time periods, local memory address, remote memory address, etc. can be changed. SRTP Channels also allows channel re-tasking of an active channel to a different remote device (changing the remote devices IP address, etc.). However, re-tasking to a different remote device will neither conserve TCP connections, nor save on the time it takes to create a channel.

SRTP Application Timeouts

The application timeouts within SRTP Channels also include the time needed to establish and maintain the underlying network and SRTP connection. Examples are establishing the TCP connection for a new channel, establishing communication with the remote device, and TCP retransmissions during Channel operations. If the time needed for TCP connection establishment or maintenance exceeds the user-specified channel application timeout values, an application timeout will occur. Channel application timeouts are temporary errors; the channel continues to run when the expected response is received. If the application is seeing timeouts during channel startup, there are a few different options: 1. Increase timeout value to account for Channel connection overhead 2. Ignore the timeout error on the first transfer 3. Use a two-step setup approach where the first COMMREQ has a timeout large enough to account for the connection overhead and then Re-Task the channel to the normal operating timeouts.

6-30

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Monitoring Channel Status

The COMMREQ Status word is returned from the Ethernet Interface to the PLC CPU immediately if the Command Block contains a syntax error or if the command is local. For remote commands with no syntax error, it is returned either after the channel is established successfully and the first transfer has completed or if there is an error establishing the channel. The location of the COMMREQ status word is defined in the Command Block for the COMMREQ function.

Format of the COMMREQ Status Word

COMMREQ Status Word Hex Format High Low 00 00

Minor Error Codes (high byte) Success and Major Error Codes (low byte)

It is critical to monitor the COMMREQ status word for each COMMREQ function. Zero the associated COMMREQ status word before executing the COMMREQ function. When the COMMREQ status word becomes non-zero, the Ethernet Interface has updated it. If after executing a COMMREQ function, the COMMREQ status word is zero (0) and the FT Output is OFF, the Command Block has been sent to the Ethernet Interface, but no status has been returned. If this condition persists, check the PLC Fault Table for information. If the COMMREQ status word is updated to 1, the Command Block was processed successfully by the Ethernet Interface. If the COMMREQ status word is updated to a value other than 1, an error has occurred in processing the Command Block. The cause may be:

Errors in the Command Block (the Channel command code or parameters), or For an establish command (Establish Read Channel, Establish Write Channel, or Send Information Report), the command parameters were valid but there was an error in establishing a channel.

Chapter 9 lists the Major and Minor error codes that may be returned in the COMMREQ status words. Do not use data received from a server until the COMMREQ status word for that channel is 1 or the Data Transfer bit goes to 1.
GFK-2224C Chapter 6 Programming SRTP Channel Commands 6-31

Differences between Series 90 and PACSystems SRTP Channels

This section lists differences between the Series 90 implementation of SRTP Channels and the PACSystems implementation. 1. The TCP Connect Timeout for an SRTP Channel on the Series 90 was 90 seconds. For PACSystems, a new SRTP AUP parameter, SRTP Channel TCP Connect Timeout, will be added that specifies the amount of time to wait for a TCP connection to be established: hconn_tout. The default value will be set to 75 seconds, and its maximum value is 75 seconds, which is the maximum value we can specify to the current OS. Minimum value is 10 milliseconds. 2. PACSystems has a TCP Linger Period, which is the period of time the OS Network stack hangs onto the TCP resources associated with a connection after it is closed. The TCP resources from a channel that was stopped will become available again after the 60 second TCP linger period has expired. The Series 90 had no linger period. 3. The Series 90 SRTP Channel implementation performed a normal stopping of the channel on a Run-to-Stop transition. On PACSystems, a Run-to-Stop transition causes an Abrupt Shutdown, avoiding the TCP Linger period and reducing the chance of exhausting TCP resources when quickly transitioning between Run->Stop and Stop>Run. 4. On the Series 90, if an Abort/Abort All Channel COMMREQ is issued, followed by an Establish Read/Write/Send Info Report Channel COMMREQ before the COMMREQ Status Word for the Abort/Abort All has been updated, the Establish Read/Write/Send Information Report was dropped and the COMMREQ Status Word was not updated (it remained zero). For PACSystems, the Establish Read/Write/Send Information Report COMMREQ is discarded and its COMMREQ Status Word is set to a failure value (A990). That indicates it was discarded because the application logic issued the command while an Abort was in progress. 5. For PACSystems, new COMMREQ Status Codes are defined. See chapter 8 for details. 6. The PACSystems implementation supports Re-tasking to a different remote device (different IP Address). 7. The Series 90-70 limited the total number of TCP connections shared between SRTP Client Channels and SRTP Server to 48. TCP connections will no longer be shared between SRTP Server and Client, and the maximum TCP Connections allowed will be increased as follows: a. Allow a maximum of 48 Server TCP connections b. Allow a maximum of 32 Client Channel TCP connections

6-32

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter Modbus TCP

7
This section describes the implementation of the Modbus/TCP Server feature for the PACSystems family of products.

Modbus TCP Server Reference Mapping Modbus Function Codes

GFK-2224C

7-1

Modbus TCP Server

The PACSystems products listed below support Modbus/TCP Server functionality:

CPU010 and CPU020 with primary firmware version 3.0 or later. CRE020 with Ethernet firmware version 3.0 [cmhe1]or later. RX7i: IC698ETM001 and RX3i IC695ETM001 with firmware version 3.0 or later.

Modbus TCP Server Connections

The Modbus TCP Server supports up to 16 simultaneous connections. These connections are not shared with any other applications. Other TCP-based application protocols such as SRTP Server use a different set of TCP connections.

Modbus Conformance Classes

PACSystems Modbus TCP Server supports Modbus Conformance classes 0, 1, and 2. The RX3i Ethernet module has been certified by the Modbus/TCP Conformance Test Laboratory to be in conformance with Conformance Test Policy Version 2.1.

Server Protocol Services

The Modbus/TCP Server responds to incoming Request Connection, Terminate Connection and Request Service messages. The client with which the server is interacting should wait for the servers response before issuing the next Request Service, otherwise requests could be lost. There is no inactivity timeout in the server. If a client opens a connection, that connection stays open until the client terminates the connection or until the connection is terminated for some other reason.

Station Manager Support

The Modbus/TCP Server supports the standard Station Manager commands: STAT, TALLY, and TRACE, plus the Modbus/TCP server-specific KILLMS command. The Modbus/TCP Server task letter is o.

7-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Reference Mapping
The Modbus protocols reference table definition is different from the internal structure of the PACSystems reference tables. Modbus refers to Holding Register, Input Register, Input Discrete and Coil tables; PACSystems uses Discrete Input (%I), Discrete Output (%Q), Analog Input (%AI), Register (%R),and Word (%W) reference tables for Modbus data. The following table shows how each Modbus table has been mapped to the PACSystems reference tables.

Modbus Reference Tables

Modbus File Access (6xxxx) Modbus Holding Register Table (4xxxx) Modbus Input Register Table (3xxxx) Modbus Input Discrete Table (1xxxx) Modbus Coil Table (0xxxx) PACSystems Reference Tables

--------F1,R1 F525,R2880 (16-bit words)

------1 32640 (16-bit words) ---

--1 32640 (16-bit words) -------

1 32768 (bits) ---------

----1 32768 (bits) -----

%I1 32768 (bits) %AI1 32640 (16-bit words) %Q1 32768 (bits) %R1 32640 (16-bit words) %W1 5,242,880 (16-bit words)

Modbus Holding Register TableThe Modbus Holding Register table is mapped exclusively to the CPU Register (%R) table. Applicable Functions

Read Multiple Registers Write Multiple Registers Write Single Register Mask Write Register Read/Write Multiple Registers

Modbus Input Register Table

The Modbus Input Register table is mapped exclusively to the CPU Analog Input (%AI) table. Applicable Functions Read Input Registers

GFK-2224C

Chapter 7 Modbus TCP

7-3

7
Modbus Input Discrete Table
The Modbus Input Discrete table is mapped exclusively to the CPU Discrete Input (%I) table. Applicable Functions Read Input Discretes

Modbus Coil Table

The Modbus Coil table is mapped exclusively to the CPU Discrete Output (%Q) table. Applicable Functions Read Coils Write Coils Write Single Coil

Modbus File Access Table

The Modbus File Access table is mapped exclusively to PACSystems %W memory. Applicable Functions Read File Record Write File Record Translating %W Reference Addresses To find the PACSystems %W memory address equivalent of a Modbus File and Record: %W = 10,000 (F-1) + R To find the Modbus File and Record equivalent of a PACSystems %W memory address:
File = W-1 +1 10,000
(Discard any fractional portion; round the result downward to the next integer value).

Record = W (10,000 (F 1))

CAUTION
If you use the Modbus function Write File Record, and specify multiple record sections, the first N-1 sections will be written to the servers PLC reference memory, even if an error prevents the writing of the last section.

7-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

7 Address Configuration
Address mapping is done in the Machine Edition Hardware Configuration of the CPU. All Ethernet modules and daughterboards in the PLC use Modbus-to-PLC address mapping based on this one map. The Modbus TCP Server does not use COMMREQs to configure address mapping. Each PLC memory area is mapped to an appropriate Modbus address space. On the Settings tab, Modbus Address Space Mapping can be set to Standard Modbus Addressing or Disabled. If Modbus Address Space Mapping is set to Standard, the Modbus TCP Address Map tab displays the standard references assignments.
Number 1 2 3 4 5 Modbus Register 0xxxx Coil Table 1xxxx Discrete Table 3xxxx Input Registers 4xxxx Register Table 6yxxx Internal Table Start Address 1 1 1 1 0 End Address 32768 32768 64 1024 0 PLC Memory Address %Q00001 %I00001 %AI00001 %R00001 %W0001 Length 32768 32768 64 1024 0

When Modbus Address Space Mapping is set to Disabled on the Settings tab, the Modbus TCP Address Map tab does not appear. If the CPU module does not receive an address map from Machine Edition, Ethernet interfaces within the PLC will respond to Modbus TCP clients with Exception Code 4, Slave Device Failure. This same exception code will also be returned when the PLCs hardware configuration is cleared.

GFK-2224C

Chapter 7 Modbus TCP

7-5

Modbus Function Codes

This section summarizes the mapping of PACSystems reference tables to Modbus addresses by the Modbus function codes supported by the Modbus/TCP Server. The mapping shown in this table assumes that the PLC is configured to use its default reference table sizes.
Modbus Function Code Table 1 5 15 2 3 6 16 22 23 4 7 8 20 21 Read Coils Write Single Coil Write Multiple Coils Read Discrete Inputs Read Holding Registers Write Single Register Write Multiple Registers Mask Write Register Read/Write Multiple Registers Read Input Registers Read Exception Status Diagnostics Read File Record Write File Record Modbus Start Address Length PLC Start Address Length

0xxxx 1xxxx

1 1

32768 32768

%Q00001 %I00001

32768 32768

4xxxx

1024

%R00001

1024

3xxxx n/a 6yxxxx

1 n/a 1

64 n/a 0

%AI00001 n/a %W00001

64 n/a 0

7-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter Network Administration

8
This chapter discusses how devices are identified on the network and how data is routed among devices. The main topics covered are:

IP Addressing Gateways Subnets

GFK-2224C

8-1

IP Addressing
Each TCP/IP node on a network must have a unique IP address. The TCP/IP Ethernet Interface is such a node, as is a PC running TCP/IP. There may be other nodes on the network that are not involved with communications to the PLCs, but no matter what their function, each TCP/IP node must have its own IP address. It is the IP address that identifies each node on the IP network (or system of connected networks). The term host is often used to identify a node on a network.

IP Address Format for Network Classes A, B, C

The IP address is 32 bits long and has a netid part and a hostid part. Each network is a Class A, Class B or Class C network. The class of a network determines how an IP address is formatted and is based on the number of bits in the netid part of the IP address.

01 Class A 0 01 Class B 1 0 01 2 Class C 1 1 0 netid

16 hostid

24

31

8 netid 8 netid

16

24 hostid

31

16

24 hostid

31

In general, the netid part is assigned by the Internet authorities and the hostid part is assigned by your local network administrator. The class of network determines the number of hosts that can be supported. A Class A network can support 224-2 (16,777,214) hosts, Class B, 216-2 (65,534) hosts, and Class C, 28-2 (254) hosts. The minus 2 refers to host numbers reserved for the network itself and the local broadcast. Each node on the same physical network must have an IP address of the same class and must have the same netid. Each node on the same physical network must have a different hostid thus giving it a unique IP address. IP addresses are written in dotted-decimal format as four decimal integers (0-255) separated by periods where each integer gives the value of one byte of the IP address. For example, the 32-bit IP address: 00001010 00000000 00000000 00000001 is written as 10.0.0.1
8-2 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

8
One can determine the class of an IP address by examining the first integer in its dotteddecimal IP address and comparing with the range of values in the following table.
Range of first integer 0 126 127 128 - 191 192 - 223 224-239 240 - 255 Class A Loopback B C D (Reserved for Multicast Use) E (Reserved for Experimental Use)

IP Addresses Reserved for Private Networks

RFC 1918 reserves IP addresses in the following ranges to be used for private networks. 10.0.0.0 10.255.255.255 172.16.0.0 172.31.255.255 192.168.0.0 192.168.255.255 (Class A) (Class B) (Class C)

Multicast IP Addresses
Multicast IP Addresses are used in multicasting, a technique that allows delivery of a single packet of data to multiple nodes on the network. Any node that joins a Multicast group will respond to the Multicast IP address assigned to that group. Subsequently, any data sent to that Multicast IP address may be received by all nodes which are members of that Multicast group. Multicast (Class D) IP addresses (224.0.0.0 through 239.255.255.255) are reserved by the Internet authorities for multicasting. Multicasting is a feature of Ethernet Global Data. For more information on the use of multicasting in Ethernet Global Data, see chapter 4.

Loopback IP Addresses
Class A IP Addresses in the 127.xxx.xxx.xxx range are reserved for loopback addressing. A network packet using a loopback destination address is not actually transmitted on the network, but instead is processed by the same device as if it were received from the network. PACSystems Ethernet interfaces recognize only the IP address 127.0.0.1 as a loopback address. All other addresses in the range 127.0.0.2 127.255.255.255 are ignored and do not provide loopback operation.

GFK-2224C

Chapter 8 Network Administration

8-3

Gateways
Gateways (also known as routers) connect individual physical networks into a system of networks. When a node needs to communicate with a node on another physical network, a gateway transfers the data between the two networks.

Networks Connected by a Gateway

The following example shows Gateway G connecting Network 1 with Network 2.
A
172.16.0.1 Network 1 172.16.0.2

G Gateway B
172.17.0.1

C
172.17.0.2 Network 2

172.17.0.3

When host B with IP address 172.17.0.1 communicates with host C, it knows from Cs IP address that C is on the same network. In an Ethernet environment, B can then resolve Cs IP address to a MAC address (via ARP) and communicate with C directly. When host B communicates with host A, it knows from As IP address that A is on another network (the netids are different). In order to send data to A, B must have the IP address of the gateway connecting the two networks. In this example, the gateways IP address on Network 2 is 172.17.0.3. This address would be configured in the Ethernet Interfaces module configuration for PLC B as its default gateway address. Note that the gateway has two IP addresses (172.16.0.2 and 172.17.0.3). The first must be used by hosts on Network 1 and the second must be used by hosts on Network 2. To be usable, a hosts gateway must be addressed using an IP address with a netid matching its own.

8-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Subnets
Subnets allow a sites network administrators to divide a large network into several smaller networks while still presenting the overall network as one single entity to the outside world. Each of the sites interior gateways need only maintain the subnet numbers of other interior gateways instead of every single host on the entire network.

Subnet Addressing and Subnet Masks

Subnet addressing is an extension of the IP address scheme that allows a site to use a single netid for multiple physical networks. Routing outside the site continues as usual by dividing the IP address into a netid and a hostid via the class. The standard format for the netid bits and hostid bits for an IP address in a Class B network is shown below.

10000000 00000011 00000000 00000001 netid bits (binary) hostid bits

Inside a site the subnet mask is used to re-divide the IP address into a custom netid portion and hostid portion. Consider adding another physical network to Network 2 (a Class B network) in the previous example. The result is shown in the figure below. Selecting the subnet mask shown below would add two additional netid bits allowing for four physical networks addressed as 0, 64, 128, and 192. The added subnet bits are normally taken from the hostid bits adjacent to the netid and the subnet mask identifies these bits.

11111111 11111111 11000000 00000000 = 255.255.192.0 netid bits hostid bits (binary) subnet mask (dotted decimal)

The bits in the subnet mask correspond one to one with the Internet address. The bits in the mask that are 1 treat the corresponding bits in the IP address as part of the netid bits. The bits in the mask that are 0 treat the corresponding bits as part of the hostid bits. In effect, two bits of the Class B hostid have been used to extend the netid, creating an extended netid, or subnetid. Each unique combination of bits in the part of the hostid where subnet mask bits are 1 specifies a different physical network.

GFK-2224C

Chapter 8 Network Administration

8-5

Example: Network Divided into Two Subnets

The new network configuration dividing Network 2 into Subnets 2.1 and 2.2 is shown below.

A
172.16.0.1 Network 1

172.16.0.2

B
172.17.64.1

C
172.17.64.2 (Sub)Network 2.1

G1 Gateway
172.17.64.3

172.17.64.4

D
172.17.128.1

E
172.17.128.2 (Sub)Network 2.2

G2 Gateway
172.17.128.3

Here, a second network with Hosts D and E has been added. Gateway G2 connects Subnet 2.1 with Subnet 2.2. Hosts D and E will use Gateway G2 to communicate with hosts not on Network 2.2. Hosts B and C will use Gateways G1 and G2 to communicate with hosts not on Network 2.1. When B is communicating with D, G2 (the configured Gateway for B) will route the data from B to D through Gateway G2. Host A will use Gateway G1 to communicate with hosts not on Network 1.

8-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter RX7i PLC Monitoring Via the Web

The PACSystems RX7i embedded CPU Ethernet Interface provides PLC data monitoring using a standard Web browser. Rack-based Ethernet modules do not support web server operation. You can use the Web server to monitor the following PLC data:

PLC reference tables. This data is a snapshot of the PLC Reference Tables when the data is displayed in the Browser and is not updated until you request another display. All reference tables are supported. PLC and IO Fault Tables.

The web server cannot be used to modify PLC data (acknowledge alarms, set/force values in tables). The maximum number of web server connections that can be configured for the Ethernet Interface is 16. If the system includes FTP server connections, fewer web server connections are available, as explained in chapter 3.

System Requirements
Web monitoring requires version 4.0 or later of Netscape Navigator or Internet Explorer. The browser must be capable of running the Java Virtual Machine (JVM) version 1.3 plug-in. The supported host operating systems are Windows NT 4.0 SP5 or SP6, Windows 95B, Windows 98 (First Edition Service Pack 1, Second Edition), and Windows 2000 Professional SP1, Windows Millennium Edition, Windows XP and Windows CE 3.0. To view the entire Reference Table page, the screen resolution must be 1024 x 768 or higher. Local web firewall blocking issues will be avoided by using HTTP protocol on port 80 to transfer standard HTML files including JavaScript and Java applets from the server to the browser and HTTP Post command to transfer form information from the browser to the server.

GFK-2224C

9-1

WEB Server Operation in a Redundant System

In a redundant system, only the active unit processes Web Server requests at the Redundant IP address and responds to web page requests. The backup unit does not respond to the Redundant IP address. When the active Ethernet interface changes to backup, it takes down all Web Server connections and their underlying TCP connections. The Web Server maintains its underlying TCP connection only long enough to process each web page request; a new TCP connection is opened, used, and closed for each subsequent web page display or update. Unless a web page change or update is requested during a redundancy switch, the operation of the Redundant IP address is transparent to the Web browser. Any web page request in process over the Redundant IP when a role switch occurs is ended. Although both the active and backup units respond to Web server requests received at the direct IP address, having a remote (host) browser issue Web Server requests to the direct IP address is not recommended. Remote web browsers should use the Redundant IP address when communicating to a Redundant System.

Standard Web Pages

The CPU Ethernet Interface is shipped with a set of standard PLC web pages already installed. These standard web pages include a PLC home page, a Reference Table display page, a PLC Fault Table display page, and an IO Fault Table display page. When necessary, new or revised web page files may be transferred into the Ethernet Interface via the standard FTP protocol, as described later.

9-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

RX7i Home Page

The RX7i home page is displayed after entering the PLC CPUs URL or IP address at your web browser. From the PLC home page, you may navigate to the other PLC web pages.

Factory Default Web Page

If the PLC home page file (index.htm) is not present in the Ethernet Interface file system, the web server instead displays the factory default web page.

The default web page is displayed in English, French, German and Spanish if the browser is configured to use Western European encoding.

GFK-2224C

Chapter 9 RX7i PLC Monitoring Via the Web

9-3

Reference Tables Viewer Page

The Reference Table s Viewer page shows the current states of a range of data references. This data is a snapshot of the PLC Reference Tables when the data was initially requested. It is NOT updated until you refresh the display. All RX7i reference tables are available.

9-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

9 Selecting Reference Table Data

Initially, the previously-viewed reference table is displayed. To change the display, you can: Select Reference Table Data Row-by-Row: The right column of each row contains the configuration options for that row. For each row, select the reference table, starting address, and data format. You can select the %R, %AI, %AQ, %I, %Q, %M, %T, %G, %S, %SA, %SB, %SC, %P, %L, or %W reference table. For %P and %L memory types, specify the logic program name, and for %L memory, the subroutine block name. The logic program and subroutine block names must be reentered when defining other rows. To select the data format, click on a reference table address cell above the reference value and select the display format type. For example:

To format a row, click the Format button for the entire row. Use the drop down box to select the data format for the selected reference address or row. With Internet Explorer, pressing the OK button changes the format immediately. With Netscape, the format changes after you refresh the screen.

Saving Reference Table Settings

You can save up to 10 previously formatted reference table views on the computer being used to view the data. To save the current reference table settings, go to the section at the bottom of the page labeled Save Current Table Settings To:. From the drop-down box, select a number to assign to these settings. Optionally, enter a description of the table settings by typing into the text box labeled Enter Description. Click on the Save button to save the reference table settings to the computer.

GFK-2224C

Chapter 9 RX7i PLC Monitoring Via the Web

9-5

Display Formats
Binary: uses 1s and 0s to represent the bits in a byte or word of data. If a discrete bit is overridden for the %I, %Q, %M or %G tables, the bit is underlined. +-Dec: signed decimal for one word of data. Valid range is 32768 to +32767. Dec: unsigned decimal for one word of data. Valid range is 0 to 65535. Hex: a four digit hexadecimal value for one word of data. The value has 16# as a prefix (for example 16#4241).Valid range is 16#0000 to 16#FFFF. ASCII: ASCII representation of two 8-bit values. For example, a hex value of 16#4142 appears as A B. ASCII display requires Internet Explorer 4.0 or Netscape 4.7 or later. +-DblDecimal: signed decimal for a double word (32 bits). Valid range is -2,147,483,648 to +2,147,483,647. This format is only available for word type memory (%R, %AI, % AQ, %P, %L, and %W). DblDecimal: unsigned decimal for a double word (32 bits). Valid range is 0 to 4,294,967,295. This format is only available for word type memory (%R, %AI, %AQ, %P, %L, and %W). Real: 7 decimal digits plus a decimal point and exponent if necessary (for example 123.4567, 1.234567e+038). This format uses 2 words or 32 bits. This format is only available for word type memory (%R, %AI, %AQ, %P, %L, and %W). The range is +-1.401298e-045 to +-3.402823e+038. Blank: The associated cell or row will have no value or reference address header.

9-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

PLC Fault Table Viewer Page

The PLC Fault Table Viewer displays the contents of the PLC fault table.

The PLC name is shown at the top of the page, together with the PLC timestamp showing when the page was accessed or refreshed. The PLC fault table provides up to 16 entries arranged from newest to oldest. If there are fewer than 16 entries, the remaining rows are blank. If there are more than 16 faults, the table displays the most recent faults in the first 8 rows and the oldest faults in the last 8 rows. To change the format of the fault extra data, select the appropriate checkbox at the top of the page. To refresh the fault data, click the Refresh PLC Fault Table button.

GFK-2224C

Chapter 9 RX7i PLC Monitoring Via the Web

9-7

9
When using Internet Explorer, the fault extra data can be viewed by using the mouse to highlight a particular fault and then clicking on the fault. This is shown below:

The fault extra data can be displayed in byte, word or ASCII format depending on which button is selected at the top of the screen. These selections affect the display of all fault extra data. If an error code does not have a string associated with it, the Fault Description field is blank.

9-8

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

9
To view the fault extra data for all faults, select the Show All checkbox as shown below:

For Netscape, first check the Show All checkbox and press the Refresh PLC Fault Table button. This will show the fault extra data for all faults. Netscape cannot show fault extra data for selected faults. To hide the fault extra data, uncheck the Show All checkbox and again press the Refresh PLC Fault Table button.

GFK-2224C

Chapter 9 RX7i PLC Monitoring Via the Web

9-9

I/O Fault Table Viewer Page

The IO Fault Table web viewer page displays the contents of the I/O Fault Table:

The fault extra data can be shown or hidden by clicking on a fault. The fault extra data for all faults in the table can be displayed by selecting the checkbox at the top of the page labeled Fault Extra Data. To change the format of the fault extra data, select the appropriate checkbox at the top of the page. To refresh the fault data, click the Refresh I/O Fault Table button.

9-10

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Downloading PLC Web Pages

To add new or revised web page files or support files, you will need to transfer the appropriate files to the Ethernet Interface via FTP. Once the new web files have been obtained, they are copied into the local computer from which the FTP utility will be run. A general procedure for transferring web files via Windows FTP is described below. (You may also use a commercial FTP program.)

FTP Connect and Login

You can either use a commercial FTP tool or use the ftp command on the DOS Prompt or Command line (Note: Not all FTP tools will be guaranteed to work since the server only supports a limited set of FTP commands). From the Windows DOS box command line interface, enter ftp followed by the URL or IP address of the PLC as shown below: ftp <URL or IP address of the Ethernet Interface> You will then be prompted for a login name and password as shown below. The default FTP password is system. login: user password: system The FTP server in the PLC Ethernet interface does not support multiple levels of login (there are no distinct anon or user logins). Once successfully logged on, your can execute any of the FTP commands described below; this login is required in order to store web page files to the Ethernet Interface.

GFK-2224C

Chapter 9 RX7i PLC Monitoring Via the Web

9-11

Changing the Password

The default FTP password is system. You can change the FTP password via a parameter in the AUP file, which is stored to the PLC via the programmer, or by using the Station Manager.

Changing the Password from the Advanced User Parameters File

The following line should be added to the AUP file to change the FTP password (for example, to my_ftp_pw): tpassword = my_ftp_pw

Changing the Password from the Station Manager

In addition, you can change the FTP password (for example to my_ftp_pw) using the following Station Manager command: = CHPARM tpassword my_ftp_pw

The FTP password can be up to 10 characters long and uses the same character set listed for the reference viewer password described later in this document. These passwords are not case sensitive. Arguments for Station Manager CHPARM command must be enclosed in double quotes to preserve the capitalization of the argument. However since these passwords are case insensitive, the double quotes are not required. Note: The CHPARM command is not available if the PLC has received a valid configuration from the Programmer.

9-12

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

9 Web Page File Transfer

After logging into the PLCs FTP server, web page files can be copied from the PC to the PLC through the following steps: 1. Set the FTP file transfer type to binary by typing in binary 2. For each file, change to the desired directory if appropriate by typing cd ./subdirectory. Then transfer the file using the put command by typing: put filename.htm 3. Verify all files are properly transferred by typing in: dir or ls. This returns a list of the files located at the current directory on the PLC Ethernet Interface 4. Quit the FTP session by typing in quit or bye. If you copy a file that already exists in the module, the new file overwrites the existing file without warning. One of the files stored will be a fault string file that will be specific for each language supported. The PLC FTP server also supports the following standard FTP commands:

get command - allows the user to transfer files from the PLC web server to their local PC (for example get filename1.htm). delete command allows user to delete web pages from the server (for example delete filename1.htm).

GFK-2224C

Chapter 9 RX7i PLC Monitoring Via the Web

9-13

Viewing the RX7i PLC Web Pages

Each web browser (HTTP) instance (i.e., each browse window) requires at least two TCP connection and each FTP session requires two TCP connections to the PLC. The maximum number of web browser connections and FTP connections at the Ethernet interface at any one time are separately configurable from 0 to 16 (a value of 0 means that the web server or FTP capability is disabled). The total number of configured web browser connections plus FTP connections is limited to 16 connections; once the number of browser/FTP connections reaches the configurable limit, any new browser or FTP connection requests will fail. The number of Web Server and FTP connections is configurable via the Programmer. The Programmer configuration details are described in the Programmer Help utility. When the PLC is unconfigured, the user can change the number of web server (HTTP) connections and FTP connections with the following Station Manager commands, respectively: CHSOSW CHSOSW web_max_conn ftp_max_conn <number from 0-16> <number from 0-16>

As noted in the Ethernet Configuration section, the sum of web server connections plus FTP connections must not exceed 16 connections. For example: = CHSOSW = CHSOSW web_max_conn 6 ftp_max_conn 4

Note: The CHSOSW commands are not available if the PLC has received a valid configuration from the Programmer.

9-14

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Chapter Diagnostics

10
This chapter describes diagnostic techniques for a PACSystems Ethernet Interface. Diagnostic Tools Available for Troubleshooting States of the Ethernet Interface EOK Blink Codes for Hardware Failures PLC Fault Table Monitoring the Ethernet Interface Status Bits Monitoring the FT Output of the COMMREQ Function Block Monitoring the COMMREQ Status Word Troubleshooting Common Ethernet Difficulties Using the EGD Management Tool

GFK-2224C

10-1

10

What to do if you Cannot Solve the Problem

If you cannot solve the problem, contact GE Fanuc Automation. Please have the following information ready: The Name and Catalog Number marked on the product. PLC CPU version number from CME Status screen Ethernet Interface CPU Embedded or standalone

Description of symptoms of problem. Depending on the problem, you may also be asked for the following information: The ladder logic application program and the PLC sweep time at the time the problem occurred. A listing of the configuration parameters for the Ethernet Interface that failed. A description of the network configuration. This should include the number of PLCs and host computers accessing the network, the type of network cable used (e.g. twisted pair, fiber optic, etc.), length of network cable, and the number and manufacturer of transceivers, hubs, and network switches used. Description on ALL Ethernet communication activity for the PLC. Versions of all software doing Ethernet communication to the PLC. This includes CIMPLICITY PE, ME, IFIX, etc. Be prepared to provide the PLC Fault Table showing Fault Extra Data Be prepared to provide Station Manager Log showing Ethernet Events

10-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10

Diagnostic Tools Available for Troubleshooting

There are several tools to assist you in diagnosing problems with the Ethernet Interface and the network. Use the Ethernet Interface LEDs to troubleshoot a problem on power-up of the Ethernet Interface and for an immediate visual summary of the operational state of the Interface. Use the PLC Fault Table to troubleshoot a problem once the Interface is running. It provides a record of exceptions logged by the PLC, the Ethernet Interface, and other I/O and communications modules. The PLC Fault Table is accessed through the PLC programming software or a web browser (for a CPU with embedded Ethernet Interface). For PLC Fault Table entries generated by the Ethernet Interface, the Detailed Fault Data for that entry contains the same data as the corresponding event in the Ethernet Interfaces exception log. Refer to GFK-2225, TCP/IP Ethernet Communications for the PACSystems Station Manager Manual, for information on how to interpret Ethernet exception log events. Use the Ethernet Status Data to troubleshoot the Ethernet Interface status For Ethernet Global Data operation, the EGD Management Tool can be used to check online operation of the EGD network. For Ethernet Global Data operation, Exchange Status words can be used to troubleshoot exchange operations. Use the Station Manager to troubleshoot a problem with the Ethernet Interface, the network, PLC backplane communication, or with your application. The LOG, TALLY, EXS, XCHANGE and STAT Station Manager commands are especially useful. The LOG command provides a complete record of exceptions occurring with the network and Interface. The TALLY command provides statistics about operation and performance of the network and Interface. The EXS command provides information about COMMREQs. The CHANNEL command displays detailed information about a specified SRTP communication channel. The STAT H command provides the current status on the operation of SRTP communication channels on the Interface. The XCHANGE command displays detailed information about a specified Ethernet Global Data exchange. The STAT G command provides the current status on the operation of EGD communications on the Interface.

Refer to GFK-2225, PACSystems TCP/IP Ethernet Communications Station Manager Manual, for information on how to access and use the Station Manager software.

GFK-2224C

Chapter 10 Diagnostics

10-3

10

States of the Ethernet Interface

1
Ethernet Interface Initializing 1 (approx. 2-6 seconds)
The Ethernet Interface is initialized by Powering up the PLC Storing a new configuration to the PLC with changes for the Ethernet Interface Pressing the Restart pushbutton Issuing a Station Manager RESTART command Internal System Error occurring when Interface is operational

Diagnostics Pass? Yes Load Request or Software Corrupted? No

No

A
Hardware Failure

2
Yes 2

B
Software Load

Software Load caused by Pressing the Restart pushbutton Detection of corrupt software Waiting for IP Address caused by Not configuring Interface using configuration software Configuring Interface with IP Address = 0.0.0.0 New CPU with no configuration CPU failure to communication with Interface

Waiting for Configuration from PLC CPU

(max. 5 min.,10 sec.)

Continue to Operational State caused by IP Address received over network

Symbols The LEDs are labeled from top to bottom as follows: EOK LAN STAT The symbols used for the LEDs in the chart are: OFF ON

Done IP address = 0.0.0.0 No Yes 3

D
/ /
Waiting for IP Address

IP Address 4 Received

Slow Blink; multiple slow blinking LEDS blink in unison Fast Blink

/ / /

E E Operational

Traffic (blinks when there is traffic on the line. The process symbols use in this chart are: Temporary condition; requires no intervention Decision point during powerup

Operational Full support for client and server capability Uses user-defined Advanced Parameters

Interface State; normally the Interface remains in a state unless there is user intervention.

10-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10
LED Pattern EOK (OFF) LAN (OFF) STAT (OFF) A Hardware Failure Where Stopped Possible Cause Fatal Hardware Error. Corrective Actions Make sure the PLC has power. Examine PLC Fault Table for clues. Recheck PLC Programmer configuration. Power off baseplate, inspect the Interface for loose components, reseat the module, and Restart. If the problem persists, replace the PLC hardware. EOK (Slow blink) LAN (Slow blink) STAT (Slow blink) All LEDs blink in unison. EOK (Slow blink) LAN (OFF) STAT (OFF) Waiting for Configuration from PLC C Did not configure slot using the PLC Programmer. CPU not communicating with Ethernet Interface. (Condition can last a maximum of 5 minutes.) EOK Blinking error code LAN Off STAT Off EOK (Slow blink) LAN (ON/Traffic/OFF) STAT (Slow blink) EOK and STAT blink in unison. EOK (ON) LAN (ON/Traffic/OFF) STAT (ON/OFF) Operational E Waiting for IP Address D Unrecoverable hardware or runtime failure See the list of blink codes on the next page. Use the PLC Programmer configuration software to configure the Interface then store the configuration to the PLC CPU. Power cycle the PLC. Clear faults and Restart Interface. Software Loader B Software corrupt. Connect a PC Software Loader and load new software.

Interfaces IP Use the PLC Programmer to configure the address has not Interface with a non-zero IP address. been configured or Assign IP address over network has been configured as 0.0.0.0.

If the LAN LED is OFF, the problem may be network cable not connected If the STAT LED is OFF, an exception condition has occurred.

Connect cable. Examine PLC Fault Table to find out why the STAT LED is OFF.

In the RX7i, the Ethernet LEDs are labeled EOK, LAN, and STAT. In the RX3i, the Ethernet LEDs are labeled ETHERNET OK, LAN OK, and LOG EMPTY, respectively.

GFK-2224C

Chapter 10 Diagnostics

10-5

10

EOK LED Blink Codes for Hardware Failures

The EOK LED indicates whether the module is able to perform normal operation. This LED is on for normal operation and flashing for all other operations. If a hardware or unrecoverable runtime failure occurs, the EOK LED blinks a two-digit error code. The EOK LED first blinks to indicate the most significant error digit, then after a brief pause blinks again to indicate the least significant error digit. After a long pause the error code display repeats
Blink Code 0x12 0x13 0x14 0x21 0x22 0x23 0x24 Description Undefined or Unexpected Interrupt. Timer failure during power up diagnostics. DMA failure during power up diagnostics. RAM failure during power up diagnostics. Stack error during power up diagnostics. Shared Memory Interface error during power up diagnostics. Firmware CRC (cyclic redundancy check) error during power up or Factory Test* Run time exception No mail communication available during software load Serial EEPROM access exception Serial EEPROM reset exception Machine check exception Data store exception. Instruction store exception Alignment exception Program exception System call exception Unexpected IRQ exception Data cache TLB miss exception Instruction cache TLB miss exception BSP startup error Blink Code 0x42 0x51 0x52 0x61 0x62 0x63 0x64 Description Firmware Loader error Unexpected watchdog timer exception Unexpected debug exception Boot: Critical interrupt exception Boot: Machine check exception Boot: Data store exception Boot: Instruction store exception

0x25 0x26 0x27 0x28 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39 0x41

0x65 0x66 0x67 0x68 0x69 0x71 0x72 0x73 0x74 0x75 0x76 0x77 0x78

Boot: External interrupt exception Boot: Alignment exception Boot: Program exception Boot: System call exception Boot: PIT interrupt exception Boot: FIT interrupt exception Boot: WDT interrupt exception Boot: Data cache TLB miss exception Boot: Instruction cache TLB miss exception Boot: Debug exception Boot: Flash memory CRC error Boot: Unexpected ACFAIL interrupt Boot: Unexpected Restart pushbutton interrupt

*CRC error or software error during normal operation causes Ethernet restart

10-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10

PLC Fault Table

Most error conditions involving the Ethernet interface generate faults in the PLC Fault table. The table on the next two pages lists Ethernet interface faults and corrective actions. To access the details of a PLC Fault Table entry, double-click the Fault Table entry and the details are displayed as fault extra data. Refer to Online Help in the PLC programming software for more information. An example of the fault extra data is shown below:
160006000300050000000000000000000000000000000000

For Ethernet Interfaces the leftmost 14 digits of fault extra data (underlined in the example above) show the corresponding log Events (2 digits) and Entries 2, 3, and 4 (in that order, 4 digits each). The example above is reporting an Event 16, Entry 2=6, Entry 3=3, and Entry 4=5. This information can be used to refer directly to detailed fault descriptions included in the Exception Log Event tables in GFK-2225, TCP/IP Ethernet Communications for the PACSystems Station Manager Manual. (In that document, refer to Appendix B, Exception Log Events.)

GFK-2224C

Chapter 10 Diagnostics

10-7

10

PLC Fault Table Descriptions

PLC Fault User Action Backplane communications with PLC Check to make sure that the logic application is not sending COMMREQs faster fault; lost request than the Ethernet Interface can process them. Reduce the rate at which the application is sending COMMREQs to the Ethernet interface. If problem persists, contact GE Fanuc Automation. Bad local application request; discarded request Bad remote application request; discarded request Cant locate remote node; discarded request Comm_req - Bad task ID programmed Comm_req - Wait mode not allowed Configured gateway address bad; cant talk off local net Connection to remote node failed; resuming without it LAN controller fault; restart LAN I/F LAN controller Tx underflow; attempt recovery LAN controller under run/overrun; resuming Check for valid COMMREQ command code. If problem persists, contact GE Fanuc Automation. Try to validate the operation of the remote node. If problem persists, contact GE Fanuc Automation. Error reported when message received where IP/MAC address cannot be resolved. Error may indicate that remote host is not operational on the network. Check that remote host is operational on network and its addresses are correct. Message from PLC for unknown Ethernet Interface task. Check COMMREQ function block. Check COMMREQ to make sure sent in no-wait mode. Error in configuration. Verify that IP address, Subnetwork Mask, and default Gateway IP address are correct. Underlying communications software detects error transferring data; resuming. If persistent error, check connection to LAN and operation of remote node. HW fault, perform a power cycle. If problem persists, contact GE Fanuc Automation. Internal system error. If problem persists, contact GE Fanuc Automation. Internal system error. If problem persists, contact GE Fanuc Automation.

LAN data memory exhausted - check The Ethernet Interface does not have free memory to process communications. parameters; resuming If problem persists, contact GE Fanuc Automation. LAN duplicate MAC Address; resuming A frame was received in which the source MAC Address was the same as this stations MAC Address. All stations on a network must have a unique MAC address. Immediately isolate the offending station; it may be necessary to turn it off or disconnect it from the network. This station remains Online unless you intervene to take it Offline.

LAN I/F cant init - check parameters; Internal system error. If problem persists, contact GE Fanuc Automation. running soft Sw utl LAN I/F capacity exceeded; discarded request LAN interface hardware failure; switched off network Verify that connection limits are not being exceeded. Replace the Ethernet Interface.

10-8

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10
PLC Fault LAN network problem exists; performance degraded LAN severe network problem; attempting recovery LAN system-software fault; aborted connection resuming LAN system-software fault; restarted LAN I/F LAN system-software fault; resuming LAN transceiver fault; OFF network until fixed Local request to send was rejected; discarded request Memory backup fault; may lose configuration/log on restart Module software corrupted; requesting reload Module state doesnt permit Comm_Req; discarded User Action Excessive backlog of transmission requests due to excessive traffic on the network. For a sustained period the MAC was unable to send frames as quickly as requested. If problem persists, contact GE Fanuc Automation. External condition prevented transmission of frame in specified time. Could be busy network or network problem. Check transceiver to make sure it is securely attached to the network. Internal system error. If problem persists, contact GE Fanuc Automation. Internal system error. If problem persists, contact GE Fanuc Automation. Internal system error. If problem persists, contact GE Fanuc Automation. Transceiver or transceiver cable failed or became disconnected. Reattach the cable or replace the transceiver cable. Check SQE test switch if present on transceiver. Internal error. Check that the Ethernet Interface is online. If problem persists, contact GE Fanuc Automation. Internal error accessing non-volatile device. If problem persists, contact GE Fanuc Automation - NA. Replace Ethernet Interface. Catastrophic internal system error. Contact GE Fanuc Automation. COMMREQ received when Ethernet Interface cannot process COMMREQ. Make sure Ethernet Interface is configured and online. Error may occur if the logic application is sending COMMREQs faster than the Ethernet Interface can process them. Reduce the rate at which COMMREQs are sent. PLC firmware does not support Ethernet communications software or attempt has been made to configure a feature not supported by the Ethernet Interface. Check CPU and Ethernet Interface revisions, order upgrade kit for CPU and/or Ethernet Interface. A specified remote device does not exist on the network. Check that the remote device IP address is correct and that the remote device is functioning properly. The CPU is attempting to send COMMREQs faster than the Ethernet Interface can receive them. The PLC logic program should retry the COMMREQ after a short delay. If the condition persists, the logic application should be revised to reduce the rate at which it sends COMMREQs to the Ethernet Interface. The CPU is attempting to send mail messages faster than they can be retrieved by the Ethernet Interface; the messages are discarded. This can result in subsequent Backplane communications with PLC fault; lost request faults.

Unsupported feature in configuration

Cant locate remote node; discarded request Mailbox Queue full Comm_req aborted

Non-critical CPU software event

GFK-2224C

Chapter 10 Diagnostics

10-9

10

Monitoring the Ethernet Interface Status Bits

The Ethernet Interface status bits normally occupy a single block of memory. The memory location is specified during configuration of the Ethernet Interface. The status bits are updated in the CPU once each PLC scan by the Ethernet Interface. These bits are generally used to prevent initiation of a COMMREQ function when certain errors occur. The first 16 bits of the block are the LAN Interface Status (LIS) bits. The next 64 bits are the Channel Status bits (2 for each channel). Unless the LAN Interface OK bit is set (Status Bit 16), the other status bits are invalid. Status Bits 1 2 3 4 5 6 7-8 9 1012 13 14 15 16 17 18 ... 79 80 Port 1A full duplex Port 1A 100Mbps Port 1B full duplex Port 1B 100 Mbps Reserved Redundant IP address is active (RX7i only) Reserved Any Channel Error (error on any channel) Reserved LAN OK Resource problem Module Overtemperature (RX3i only) LAN Interface OK Channel 1 Status (SRTP: Data Transfer) Channel 1 Status (SRTP: Channel Error) ... Channel 32 Status (SRTP: Data Transfer) Channel 32 Status (SRTP: Channel Error) Brief Description

LAN Interface Status (LIS) Bits

The LAN Interface Status bits monitor the health of the Ethernet Interface itself. Bit 1, Port 1a Full Duplex: This bit is set to 1 when Port 1A is set to full duplex. Full-duplex or half-duplex operation is automatically negotiated between the Ethernet Interface and its immediately-connected network device, usually a network hub or switch. If this bit is 0, the port is in half-duplex Ethernet mode. This bit is only valid if bit 13 (LAN OK) is 1. Bit 2, Port 1A 100Mbps: This bit is set to 1 when Port 1A is operating at 100Mbps.
10-10 TCP/IP Ethernet Communications for PACSystems April 2005 GFK-2224C

10
Bit 3, Port 1B Full Duplex: This bit is set to 1 when Port 1B is set to full duplex. Full-duplex or half-duplex operation is automatically negotiated between the Ethernet Interface and its immediately-connected network device, usually a network hub or switch. If this bit is 0, the port is operating in half-duplex Ethernet mode. This bit is only valid if bit 13 (LAN OK) is 1. Bit 4, Port 1B 100Mbps: This bit is set to 1 when Port 1B is operating at 100Mbps. Bit 6, Redundant IP Address Active: This bit is set to 1 when the configured Redundant IP address is active. (The Ethernet Redundancy feature is available in the RX7i only.) Otherwise this status bit is set to 0. Bit 9, Any Channel In Error: This bit (normally 0) indicates one or more of the channels are in error. Bit 13, LAN OK: This bit is 1 as long as the Ethernet Interface software is able to communicate on the network. If the network becomes inaccessible due to local or network problems, this bit is set to 0. If LAN communication becomes possible again, it is set to 1. Bit 14, Resource Problem: This bit is set to 1 if the Ethernet Interface software has a resource problem (i.e., lack of data memory). The bit is reset to 0 on a subsequent PLC sweep. The Ethernet Interface may or may not be able to continue functioning, depending on the severity of the problem. Look in the PLC Fault Table for details. In addition, the Station Manager STAT B and LOG commands can be used. See the Station Manager Manual, GFK2225, for more information. Bit 15, Module Overtemperature: This bit is set if the Ethernet interface hardware has detected that the internal temperature has exceeded normal limits. The bit is cleared when the internal temperature has not exceeded normal limits, or has recovered from an overtemperature condition. (Overtemperature indication is available in the RX3i only.) Bit 16, LAN Interface OK Bit: This bit is set to 1 by the Ethernet Interface each PLC scan. If the Ethernet Interface cannot access the PLC, the CPU sets this bit to 0. When this bit is 0, all other Ethernet Interface Status bits are invalid.

Channel Status Bits

The Channel Status bits provide runtime status information for each communication channel. Each channel has two status bits; the meaning of the channel status bits depends upon the type of communication performed on that channel. SRTP Client (channels) operation provides two Channel Status bits for each SRTP channel, a Data Transfer bit and a Channel Error bit. These are defined in chapter 6, SRTP Channels. Bits 17, 19, 21 ... 79, Data Transfer Bit: The Data Transfer bit pulses (0 1 0) each time there is a successful read or write. Bits 18, 20, 22 ... 80, Channel Error Bit: This bit (normally 0) indicates any channel error, fatal or non-fatal. It does not necessarily indicate that the channel is idle.

GFK-2224C

Chapter 10 Diagnostics

10-11

10

Monitoring the FT Output of the COMMREQ Function Block.

The COMMREQ function block indicates its status through its FT output:
(Enable )------------(Command Block address) (Rack/Slot Location of the Ethernet Interface) (Task value) -

COMM REQ IN FT SYSID TASK

- CommReq Delivered - Function Faulted (logic)

If after executing a COMMREQ Function, the FT Output is ON, there is a programming error in one or more of the following areas. Invalid rack/slot specified. The module at this rack/slot is unable to receive a COMMREQ Command Block. Invalid Task ID. This value should always be 65536 decimal (10000H) for the CPU Ethernet daughterboard, or 0 decimal (0000H) for the Ethernet module. Invalid Data Block length (0 or greater than 128).

This output also may indicate that no more COMMREQ functions can be initiated in the ladder program until the Ethernet Interface has time to process some of the pending COMMREQ functions. If the FT Output is set, the CPU did not transfer the Command Block to the Ethernet Interface. In this case, the other status indicators are not updated for this COMMREQ. The Ethernet Interface is unable to return a COMMREQ Status Word to the PLC logic application.

10-12

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10

Monitoring the COMMREQ Status Word

Every COMMREQ Command Block instruction specifies a 1-word memory address to receive status information about the execution of the command. Before executing a COMMREQ for the Ethernet interface, the application program logic should the associated status word zero (for example, using a MOVE Word instruction). After executing a COMMREQ, the program should monitor its status word. If the status word is updated to a one (1), the command has been processed successfully. If the status word is updated to a value other than 1, an error has occurred. Any data returned by that command should not be used until the problem is corrected and the status word indicates success. It is critical to monitor the COMMREQ status word for each COMMREQ function. . If after executing a COMMREQ function, the COMMREQ status word is zero (0), the success Output is ON and the FT Output is OFF, the Command Block has been sent to the Ethernet Interface, but no status has been returned. If this condition persists, check the PLC Fault Table for information.

Format of the COMMREQ Status Word

Displaying the status word in hexadecimal form makes it easier to differentiate the high and low bytes. This can be done using a MOVE WORD function block to display the hexadecimal value within the ladder program.
Status Word in Hex Format High Low 00 00

Minor Error Codes (high byte) Success and Major Error Codes (low byte)

The following tables list the error codes that are reported in the COMMREQ Status word after the execution of a COMMREQ function.

GFK-2224C

Chapter 10 Diagnostics

10-13

10

Major Error Codes in the COMMREQ Status Word

Success or a Major Error Code appears in the low byte of the COMMREQ Status Word. Hexadecimal values for the low byte are listed below. For many Major Error Codes, additional information appears as a Minor Error Code in the high byte of the COMMREQ Status Word. Hexadecimal values for the high byte are listed on the following pages.
Error Status Major Error Description (Hexadecimal) 01H Successful Completion. (This is the expected completion value in the COMMREQ Status word.) 02H Insufficient Privilege at server PLC. For a PACSystems or Series 90-70 server PLC, the minor error code contains the privilege level required for the service request. 04H Protocol Sequence Error. The server CPU has received a message that is out of order. Call GE Fanuc Automation for assistance. 05H Service Request Error at server PLC. The minor error code contains the specific error code. See the following table of Minor Error codes. 06H Illegal Mailbox Type at server PLC. Service request mailbox type is either undefined or unexpected. Call GE Fanuc Automation for assistance. 07H The server PLC CPUs Service Request Queue is full, usually due to heavy CPU loading. The client should retry later. It is recommended that the client wait a minimum of 10 milliseconds before sending another service request. 0BH Illegal Service Request. The requested service is either not defined or not supported at the server PLC. (This value is returned in lieu of the actual service request error (01H), to avoid confusion with the normal successful COMMREQ completion.) Call GE Fanuc Automation for assistance. 11H SRTP Error Code at server. An error was detected at the SRTP server. See the following table of Minor Error codes. 82H Insufficient Privilege at client PLC. The minor error code contains the privilege level required for the service request. 84H Protocol Sequence Error. The CPU has received a message that is out of order. Call GE Fanuc Automation for assistance. 85H Service Request Error at the client PLC. The minor error code contains the specific error code. See the following table of Minor Error codes. 86H Illegal Mailbox Type. Service request mailbox type is either undefined or unexpected. Call GE Fanuc Automation for assistance. 87H The client PLC CPUs Service Request Queue is full. The client should retry later. It is recommended that the client wait a minimum of 10 milliseconds before sending another service request. 8BH Illegal Service Request. The requested service is either not defined or not supported. (This value is returned in lieu of the actual service request error (01H), to avoid confusion with the normal successful COMMREQ completion.). Call GE Fanuc Automation for assistance. 90H SRTP Client (Channels) error. See the following table of Minor Error codes. (Some EGD command errors also use major code 90 when indicating the same error condition as SRTP channels.) A0H EGD Command error. See the following table of Minor Error codes.

10-14

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10 Minor Error Codes for Major Error Codes 05H (at Remote Server PLC) and 85H (at Client PLC)
Error Status (Hexadecimal) Remote Server Client 8F05H 8E05H 9005H 9305H C105H C305H C605H C705H C805H C905H CA05H CB05H CC05H CD05H CE05H CF05H D105H D205H D505H D605H D705H D805H D905H DA05H DB05H DC05H DD05H DE05H DF05H 8F85H 8E85H 9085H 9385H C185H C385H C685H C785H C885H C985H CA85H CB85H CC85H CD85H CE85H CF85H D185H D285H D585H D685H D785H D885H D985H DA85H DB85H DC85H DD85H DE85H DF85H Session already exists. Memory write is prohibited. Invalid PLC memory reference range. Text buffer length/count does not agree with request parameters. Invalid block state transition. Text length does not match traffic type. Control Program (CP) tasks exist but requestor not logged into main CP. Passwords are set to inactive and cannot be enabled or disabled. Password(s) already enabled and cannot be forced inactive. Login using non-zero buffer size required for block commands. Device is write-protected. A comm or write verify error occurred during save or restore. Data stored on device has been corrupted and is no longer reliable. Attempt was made to read a device but no data has been stored on it. Specified device has insufficient memory to handle request. Specified device is not available in the system (not present). Packet size or total program size does not match input. Invalid write mode parameter. Invalid block name specified. Total datagram connection memory exceeded. Invalid datagram type specified. Point length not allowed. Transfer type invalid for this Memory Type selector. Null pointer to data in Memory Type selector. Invalid Memory Type selector in datagram. Unable to find connection address. Unable to locate given datagram connection ID. Size of datagram connection invalid. Invalid datagram connection address. Error Description

continued

GFK-2224C

Chapter 10 Diagnostics

10-15

10

Minor Error Codes for Major Error Codes 05H (at Remote Server PLC) and 85H (at Client PLC)
Continued from previous page Error Status (Hexadecimal) Remote Server Client E005H E405H E905H EA05H EE05H EF05H F005H F105H F205H F405H F505H F605H F705H F805H F905H FC05H FE05H FF05H E085H E485H E985H EA85H EE85H EF85H F085H F185H F285H F485H F585H F685H F785H F885H F985H FC85H FE85H FF85H

Error Description Service in process cannot login. Memory Type for this selector does not exist. Memory Type selector not valid in context. Not logged in to process service request. Could not return block sizes. Programmer is already attached. Request only valid in stop mode. Request only valid from programmer. Invalid program cannot log in. Invalid input parameter in request. Invalid password. Invalid sweep state to set. Required to log in to a task for service. Invalid program name referenced. Task address out of range. I/O configuration is invalid. No privilege for attempted operation. Service request has been aborted.

10-16

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10 Minor Error Codes for Major Error Code 11H (at Remote Server PLC)
Error Status (Hexadecimal) 0111H 0211H 0311H 0411H 0511H 0611H 0711H 0811H 0911H 0A11H 0B11H 0C11H 1411H 1711H 1811H 1911H 1A11H 1B11H 1D11H 2111H 2211H 2311H 2411H 2611H 2711H 2A11H 2B11H 2C11H 2D11H 2E11H 2F11H SRTP Error Description Generic SRTP error. The PLC is inaccessible. Reserved. Unexpected SRTP version encountered in received message. Unrecognized SRTP message received. Data present in SRTP message which should not contain data. Generic resource problem detected. SRTP message encountered in inappropriate connection state. Generic refusal by backplane driver to handle request. Recognized but unsupported SRTP message received. Lost transaction in server. Error sending SRTP PDU to the client PLC. Unable to allocate a text buffer from dual port memory. Invalid text length detected in a mailbox message. Invalid number of destinations detected in a mailbox message. Invalid source detected in a mailbox message. Invalid slot number detected in a mailbox message. Invalid rack number detected in a mailbox message. Bad text buffer address in dual port memory. Unable to find control data required to send a mailbox message to the PLC. Timed out waiting for availability of mail communications with the PLC. Invalid task ID detected while attempting to send a mailbox message to the PLC. Unable to send mailbox message to PLC because the mail queue is full. Unable to communicate with PLC. Backplane driver not initialized or unable to acquire a dual port memory semaphore. The backplane driver could not access the PLC. Invalid binding on the message sent to the backplane driver. The message could not be sent to its destination because the mailbox was not open. The maximum number of transfers to the destination is already taking place. The maximum number of transfers of this transfer type is already taking place. Cannot obtain a backplane transfer buffer. continued

GFK-2224C

Chapter 10 Diagnostics

10-17

10

Minor Error Codes for Major Error Code 11H (at Remote Server PLC)
Continued from previous page Error Status (Hexadecimal) 3011H 3111H 3211H 3311H 3411H 3511H 3611H 3711H 3811H 3911H 3A11H 3B11H 3C11H 3D11H 3E11H 3F11H 4011H 4111H 4211H 4311H 4411H SRTP Error Description Cannot obtain resources other than backplane transfer buffers. Connection ID or block transfer ID is not valid. Timed out waiting for PLC CPU response. The PLC CPU aborted the request. An invalid message type was specified. The specified task is not registered. The mailbox offset specified is invalid. The backplane task could not be registered because the message response handler was not specified. The backplane task could not be registered because the unsolicited mailbox message handler was not specified. The backplane task could not be registered because a required parameter was not specified. More than the allowable byte length in a single transfer. Bad sequence number in the request. Invalid command in request. Response length does not match length specified in the response qualifier. Request failed because the PLCs Service Request Processor is not initialized. Request failed due to an error in the remote device, most likely running out of Dual-Port RAM text buffers. Unable to free dual port memory that was allocated for a connection or block transfer area. The backplane task could not be registered because the service request handler was not specified. No dual port memory was allocated for the connection or block transfer area needed to process the request. Failure to register with backplane driver because the requested task is already registered. Request failed because an invalid field was identified in the request mailbox qualifier. continued

10-18

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10
Minor Error Codes for Major Error Code 11H (at Remote Server PLC)
Continued from previous page Error Status (Hexadecimal) E811H E911H EA11H EB11H EC11H FE11H 2911H 2A11H 2F11H 3011H 3111H 3211H 3311H 3411H 3611H 4811H 4911H 4C11H 4D11H 4E11H 4F11H SRTP Error Description Unable to send request to the PLC because an internal message queue is full. Unable to send request to the PLC because the text buffer type is invalid. Unable to send request to the PLC because the mailbox utility function is invalid. Unable to send request to the PLC because the mailbox message is not specified. Unable to send request to the PLC because the internal message queue is not initialized. Request failed due to mailbox error on remote device. The remote device log will have more information. The backplane driver is not initialized. The backplane driver could not access the PLC. Request failed due to an invalid parameter detected in the remote device. The remote device log will have more information. The specified task is not registered. Failure to register with backplane driver because the requested task is already registered. Unable to find resource necessary for backplane driver to process a service request. Bad sequence number detected in the service request because it is already in use. Invalid data detected that prevents backplane driver from completing a request. More than the allowable byte length in a single transfer. Memory resource problem detected. Network buffer resource problem detected. Error detected while attempting to receive mailbox messages from the PLC. Timed out waiting to obtain a backplane transfer buffer. Timed out waiting to transfer a mailbox message to the PLC. Timed out waiting for PLC CPU response.

GFK-2224C

Chapter 10 Diagnostics

10-19

10

Minor Error Codes for Major Error Code 90H (at Client PLC)
Error Status (Hexadecimal) 0190H 0290H 8190H 8290H 8390H 8490H 8590H 8690H 8790H 8890H 8990H 8A90H 8B90H 8C90H 8D90H 8E90H 8F90H Error Description Timeout expired before transfer completed; still waiting on transfer. Period expired before transfer completed; still waiting on transfer. COMMREQ data block too short for the command. COMMREQ data block too short for server PLC node address. Invalid server memory type. Invalid Program Name. Invalid Program Block Name. Zero server unit length is not allowed. Server unit length is too large. Invalid channel number. Invalid time unit for period. (Maximum permitted 3965 hours) Period value is too large. Zero server memory starting address is not allowed. Invalid client memory type. Invalid server host address type. Invalid IP address integer value. (Must be 0255) Invalid IP address class. (Must be valid Class A, B, or C IP address) May also occur if the destination IP address in the COMMREQ is same as the senders IP address. Insufficient TCP connection resources to do request. Zero local starting address is not allowed. Address length value invalid. Must be 4 for address type 1. COMMREQ data block too short for Program Block name (including 0 pad). COMMREQ data block too short for Program name (including 0 pad). Internal API error. See PLC Fault Table or exception log for details. This problem may occur due to the Ethernet Interface being asked to perform beyond its capacity. Try transferring less data per message or establishing fewer simultaneous connections. Underlying TCP connection aborted (reset) by server end point. Underlying TCP connection aborted by client end point. The remote server has no Service Request Processor. Response to session request did not arrive in proper order. Session denied by server PLC. Data response did not arrive in proper order. Data response had unexpected size. Unrecognized COMMREQ command code. continued

9090H 9190H 9290H 9390H 9490H 9590H

9690H 9790H 9890H 9A90H 9B90H 9C90H 9D90H 9E90H

10-20

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10
Minor Error Codes for Major Error Code 90H (at Client PLC)
Continued from previous page Error Status (Hexadecimal) A190H A290H A390H A490H A590H A690H A790H A890H A990H AA90H

Error Description Invalid CRS word memory type. Failed an attempt to update the CRS word. Reserved. Reserved. Reserved. Invalid bit mask. Unable to connect to remote device. Channel Resources in Use. Try the command again; a resource will become available. Establish Read/Write/Send Info Report Channel COMMREQ was received while an Abort was in progress. An attempt to establish a TCP connection with a Remote Server has failed. Check the following:

AB90H

Make sure the Server is turned on. Make sure cables are connected. If using a switch, make sure the switch is turned on.

A COMMREQ was discarded because the application program issued the COMMREQ before the COMMREQ Status Word for the previous COMMREQ was set. A protocol error occurred while communicating with the local PLC. A TCP Timeout occurred while communicating with the Remote PLC. A protocol error occurred while communicating with the local PLC. Network Address name length error. The name cannot exceed 31 ASCII characters and must be terminated with a NUL character (zero). Specified Network Address name could not be resolved into an IP address. Internal name resolution error. See PLC Fault Table or exception log for details. The channel the application is trying to access is owned by a different protocol. (Redundancy only) COMMREQs commands are not allowed when Redundant IP address is not active at this Ethernet interface. Abort in Progress on a Channel
Chapter 10 Diagnostics 10-21

AC90H AD90H AE90H B090H B190H B390H B590H C090H FF90H

GFK-2224C

10 Minor Error Codes for Major Error Code A0H (at Client PLC)
Error Status (Hexadecimal) 01A0H 02A0H 03A0H 04A0H 05A0H 06A0H 07A0H 08A0H 09A0H 0AA0H 0BA0H 0CA0H 0DA0H 0EA0H 0FA0H 10A0H 11A0H 12A0H 13A0H 14A0H 15A0H 50A0H 51A0H 52A0H 53A0H 54A0H Error Description Remote exchange is not healthy. Remote exchange is not defined. Remote exchange signature does not match. Request data length is invalid. Response data length is invalid. Invalid memory type selector or address range at remote device. Password protection does not permit access at remote device. Attempt to write to a consumed exchange; this is not permitted. Internal resource error at remote device (memory allocation failed, etc.) Message delivery error; command was not processed. Software initialization error; command was not processed. Invalid RDS session was specified. Data buffer length is invalid. Invalid response message from remote device. Address type is not supported at remote device. A memory access error occurred while processing this command. Remote device did not understand the request. Remote device has no variable defined at the specified address. An attempt was made to write a Read-Only variable at remote device. Data length or contents are invalid for transfer according to the data type of that variable at remote device. Response message would exceed max response size (1400 bytes). The remote server detected an unsupported protocol version in the request. The remote server did not recognize the requested command. The remote server detected a configuration time mismatch in the request. The remote server detected that the request was not a valid RDS message. The RDS_Header bit (required by RDS version 2.01 and higher) was not set. Attempt to establish a second session to a remote server. Only one session at a time is permitted between this device and each remote server.

10-22

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10

Using the EGD Management Tool

The EGD Management Tool can perform online monitoring of EGD class 2 devices such as the PACSystems Ethernet Interfaces. It can quickly look at the Ethernet Global Data traffic across an entire network of EGD devices to spot problems. To use the EGD Management Tool, you must have configured Ethernet Global Data using the EGD Configuration Server option as described in chapter 3.

Installing the EGD Management Tool

The EGD Management Tool is not automatically installed when you install the Programmer. To install the EGD Management Tool, look in the directory where you installed the programmer and you will find a subdirectory named EGD Installs. In that directory, you will find a file named EgdManagementToolSetup.msi. Double-click on this file to install the EGD Management Tool.

Launching the EGD Management Tool

To run the EGD Management Tool, select the Ethernet Global Data node in the Navigator and right click. Select Launch EGD Management Tool. The EMT will begin execution in a separate frame on your desktop.

The right side of the screen shows a graphical representation of the EGD network based on the configuration data stored in the EGD Configuration Server. EGD collections are displayed as a folder icon. The navigator on the left side allows specific devices, exchanges and variables in the configuration to be examined. Properties for these elements are shown in the property pane at the lower left. The EGD Management Tool displays devices and networks based on the configuration information in the EGD Configuration Server for the machine it is running on. Using the options menu you can configure the server information much as you do for the programming
GFK-2224C Chapter 10 Diagnostics 10-23

10
tool, and also set options for the online operation of the tool. Be aware that changing the server configuration will change it for all tools running on that machine, including the programming software. In addition to the online operations described below, the EGD Management Tool has a number of offline capabilities (such as View/Reports) for doing analysis of the Ethernet Global Data configuration. See the EGD Management Tool help for more information.

Monitoring EGD Devices

The EGD Management Tool monitors the devices on the Ethernet Global Data network provided it has access to that network. To have access to the EGD network, the computer running the EGD Management Tool must have a Network Interface Card that connects to the EGD network. Consult with your local network administrator if you need help connecting the computer to the Ethernet Global Data network. The screen below shows the EGD Monitoring Tool connected to and monitoring an EGD network.

Devices that have a red x are not responding to communications from the EGD Management Tool. Devices that have a yellow triangle have some kind of error or warning condition that may require attention. Use the browser pane to select the device to get further information about the failures being reported. The EGD Management Tool reports a configuration mismatch for PLCs that have multiple Ethernet Interfaces. Only one of the interfaces in a PLC is queried by the EGD Management Tool, so only a subset of the exchanges in the PLC is visible online through that interface.

10-24

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10
Online information is only available for EGD Class 2 devices (devices that support the EGD commands). This includes all PACSystems controllers. It does not include most of the older GE Fanuc Series 90 PLCs. When the EGD Management Tool is used online, it periodically sends Ethernet Global Data commands to each device. This may have a performance impact on the network and the devices on the network. Before using the EGD Management Tool in a production environment, be sure to assess the performance impact of its use on your application.

Monitoring Status of Ethernet Global Data for a Device

The EGD Management Tool can display detailed information for each exchange in an EGD Class 2 device such as a PACSystems controller. Selecting the Exchanges node for the device in the navigator pane will display the list of exchanges for the device.

GFK-2224C

Chapter 10 Diagnostics

10-25

10

Configuration Summary
Selecting the Configuration Summary tab displays information about the exchanges defined in the device.

The configuration summary data for each exchange has the following information: Exchange the name of the exchange as it is stored in the EGD configuration server. Producer ID the producer ID of the exchange as it is stored in the EGD configuration server. Destination the destination IP address for the exchange. Mode Unicast, Multicast or Broadcast based on the mode of the exchange. Type Producer or Consumer depending on the type of the exchange. Configuration Time the configuration timestamp of the exchange as it is stored in the EGD configuration server. Signature the signature value of the exchange as it is stored in the EGD configuration server. Length the byte size of the exchange as it is stored in the EGD configuration server. Period the production period for a produced exchange or the consume timeout for a consumed exchange as it is stored in the EGD configuration server.

10-26

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10
Online EGD Statistics
Selecting the Online Statistics tab displays a list of the exchanges in the device and statistics information about each exchange. The statistics are updated periodically based on a rate in the Options menu.

The statistics data for each exchange has the following information: Exchange the name of the exchange as it is stored in the EGD configuration server. Configuration Time the date and time that the configuration for the exchange was created. Due Time the date and time that a sample is due. For a produced exchange, this is the time that the next sample will be produced. For a consumed exchange, this is the time at which the exchange will time out if data is not received. Status information about the status of the exchange. For a produced exchange, status will be Producing if the exchange is actively being sent to the network and Pending if the exchange is defined but not producing. A Pending status in a PACSystems exchange may indicate that the controller has its I/O disabled thus stopping the production of EGD. For a consumed exchange, status will be Healthy if no timeout has occurred for the exchange and Unhealthy if the exchange is timed out. Length the byte size of the data for the exchange. Message Count the number of samples transferred on the exchange. Missed Count the number of samples that were missed on the exchange. Missed samples may indicate issues with the underlying Ethernet network or overloading of the consuming device. Refresh Errors the number of timeouts that have occurred for a consumed exchange.

GFK-2224C

Chapter 10 Diagnostics

10-27

10
Produced Variables
Expanding the Exchanges node in the navigator pane displays the list of exchanges for the device as recorded in the EGD Configuration Server. Selecting an exchange brings up a list of variables for that exchange as shown below. This can be used to look at the details of the data for an exchange.

10-28

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10

Troubleshooting Common Ethernet Difficulties

Some common Ethernet errors are described below. Ethernet errors are generally indicated in the PLC Fault Table and the Ethernet exception log. As previously explained, PLC Faults generated by the Ethernet interface contain Ethernet exception events within the extra fault data. See the PACSystems Station Manager Manual, GFK-2225 for detailed descriptions of Ethernet exception events.

COMMREQ Fault Errors

When the PLC CPU attempts to initiate COMMREQs to the Ethernet Interface more rapidly than the Ethernet Interface can accept them, the COMMREQ delivery will fail. The fault output of the COMMREQ function block will be set and the COMMREQ will not be delivered to the Ethernet Interface. In this case, the PLC logic program should attempt to initiate the COMMREQ on another sweep after a very short delay. This condition may arise when the logic Program attempts to initiate greater than 16 COMMREQs in the same logic sweep. Sustained heavy COMMREQ delivery from the PLC CPU to the Ethernet Interface can use a considerable portion of the Ethernet Interfaces processing capability. Under heavy COMMREQ load, the Ethernet Interface may discard some received COMMREQs until it is once again able to process further COMMREQs. In such cases, the Ethernet Interface increments the CmrqDscd tally; this tally is available via the TALLY C Station Manager command. Under sustained extremely heavy COMMREQ load, the Ethernet Interface may not respond to Station Manager commands and possibly some non-Programmer data communications. If this occurs, first switch the PLC CPU to STOP mode, which ceases COMMREQ delivery in order to resume normal Ethernet operation. Then modify the PLC logic application to reduce the COMMREQ traffic to a manageable level.

GFK-2224C

Chapter 10 Diagnostics

10-29

10

PLC Timeout Errors

PLC timeout errors may occur when the SRTP traffic to the Ethernet Interface exceeds the PLCs ability to process the requests, or when the PLC is unable to deliver mail to the Ethernet Interface.. PLC Timeout errors will take down an SRTP Server connection; in this case, the remote SRTP client must reestablish a new SRTP connection to the Ethernet Interface. This error is indicated in the PLC Fault Table as:
Backplane communication with PLC fault; lost request with exception Event = 8, Entry 2 = 8

These errors may also be accompanied by any of the following:

Backplane communication with PLC fault; lost request with exception Event = 8, Entry 2 = 6; location = Ethernet Interface LAN system-software fault; resuming with exception Event = 8, Entry 2 = 16; location = Ethernet Interface Non-critical CPU software event status code (bytes 5-8) = 80 3a 00 12; location = CPU module

The PLC Timeout condition occurs when the CPU cannot process requests within a specified timeout period. The remedy is to reduce the rate of requests, or increase the processing capacity in the PLC.
Cause Heavy COMMREQ traffic. Heavy SRTP traffic. Long PLC sweep time. PLC Communication Window set to LIMITED mode. Corrective Action Reduce the rate at which the logic application sends COMMREQs to the Ethernet Interface. Reduce the size, number, or frequency of SRTP requests at the remote SRTP client. Modify the PLC application to reduce the PLC sweep time. Change to RUN-TO-COMPLETION mode.

Note: The Backplane-mounted Ethernet module uses the Backplane Communications Window. The RX7i CPU-mounted Ethernet daughterboard uses the Controller Communications Window.

10-30

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10 Application Timeout Errors

Application timeout errors include: SRTP Channel timeout errors (COMMREQ Status 0190H or 0290H at the client) EGD Command timeout errors (COMMREQ Status 0190H at the client) EGD consumed exchange refresh errors (Exchange Status 6 or 7).

Application timeout errors can happen for several reasons, including: Incorrect destination device address, or destination device not on the network. The communication service cannot be performed. Verify that the destination device address is correct and that the destination device is functioning properly. Ping the destination device to check that it is present on the network. The network throughput cannot keep up with the traffic generated by the application. This condition can occur when the intervening network components between the application devices cannot handle the volume of network traffic, causing network packets to be dropped. For SRTP, this causes TCP retransmissions; repetitive retransmissions can slow the SRTP responses enough that the client detects an application timeout error. For EGD, this causes samples to be dropped. If the consumer misses enough samples, it detects a consumer timeout error; when that exchange subsequently receives samples, the consumer may detect a Data with Refresh error. This condition typically arises when intermediate network routers or switches lack the buffering or processing capacity to handle the network load. Reduce the volume of traffic on the network, or identify and upgrade the network component(s) that are unable to handle the traffic volume. Consult you network administrator for assistance. The SRTP channel timeout and period include the time required to establish the TCP connection. It is important to consider the connection time when configuring these values. If more than one SRTP channel is being established and the PACSystems server has just been restarted or updated with a new hardware configuration, the channel timeout and period should be more than one second. This allows sufficient time for the high level of TCP traffic required to establish new network connections. When first establishing a channel, a channel timeout lower than one second may result in a 0190H (channel timeout) COMMREQ status and a channel period lower than one second may result in a 0290H (period expired error)

GFK-2224C

Chapter 10 Diagnostics

10-31

10

EGD Configuration Mismatch Errors

When using Ethernet Global Data, the produced exchange (defined at the producer) must agree with the consumed exchange (defined at the consumer). The consumer generates an error when the size of an exchange received from the network differs from the configured size for that consumed exchange. This error is indicated in the PLC Fault Table as:
LAN system-software fault; resuming with exception Event = 28, Entry 2 = 1d

As this error is generated each time the mismatched exchange is received, the Ethernet exception log can quickly fill up with mismatch error events.
Cause Producer and Consumer exchange definitions are of different size. Corrective Action Review the conflicting exchange definitions at the producer and at the consumer. Change the incorrect exchange definition so that produced and consumed definitions are the same size.

If the consumer wishes to ignore certain portions of a consumed exchange, be sure that the length of the ignored portions is correct. The ignored portion is specified as a byte count.

Station Manager Lockout under Heavy Load

Sustained heavy EGD and/or SRTP Server load can utilize all processing resources within the Ethernet interface, effectively locking out the Station Manager function. The Station Manager appears inoperative under either local or remote operation. The Ethernet interface always gives higher priority to data communication functions than to the Station Manager. When the processing load is reduced, the Station Manager becomes operative once again. This condition is not reported to the PLC Fault Table or Ethernet exception log.

PING Restrictions
To conserve network data buffer resources, the CPU process only one ICMP control message at a time. An ICMP Echo (ping) request that arrives while the CPU is processing another ICMP control message is discarded. When multiple remote hosts attempt to ping the CPU at the same time, some individual ping requests may be ignored depending upon the timing of the ping requests on the network. The CPU may initiate ping requests to another host on the network via the ping Station Manager command. The ping request sequence is restricted to one remote host at a time. Discarded ping requests are not reported to the PLC Fault Table or Ethernet exception log.

10-32

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

10 SRTP Connection Timeout

When the Ethernet Interface is abruptly disconnected from a remote SRTP server (for example, by disconnecting the Ethernet cable), the underlying TCP connection attempts to reestablish communication. The SRTP connection in the Ethernet Interface may remains open for approximately 3 minutes 30 seconds while TCP attempts to reconnect; during this interval, the SRTP connection is unavailable. If all the SRTP connections in the Ethernet Interface are in use or otherwise unavailable, a new SRTP server connection must wait until the TCP reconnect time expires on an existing connection. The SRTP connection timeout is normal expected behavior, and is consistent with other GE Fanuc PLC products.

Sluggish Programmer Response after Network Disruption

The network programmer attempts to use a special privileged SRTP server connection at the Ethernet Interface in order to establish and maintain connection even under heavy load due to EGD and other SRTP connections. The Ethernet Interface supported only one such privileged connection. Once established, no other privileged connections are permitted until the current privileged connection is terminated. This normally occurs when the network programmer disconnects from the target PLC. As described above under SRTP Connection Timeout, when the programmer-PLC network connection is abruptly broken (not the orderly termination performed during disconnection), the SRTP server connection and its underlying TCP connection remain alive until the TCP connection eventually times out (about 3 minutes 30 seconds). If the programmer reconnects during this interval, it actually obtains a new, non-privileged connection. Under heavy load at the Ethernet Interface, the programmer may experience sluggish response over this nonprivileged connection. If this occurs, the user can manually disconnect and reconnect the programmer after the previous connection has timed out. Upon reconnection, the programmer should once again obtain the privileged connection.

EGD Command Session Conflicts

EGD Commands support only one pending EGD command from a client device to each server device. Attempts to issue a second EGD command from a client to the same server before completion of the first command will result in an error. Some examples are: 1. The logic application issues a second EGD Command COMMREQ to the same remote server, perhaps from a different location in the logic program. 2. The EGDCMD Station Manager command issues a command to the same remote server device as the logic application.

GFK-2224C

Chapter 10 Diagnostics

10-33

10

SRTP Request Incompatibility with Existing Host Communications Toolkit Devices or Other SRTP Clients
The Advanced User Parameter (AUP) named chct_comp provides greater compatibility with existing Host Communication Toolkit devices. Some Host Communication Toolkit devices generate incorrectly-encoded SRTP messages. In some cases, PACSystems Ethernet interfaces detect and report SRTP encoding errors that were ignored by previous Series 90 products; these errors cause the PACSystems SRTP server to drop the SRTP connection to the Host Communications Toolkit device. If possible, the Host Communications Toolkit device should be upgraded so that it will generate properly-encoded SRTP messages. If the device cannot be upgraded, the chct_comp AUP parameter can be used to tell the PACSystems Ethernet interface to ignore known SRTP errors that were not detected by previous Series 90 products. (See Appendix A for details of the chct_comp parameter.)

COMMREQ Flooding Can Interrupt Normal Operation

The PLC logic application program should generally wait for a response from each COMMREQ function block before activating another COMMREQ function block to the same endpoint. Extremely heavy COMMREQ delivery loading, such as activating the same COMMREQ every logic sweep, can prevent normal SRTP, Modbus, EGD, and Station Manager operation. During such loading, the Ethernet LAN LED may be frozen.

Accelerated EGD Consumption Can Interfere with EGD Production

Consumed EGD exchanges received from the network normally receive accelerated processing for increased overall EGD performance. This accelerated processing can preempt EGD production activity, possibly delaying transmission of produced exchanges to the network. Such delay varies with network loading and the volume of consumed exchanges. In applications requiring minimal produced exchange timing variability, the consumed exchange acceleration may be disabled via the gc_accel AUP parameter. (See appendix A for details of the gc_accel parameter.) Under extreme network load, accelerated processing of the incoming EGD samples may consume so much processing time that the watchdog timer for the network interface expires and the network interface is reset.

10-34

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Appendix Configuring Advanced User Parameters

A
Advanced User Parameters (AUPs) are internal operating parameters used by the Ethernet interface. For most applications, the default Advanced User Parameters should not be changed. If it is necessary to modify any of these parameters, it must be done by creating an AUP file, using any ASCII text editor. This file must contain the names and values of only those parameters that are being changed. This user-generated AUP file is then imported into the programmer and assigned to a particular Ethernet Interface. To modify Advanced User Parameters in more than one Ethernet Interface in the same control system, import an AUP file for each Ethernet Interface. (If the changes are identical, you may use the same AUP file for more than one Ethernet Interface.) When the entire hardware configuration is stored from the programmer to the CPU, the programmer also stores the parameters from all assigned AUP files. The CPU delivers any assigned AUP file data to its Ethernet Interface along with its configuration. AUP file data is transferred along with the rest of the hardware configuration during both download (programmer-to-CPU) and upload (CPU-to-programmer) operations. AUP file data is also included in the configuration Verify operation between programmer and CPU. Note that there may be a separate AUP file for each Ethernet interface (or some may have them while others do not).

GFK-2224C

A-1

A
If an Ethernet Interface is not configured by the programmer, its Station Manager can be used to locally modify the Advanced User Parameters for that individual module. (Setting the IP address/subnet mask via BOOTP or the SetIP Tool does not qualify as a programmer configuration.)

Caution
The IEEE 802.3 standard strongly discourages the manual configuration of duplex mode for a port (as would be possible using AUP.) Before manually configuring duplex mode for a port using AUP, be sure that you know the characteristics of the link partner and are aware of the consequences of your selection. In the words of the IEEE standard: "Connecting incompatible DTE/MAU combinations such as full duplex mode DTE to a half duplex MAU, or a full-duplex station (DTE or MAU) to a repeater or other half duplex network, can lead to severe network performance degradation, increased collisions, late collisions, CRC errors, and undetected data corruption."

Note: If the speed and duplex mode of a port are forced using Advanced User Parameters, the switch will no longer perform automatic cable detection. This means that if you have the switch port connected to a switch or hub port you must use a crossover cable. If you have the switch port connected to the uplink port on a switch or hub or if you have the switch port connected to another Ethernet device you must use a normal cable.

A-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Format of the Advanced User Parameters File

The AUP file must have this format: AUP_r_s where r and s indicate the Rack and Slot location of the Ethernet Interface <parameter name> = <parameter value> <parameter name> = <parameter value> <parameter name> = <parameter value> The AUP file has the following requirements:

The first line of the file must consist only of the text: AUP_r_s where r and s usually indicate the Rack and Slot location of the Ethernet Interface. (For example, an Ethernet Module is rack 0, slot 11 would be indicated as AUP_0_11. The CPU-embedded Ethernet Interface always uses Rack 0, Slot 1.) This was intended as a convenient way to differentiate AUP files for different modules. Any rack and slot number will do, so that the same AUP file could be imported for use by multiple Ethernet interfaces if desired.

All parameter names are lowercase. The equal sign (=) is required between the parameter name and parameter value. Spaces are allowed, but not required, between the parameter name and the equal symbol (=) and between the equal symbol and the parameter value. Character string values are case-sensitive; as with Station Manager commands, uppercase parameter values must be enclosed within a pair of double quotes. Numeric parameters are entered in decimal or hexadecimal format; hexadecimal values must be terminated with an 'h' or 'H' character. IP addressing parameters must be entered in standard dotted decimal format. Comments in the file must start with a semicolon character. All characters in the same line following a semicolon are ignored. Blank lines are ignored.

Example:
The following example sets the station manager password to system and the IP time-to-live for point-to-point Ethernet Global Data exchanges to 4. AUP_0_1 stpasswd = system gucast_ttl=4 ; ; set the password to system set the EGD unicast IP TTL to 4

GFK-2224C

Appendix A Configuring Advanced User Parameters

A-3

Advanced User Parameter Definitions

The following Advanced User Parameters can be configured for the Ethernet interface.
System Memory Parameters (task b) staudp stpasswd Remote command UDP port Station Manager password (only visible from MODIFY prompt) Default 18245 (4745H) system Default 60 seconds Range 0 65535 (ffffH) 0-8 characters, case sensitive, no spaces Range 10 3600 (E10H)

Backplane Driver Parameters (task c) crsp_tout CPU response timeout. Amount of time to wait for the CPU to respond to a request sent through the PLC Driver. HCT compatibility option. (Rel 2.57 and later) Allows Ethernet interface to ignore SRTP header errors (typically generated by remote HCT devices) that were not detected in previous Series 90 products. 0 = HCT compatibility disabled (= report all errors) 1 = HCT compatibility enabled (= ignore some errors) RDS Parameters (task d) ARP Parameters (task f) fflush Interval in seconds at which to flush the ARP cache

chct_comp

0 (0H)

0, 1

None Default

None Range

600 (10 minutes) 0 604800 (93A80H) Default 7937 (1f01H) 18246 (4746H) 1 (1H) 16 (10H) 0 (0H) 0 (0H) Range 0 65535 (ffffH) 0 65535 (ffffH) 0 255 (00ffH) 0 255 (00ffH) 0 65535 (ffffH) 0, 1, 2

Ethernet Global Data Parameters (task g) gctl_port gdata_port gbcast_ttl gucast_ttl gp_phase gcmd_pri UDP port for EGD control messages UDP port for point-to-point (unicast) EGD messages IP time-to-live for global broadcast messages (hop count) IP time-to-live for point-to-point (unicast) messages (hop count) Startup delay time in ms for successive produced exchanges EGD command processing priority. 0 = EGD commands have lower priority than data production. 1 = EGD commands and data production have equal priority. 2 = EGD commands have higher priority. Enable consumed exchange acceleration. 0= Acceleration disabled; 1= Acceleration enabled.

gc_accel

1 (1H)

0, 1

EGD provides a UDP port parameter and host group IP address parameter for each of 32 possible host groups (0-31). The parameter formats for each host group are shown below. XX specifies host group 0-31. gXX_udp gXX_addr gXX_ttl UDP port for host group XX IP time-to-live for host group XX (must be Class D address) IP time-to-live for host group (multicast) messages (hop count) 18246 (4746H) 224.0.7.XX 1 (1H) 0 65535 (ffffH) 224.0.0.2 239.255.255.255 0 255 (00ffH)

A-4

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

A
RDS Parameters (task d) SRTP Client (Channels) Parameters (task h) hconn_tout TCP Connect timeout (in milliseconds) None Default 75000 (124F8H) Default 64 (0040H) None Range 10 75000 (124F8H) Range 0 255 (00ffH) 0 65535 (ffffH) None Range 0,1,2 0,1,2 0,1,2 0,1,2 0,1,2 0,1,2 None None Range 0, 1 0 65535 (ffffH) 0 65535 (ffffH) 0 65535 (ffffH) 0 65535 (ffffH) 0 32767 (7fffH) Range 0 to 8 characters Range 1 1000ms 1 1000ms 1 - 25 1 25

IP Parameters (task i) ittl ifrag_tmr IP header default timetolive (hop count) IP fragment timeout interval in seconds

3 (0003H) None Default 2 0 0 2 0 0 None None Default 0 (000H)

ICMP/IGMP Parameters (task j) Network Interface Parameters (task l) lduplex0 lduplex1a lduplex1b lspeed0 lspeed1a lspeed1b Ethernet duplex for Controller (1 = half, 2= full) Ethernet duplex for Port 1A (0=auto-detect, 1=half, 2=full) Ethernet duplex for Port 1B (0=auto-detect, 1=half, 2=full) Ethernet speed for Controller (1=10Mbit, 2=100Mbit) Ethernet speed for Port 1A (0=auto-detect, 1=10Mbit, 2=100Mbit) Ethernet speed for Port 1B (0=auto-detect, 1=10Mbit, 2=100Mbit)

UDP Parameters (task u) SRTP Parameters (task v) TCP Parameters (task w) wnodelay wkal_idle wkal_cnt wkal_intvl wsnd_buf wrcv_buf TCP nodelay option (0= inactive; 1 = active) TCP keepalive timer value (in seconds) TCP keepalive probe count TCP keepalive probe interval (in seconds) TCP send buffer size (in bytes) TCP receive buffer size (in bytes)

240 (4.0 min) 2 60 seconds 65535 (ffffH) 4096 (1000H) Default

FTP Parameters (task t) tpassword Password for login for FTP access.

system
Default 100 (0064H) 100 (0064H) 1 (0001H) 5 (0005H)

Ethernet Redundancy Parameters (task q) rdipckival rdiparpivl Interval between additional checks for Redundant IP in use (in milliseconds) Interval between gratuitous ARP requests sent by the backup unit on behalf of the new active unit (in ms).

rdipnumarp Number of gratuitous ARP requests to send out during Redundant IP activation process. rdiparplog Number of gratuitous ARP requests to send by backup unit before a Redundant IP not available exception is logged. (The backup unit continues to send ARP requests as long as it receives network packets addressed to the Redundant IP Address.)

GFK-2224C

Appendix A Configuring Advanced User Parameters

A-5

A-6

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Index
A
Abort Channel command (2001), 6-21 Aborting a channel, 6-2 Advanced User Parameters, A-1 Application Timeout, 10-32 AUP file, A-1 Configuration Data, 3-2 Configuration Mismatch, 10-33 Configuring Ethernet Global Data, 3-12, 314, 3-21 Configuring the Ethernet Interface, 3-7 Consumed Data Exchange Definition, 318, 3-19, 3-24 Consumer, 4-2

B
BOOTP, 3-5, 3-8 Broadcasting Ethernet Global Data, 4-7

D
Data Block, 6-9
Length, 6-8

C
Cable
Ethernet, 1-5

Cable, CPU Programming, 2-12 Channel Commands, 6-2

Abort Channel (2001), 6-21 Channel number, 6-11, 6-15, 6-19, 6-21, 623 Command period, 6-11, 6-15, 6-19 Establish Read Channel (2003), 6-10 Establish Write Channel (2004), 6-14 Number of repetitions, 6-11, 6-15, 6-19 Retrieve Detailed Channel Status (2002), 622 Send Information Report (2010), 6-18 Timeout, 6-11, 6-15, 6-19

Data Transfer bit, 6-4, 10-11 Data Transfers with One Repetition, 6-28 Detailed Channel Status words, 6-22, 6-24 Determining if an IP address has been used, 2-14 Documentation, 1-2

E
EGD Command Session Conflicts, 10-34, 10-35 Embedded switches, 2-7 EOK LED, 2-4 Establish Read Channel command (2003), 6-10 Establish Write Channel command (2004), 6-14 Ethernet Global Data, 4-2
Configuring, 3-12, 3-14, 3-21 Consumed Data Exchange Definition, 3-18, 3-19, 3-24 Consumer, 4-2 Effect of PLC modes and actions on, 4-14 Exchange, 4-3 Exchange Status Word, 4-15 Operation, 4-8 Produced Data Exchange Definition, 3-15, 3-16, 3-22 Producer, 4-2 Selective Consumption, 3-26 Variables, 4-4

Channel Error bit, 6-4, 10-11 Channel Status, 6-3

SRTP, 6-4

Channel Status bits, 6-4 Channel Status words, 6-22 Channels

Aborting, 6-2 Maximum that can be established, 6-2 Numbers assigned, 6-11, 6-15, 6-19, 6-21, 6-23 Re-tasking, 6-2

Client PLC, 6-14 Client/Server Capability, 1-3 Command Block, 6-8 COMMREQ, 10-13 COMMREQ Fault Errors, 10-30 COMMREQ Format, 6-7 COMMREQ Format for Programming EGD Commands, 5-2 COMMREQ functions, maximum pending, 6-28 COMMREQ Status, 10-14 COMMREQ Status word
Pointer, 6-9

Ethernet Restart Pushbutton, 2-4 Exchange Status Word

Ethernet Global Data, 4-15

F
Fault table, 10-7

G
Gateways, 8-4

Communications Request, 6-7

GFK-2224C

Index-1

Index H
Hardware failure, 10-5 Hub, 2-10

O
Operating States, 10-4 Operational state, 10-5 Overtemperature, 10-11

I
Installation, 2-5 IP address
Configuration, 3-8 Determining if it has been used, 2-14 Isolated network, 3-9

P
Period for Channel Commands, 6-11, 615, 6-19 PING Restrictions, 10-33 Pinging the TCP/IP Interfaces on the Network, 2-14 Pinouts, 2-9 PLC Fault Table, 10-7 PLC Timeout Errors, 10-31 Port Connectors, 2-7 Port LEDs, 2-4 Port Settings, 2-12 Power-Up, 2-13 Power-up states, 10-4 Private Networks, IP addresses, 8-3 Produced Data Exchange Definition, 3-15, 3-16, 3-22 Producer, 4-2 Producer Period, 4-9 Programmer Response, 10-34 Protocol
Modbus, 7-2

IP Address Assignment, 3-3 IP Addresses Reserved for Private Networks, 8-3 IP Addresses, Multicast, 8-3 IP addressing, 8-2

L
Ladder programming, 6-25 LAN Interface OK bit, 6-3 LED Blink Codes, 10-6 LED Operation during Restart, 2-4 LEDs, 2-3, 2-13, 10-4 Local PLC, 6-14 Loopback IP Addresses, 8-3

M
Mapping
modbus to ENIU memory, 7-3

R
Read EGD Exchange command, 5-11 Read PLC Memory command, 5-4 Redundancy, 4-5, 5-1, 10-11 Redundant IP, 3-10 Redundant IP address, 10-11 Related documents, 1-2 Remote PLC, 6-14 Repeater, 2-10 Repetitions, number of for Channel Commands, 6-11, 6-15, 6-19 Re-tasking a channel, 6-2 Retrieve Detailed Channel Status command (2002), 6-22

Masked Write to EGD Exchange, 5-17 Modbus

Protocol, 7-2 reference tables, 7-3

Modbus Address Space Mapping, 7-5 Modbus Function Codes, 7-6 Multicast IP Addresses, 8-3 Multicasting Ethernet Global Data, 4-6 Multiple Gateways and Subnets, 8-5

N
Name Server IP address, 3-9, 3-14, 3-15 Network Address, 6-13, 6-20 Network connection, 2-9 Network time sync, 3-9 Number of repetitions for a Channel Command, 6-11, 6-15, 6-19

S
Sample ladder program, 6-25 Scan Set, 3-10 Send Information Report command (2010), 6-18

Index-2

TCP/IP Ethernet Communications for PACSystems April 2005

GFK-2224C

Index
Sequencing communications requests, 628 Serial port configuration
Data rate, 3-11 Flow control, 3-11 Parity, 3-11

Server Capability, 1-3 Server PLC, 6-14 Server Protocol Services, 7-2 Simple isolated network configuration, 3-9 SNTP Operation, 4-12 SNTP Timing Signals, 4-13 Software Loader, 10-5 SRTP Channel Status, 6-4 SRTP Connection Timeout, 10-34 STAT LED, 2-4 Station Manager, 10-3 Station Manager, 1-5 Station Manager (RS-232) Port Pinout, 212 Station Manager Lockout under Heavy Load, 10-33 Station Manager Port, 2-12 Station Manager Support, 7-2 Status address location, 3-9 Status Bits, 10-10 Subnet Addressing and Subnet Masks, 8-5 Subnet mask, 8-5 Subnets and Multiple Gateways, 8-5 Switch, 2-10

T
Telnet, 3-6 Time units for command period, 6-11, 615, 6-19 Timeout for Channel Commands, 6-11, 615, 6-19 Timeout Period, 4-9 Timestamping of Ethernet Global Data, 411 Troubleshooting, 10-3

W
Waiting for configuration from PLC, 10-5 Waiting for IP address, 10-5 Write EGD Exchange command, 5-14 Write PLC Memory command, 5-8

GFK-2224C

Index

Index-3