Size:
19.68 Mb
Download

Sending Explicit Messages

Section 9-1

in the same network layer and the remote node’s IP address range is limited.

The following diagram shows an example of actual node address specifications.

EtherNet/IP Unit with unit number 2

CMND

S

D

C

 

PLC's

 

CPU

 

Unit

FINS

Node 05

command

 

Explicit message

Other company's

EtherNet/IP node

The node address of the non-OMRONnode is set as the destination node address in the FINS command data.

 

15

 

8 7

 

0

S

2

8

0

1

Command code

S+1

0

6

 

 

 

Explicit command block

Node address of the non-

OMRON node: 06 Hex

 

15

8 7

 

0

C+3

0

5

F

E

Destination node address:

Destination unit address:

Local node address: 05

FE or 12 (Hex)

Note Depending on conditions, the destination slave may not always accept an explicit message. Always perform retry processing when sending explicit messages.

235

Sending Explicit Messages

Section 9-1

CIP UCMM MESSAGE SEND (28 10)

This command sends an explicit message for CIP routing to another node’s specified class and receives a response. There are two command formats: one with a specified route path (path to the target device), and the other without the route path.

Command Block

Relay Hop Format

The following format includes the route path (routing service data). Specify the entire routing path in the command’s request path.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

502 bytes max.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Request path

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

52

 

02

20

 

 

 

06

 

 

 

 

24

 

 

 

 

01

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

28

 

 

10

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Command

Transport

 

Message

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Instance ID: 01 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

code

ID

 

monitoring

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

time

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8-bitinstance ID: 24 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Class ID Connection Manager: 06 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8-bitclass ID: 20 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Request path size = 2 words: 02 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Service code

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Unconnected Send service: 52 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

502 bytes max.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Routing service data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

00

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Message

 

 

 

 

 

 

 

 

 

Request path

Request data

 

 

 

 

 

 

Route path

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

request size

 

 

 

 

 

 

 

 

 

(variable length)

(variable length)

 

 

 

 

 

(variable length)

 

 

 

 

 

 

 

 

Time Out Ticks

 

 

 

 

 

 

Request path size

 

 

 

 

 

 

Padding data

 

 

 

 

 

Route path size

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Service code

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(when necessary)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Priority/Time Tick

 

 

 

 

 

 

 

 

 

Last hop

 

 

Routing

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Routing

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

service data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

service data

Last Hop Format

The following format does not include the route path.

2810 Hex

 

 

 

Command

Transport

Message

 

code

ID

monitoring time

 

 

 

502 bytes max.

 

 

 

Request path size

Request data

 

 

(variable length)

(variable length)

 

 

Request path size

 

Service code

236

Sending Explicit Messages

Section 9-1

Response Block

The following normal response is returned to a transmitted CIP UCMM MESSAGE SEND command if it was completed normally.

2810

 

 

Hex

0000

 

 

Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Command

Response

 

Transport No. of bytes

code

code

 

ID

 

received

 

 

 

 

 

 

 

 

 

502 bytes max.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

00

00

 

 

 

00

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Hex

Hex

 

 

Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Service response data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(variable length)

Reserved

General status

Reserved

Service code (response)

The following response is returned if an error occurs in a transmitted CIP

UCMM MESSAGE SEND command.

2810

 

 

Hex

0000

 

 

Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Command

 

Response

Transport

No. of bytes

 

 

 

 

 

 

 

 

code

 

code

 

 

ID

received

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

502 bytes max.

 

 

 

 

 

 

 

 

 

 

 

 

 

00

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Additional status

 

Service

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(variable length)

response data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Additional status size

(variable length)

 

 

 

 

 

 

 

 

 

 

 

General status

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Reserved

Service code (response)

The following response is returned if the CIP UCMM MESSAGE SEND command could not be sent or timed out.

2810 Hex

(See note.)

Command Response code code

Note: There may be additional data depending on the response code, e.g., for a relay error.

Parameters

Transport ID (command, response):

When multiple CIP UCMM MESSAGE SEND commands are being sent, the Transport ID identifies the commands. This Transport ID is returned unchanged in the response.

Message monitoring time (command):

Specifies the monitoring time in 10-msunits, in order to monitor the time from the point that the EtherNet/IP Unit orbuilt-inEtherNet/IP port extracts the CIP explicit message from this command until a response is received. The monitoring time can be set between 0.01 and 655.35 s.

Service code (command, response):

In the command, this code is the service code defined for EtherNet/IP.

In the response, bit 15 of the service code specified in the command is turned

ON and the resulting value is returned.

237

Sending Explicit Messages

Section 9-1

In the routing format for rely hops, the first service code (in the routing service data) is 52 Hex, which is the Unconnected Send service.

Request path size (command):

Specifies the number of words of data that are specified in the request path field.

In the routing format for relay hops, the first request path size (in the routing service data) is 02 Hex.

Request path (command):

Specifies the request path (class ID, instance ID, etc.) in bytes. If there is an odd number of bytes, pad the last byte with a 0 so that the data is in full word units.

In the routing format for relay hops, the first request path (in the routing ser-

vice data) is 20 06 24 01 Hex (Connection Manager). For details, refer to the description of the Route Path inAppendix D CIP Message Communications.

Request data (command):

In the command, specify the data determined by the service code.

In the response, the reception data determined by the service code will be returned.

Priority/Time tick (command):

The timeout time specified by the Priority Time Tick is used as a base value to

specify the actual timeout value. For details, refer to the description of the Priority/Time Ticks and Time Out Ticks at the end ofAppendix D CIP Message Communications.

Time Out Ticks (command):

Specifies the base value of the timeout time. For details, refer to the description of the Priority/Time Ticks and Time Out Ticks at the end ofAppendix D CIP Message Communications.

Message request size (command):

Specifies the number of bytes of data from the second service code to the request data. The data size is specified in LSB, MSB order.

For example, if there are 400 bytes, the data size is 0190 hex bytes, which is entered as 90 01 hex.

Padding data (command):

If the message request size specifies an odd number of bytes, use 00 hex as padding in the last byte. The padding data is not required if there is an even number of bytes.

Route path size (command):

Specifies the number of words of data that are specified in the route path field.

Route path (command):

Specifies the path (route path) to the target device. For details, refer to the description of the Route Path inAppendix D CIP Message Communications.

No. of bytes received (response):

This hexadecimal value is returned to indicate the number of bytes of data received after the service code (response).

General status (response):

The general status defined in EtherNet/IP is returned. The normal response is 00 hex. For details, refer to the description of the Response Codes inAppendix D CIP Message Communications.

Additional status size (response):

238

Sending Explicit Messages

Section 9-1

This hexadecimal value is returned to indicate the number of words of data in the additional status field.

Additional status (response):

The additional status defined in EtherNet/IP is returned. For details, refer to the description of the Response Codes inAppendix D CIP Message Communications.

Service response data (response):

The reception data determined by the service code is returned.

Description

The CIP UCMM MESSAGE SEND command is used to send an Ether- Net/IP-definedexplicit message to another company’s node and receive a response.

Unlike other FINS commands, the destination of a CIP UCMM MESSAGE SEND command’s control data is the local node’s EtherNet/IP Unit or built-inEtherNet/IP port, and the actual destination node is specified in the command’s route path.

When an EtherNet/IP Unit or built-inEtherNet/IP port receives an explicit message, it automatically returns a response to the message.

When specifying the timeout time, the proper values are different for lasthop and relay-hopmethods. With thelast-hopmethod, set the timeout time for the actual request service processing. With therelay-hopmethod, the timeout for the relay path must be added to the timeout time for the actual request service processing.

In CIP routing, the node/Unit performing the routing subtracts the timeout time for 1 hop, deletes its own address from the routing information, and relays the message to the next node/Unit.

Set the following timeout values for command processing.

The maximum number of relay nodes (Units) is 16. If the number is more than 16, the explicit message send command may time out even if the conditions of network and each node (Unit) are normal. If more than 16 relay nodes (Units) have been set, a constant time must be specified for the request service processing timeout time (normally 0000 hex).

Priority Time Tick and Time Out Ticks =

(5 s × Number of relay nodes/Units) + Request processing timeout

Message monitoring time ≥ Priority Time Tick and Time Out Ticks

CMND(490) timeout set value = Message monitoring time

A timeout may occur sooner than the actual set value, depending on the point where the timeout occurs in the path.

General status = 01 hex, and Additional status = 0204 hex

A FINS timeout error response (0205 hex) may occur if the CMND(490) timeout set value or message monitoring time is less than the Priority Time Tick and Time Out Ticks.

Note 1. For details on the parameters of explicit messages, refer to the EtherNet/ IP and CIP specifications.

2.The Open DeviceNet Vendor Association, Inc. (ODVA) can be contacted at the following address to obtain copies of the EtherNet/IP and CIP specifications.

ODVA Headquarters

4220 Varsity Drive, Suite A

239

Sending Explicit Messages

Section 9-1

Ann Arbor, Michigan 48108-5006

USA

TEL: 1 734-975-8840

FAX: 1 734-922-0027

Email odva@odva.org

WEB www.odva.org

240

Sending Explicit Messages

Section 9-1

EXPLICIT MESSAGE SEND (28 01)

Command Block

Response Block

EXPLICIT MESSAGE SEND will send a DeviceNet Unit-compatibleexplicit message to the specified class of another node and receive a response.

The other node is specified with the destination node address in the command. The actual destination IP address is as follows.

Destination IP address = (Local IP address & Subnet mask) + Destination node address

28

01

 

 

468 bytes max.

Command

Class ID

Instance ID

Service data

code

Service code

 

 

Destination node address

 

 

Normal Response

 

 

 

 

 

 

 

 

 

 

 

28 01

00

00

 

 

 

 

498 bytes max.

 

 

 

 

 

 

 

 

 

 

 

Command

Response

No. of bytes

 

 

 

Service data

 

 

 

code

code

received

Service code

Destination node address (remote node)

Error Responses

The following response is returned if an error occurs for the explicit message.

 

 

 

 

 

 

 

 

 

28

01

00

00

 

 

94

 

 

 

 

 

 

 

 

 

 

Command

Response No. of bytes

 

 

Error code

 

 

code

 

code

received

Service code 94 (Hex)

Destination node address (remote node)

The following response is returned if the explicit message cannot be sent or times out.

 

 

 

 

 

 

 

 

 

28

01

 

 

 

 

 

 

 

 

 

 

 

 

Command

Response

 

 

code

code

Parameters

Destination node address (command):

The node address of the destination of the explicit message.

The node address of the local EtherNet/IP Unit or built-inEtherNet/IP port is specified in the control data for the CMND(490), but the node address of the actual destination is specified here in the FINS command. The destination node address cannot be set to 00 hex or FF hex.

Service code (command, response):

A service code defined for EtherNet/IP. In a normal response, bit 15 of the service code specified in the command will be turned ON and returned. In an error response, 94 Hex will always be returned.

241

Sending Explicit Messages

Section 9-1

Class ID (command):

The class ID of the destination of the explicit message.

Instance ID (command):

The instance ID of the destination of the explicit message.

Service data (command, response):

The data defined for the services codes.

No. of bytes received (response):

The number of bytes received from the destination node address (remote node).

Destination node address (remote node):

The node address of the OMRON Special I/O Slave Unit or Slave manufactured by another company to which the explicit message was sent is returned.

Error code (response):

An error code defined in EtherNet/IP (1-bytegeneral status and2-byteadditional status) is returned. The data format isDeviceNet-compatible(2 bytes total), so the returned Error Code is converted to the1-bytegeneral status and a1-byteadditional status (high byte only).

Description

The EXPLICIT MESSAGE SEND command is used to send an EtherNet/ IP-definedexplicit message to another company’s node and receive a response.

Unlike other FINS commands, the destination of a EXPLICIT MESSAGE SEND command’s control data is the local node’s EtherNet/IP Unit or built-inEtherNet/IP port, and the actual destination node is specified in the command’s route path.

Always specify the local node’s EtherNet/IP Unit or built-inEtherNet/IP port in the CMND(490) instruction’s control data. An error will occur if another node’s Master Unit is specified as the destination.

When an EtherNet/IP Unit or built-inEtherNet/IP port receives an explicit message, it automatically returns a response to the message.

A time of 2 s is used for request service processing timeouts.

Set the CMND(490) instruction’s timeout set value to 2 s or longer.

When there is a timeout, the error code will be 0102 hex.

When the CMND(490) instruction’s timeout set value is less than 2 s, a FINS timeout error response of 0205 hex may occur.

Note 1. For details on the parameters of explicit messages, refer to the EtherNet/ IP specifications.

2.The Open DeviceNet Vendor Association, Inc. (ODVA) can be contacted at the following address to obtain copies of the EtherNet/IP and CIP specifications.

ODVA Headquarters

4220 Varsity Drive, Suite A

Ann Arbor, Michigan 48108-5006USA

TEL: 1 734-975-8840FAX: 1734-922-0027

Email odva@odva.org WEB www.odva.org

242

Sending Explicit Messages

Section 9-1

9-1-1Sending Explicit Messages Using CMND(490)

With a CS/CJ-seriesEtherNet/IP Unit orbuilt-inEtherNet/IP port, a CMND(490) in the CPU Unit’s ladder program can send CIP UCMM explicit messages.

Send the CIP UCMM explicit message’s command data in a FINS command following the 2810 hex FINS command code.

The CIP UCMM explicit message’s response is received following the 2810 hex FINS command code and the FINS completion code.

The following command is used: [ CMND

S

D

C ]

S: First command word

D: First response word

C: First control data word

Command data is set in order starting with the word specified for the CMND(490) operand S (first command word) and continuing with words with higher addresses in I/O memory in the command block format.

Command Format Example: Get_Attribute_All Service to Identity Object

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Request path

 

 

 

 

 

 

 

 

 

 

 

 

 

28

10

 

00

00

05

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

DC

 

 

52

 

02

 

 

20

 

06

 

24

 

01

 

0A

 

0C

 

06

00

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Command

 

Transport

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Message

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

code

 

 

 

 

ID

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

request size

 

 

 

 

 

 

 

 

 

 

 

 

 

Service code

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Time Out Ticks

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Unconnected Send service: 52 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Priority/Time Tick

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Request path size = 2 words: 02 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Instance ID

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8-bitclass ID: 20 Hex

 

 

 

 

 

 

 

 

 

 

 

8-bitinstance ID: 24 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Class ID Connection Manager: 06 Hex

 

Routing service data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Request path

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Route path

 

 

 

 

01

02

 

20

01

24

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

01

 

 

08

 

00

 

 

12

 

 

0D

 

31

 

39

 

32

 

2E

 

31

36

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Route path

 

 

 

 

 

 

 

 

1

9

2

 

.

 

1

6

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

size

 

 

 

 

 

 

 

 

Route path size (13 bytes)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(8 words)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Instance ID

 

 

Ethernet port: 12 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8-bitinstance ID: 24 Hex

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Class ID

identity object

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8-bitclass ID

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Request path size (2 words)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Service code

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Get_Attribute_All service

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Last hop data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Routing service data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Route path

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

38

 

2E

 

32

 

35

 

30

 

 

2E

 

32

 

00

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

8

 

.

 

2

 

5

0

 

 

.

 

2

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Padding data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Routing service data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

243

Note
Request path data or request data that is in word (2-byte) or double-word (4- byte) units, such as word data and ERROR CLEAR codes, is specified from low to high (U) bytes in command block format. For example, to specify word data 1234 hex, specify 34 hex and then 12 hex. To specify the double word data 12345678 hex, specify 78 hex, 56 hex, 34 hex, and then 12 hex. The command blocks are shown in the following diagram.
The response data is set in the same way, starting from the word specified for CMND(490) operand D (first response word) and continuing with words with higher addresses in I/O memory in the response block format.
Service code = 01 hex (Get_Attribute_All service), Request path size = 02 hex 8-bit class ID = 20 hex, Class ID = 01 hex (Identity Object)
8-bit instance ID = 24 hex, Instance ID = 01 hex Route path size = 8 words
Ethernet port = 12 hex (Extended Link Address Size = 1 hex, Ethernet port number = 2 hex), Route path size = 13 bytes 1 9 2 .
1 6
8 .
2 5
0 .
2
Service code = 52 hex, Request path size = 02 hex
8-bit class ID = 20 hex, Class ID = 06 hex (Connection Manager) 8-bit instance ID = 24 hex (request path), Instance ID = 01 hex Priority/Time Tick = 0A hex, Time Out Ticks = 0C hex

Sending Explicit Messages

Section 9-1

Setting the Command Data for CMND(490)

Bit

15

08 07

00

 

S+0

 

28

 

10

 

FINS command code

 

S+1

 

00

 

00

 

Transport ID

 

S+2

 

05

 

DC

 

Message monitoring time

S+3

 

52

 

02

 

 

 

 

 

 

 

 

 

 

 

S+4

 

20

 

06

 

 

 

 

 

 

 

 

 

 

 

S+5

 

24

 

01

 

 

 

 

 

 

 

 

 

 

 

S+6

 

0A

 

0C

 

 

 

 

 

 

 

 

 

 

 

S+7

 

06

 

00

 

Message request size

 

S+8

 

01

 

02

 

 

 

S+9

 

20

 

01

 

Link

 

S+10

 

24

 

01

 

path

 

 

 

 

 

 

 

 

 

S+11

 

08

 

00

 

 

 

 

 

 

 

 

 

 

 

S+12

 

12

 

0D

 

 

 

 

 

 

 

 

 

 

 

S+13

 

31

 

39

 

 

 

 

 

 

 

 

 

 

 

S+14

 

32

 

2E

 

 

 

 

 

 

 

 

 

 

 

S+15

 

31

 

36

 

 

 

 

 

 

 

 

 

Route path

IP address

S+16

 

38

 

2E

 

S+17

 

32

 

35

 

 

192.168.250.2

S+18

 

30

 

2E

 

 

 

 

 

 

 

 

 

 

 

S+19

 

32

 

00

 

 

 

 

 

 

 

 

 

 

 

Command Block

Example: 1234 hex

Service Data

Example: 12345678 hex

Service Data

The format from CMND(490) operand S onwards will be set as follows:

Example: 1234 hex

Example: 12345678 hex

From higher byte

From higher byte

Bit

Bit

From lower byte

 

Bit

From lower byte

 

 

Bit

Similarly, when the additional status data and service response data in the response block is in word (2-byte)ordouble-word(4-byte)units, such as word

244

Sending Explicit Messages

 

 

 

 

 

 

 

 

 

Section 9-1

 

data and ERROR CLEAR codes, is also returned in the same order from low

 

to high bytes in the response block.

 

 

 

Example: Sending Explicit Messages Using CMND(490)

 

 

 

 

 

 

 

 

 

 

 

EtherNet/IP Unit

 

 

 

 

 

 

 

with unit number 0

 

 

 

 

 

 

 

 

PLC's

CMND(490)

 

 

 

 

 

CPU

instruction

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Unit

 

 

 

 

 

 

 

 

Network address: 01 hex

 

 

 

 

 

 

 

 

 

 

Node address: 05 hex

 

 

 

 

 

Unit address: 10 hex

 

 

 

 

 

 

 

 

 

 

 

 

Explicit

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

message

 

 

 

 

 

 

 

 

 

 

 

 

 

 

EtherNet/IP node of other manufacturer

Operation

The identity object information (class ID = 01 hex) is read from the other com-

 

pany’s EtherNet/IP node at IP address 192.168.250.2, using the CIP UCMM

 

MESSAGE SEND command, 28 10. The command data is stored in the DM

 

Area starting at DM01000, and the response data is stored in the DM Area

 

starting at D02000. If the command ends with an error, the end code is stored

 

in D00006 and command transmission is retried.

Command Details

[CMND

S

D

 

C ]

 

 

 

 

S = D01000: First command word

 

 

 

 

D01000

= 2810 hex

 

Command Code

 

D01001

= 0000 hex

 

Transport ID: 0000 hex

 

D01002

= 05DC hex

Message monitoring time: 15.00 s

 

D01003

= 5202 hex

 

Slave code: 52 hex (Unconnected Send)

 

 

 

 

Request path size: 2 words

 

D01004

= 2006 hex

 

Request path: 20 06 24 01 hex

 

 

 

 

(Connection Manager)

 

 

 

 

Class ID: 06 hex

 

D01005

= 2401 hex

 

Instance ID: 01 hex

 

Words S+6 to S+19 contain the request data.

 

D01006

= 0A0C hex

 

Priority/Time_Tick: 0A hex

 

 

 

 

Time Out Ticks: 0C hex

 

D01007

= 0600 hex

 

Message request size: 6 bytes

 

Words S+8 to S+10 contain the request message request.

 

D01008

= 0102 hex

 

Service: 01 hex (Get_Attribute_All)

 

 

 

 

Request path size: 2 words

 

Words S+9 and S+10 contain the request path.

 

D01009

= 2001 hex

 

8-bitclass ID: 20 hex

 

 

 

 

Class ID: 01 hex

 

D01010

= 2401 hex

 

8-bitinstance ID: 24 hex

 

 

 

 

Instance ID: 01 hex (Identity object)

 

Words S+11to S+19 contain the root path.

 

 

 

 

D01011

= 0800 hex

 

Route path size: 8 words

 

D01012

= 120D hex

 

Extended link address size = 1 hex

 

 

 

 

Route path size: 13 bytes (characters) = 0D hex

 

D01013

= 3139 hex

 

IP address: “19”

 

D01014

= 322E hex

 

IP address: “2.”

 

 

 

 

D01015

= 3136 hex

 

IP address: “16”

245

Sending Explicit Messages

 

 

 

Section 9-1

 

D01016

= 382E hex

IP address: “8.”

 

D01017

= 3235 hex

IP address: “25”

 

D01018

= 302E hex

IP address: “0.”

 

D01019

= 3200 hex

IP address: “2”

 

 

 

 

Padding data: 00 hex

 

D = D02000:

First response word at local node

 

C = D00000:

First control word

 

D00000

= 0028 hex

Number of command bytes: 40 bytes

 

D00001

= 0064 hex

Number of response bytes: 100 bytes

 

D00002

= 0001 hex

Destination network address: 1

 

D00003

= 0510 hex

Destination node address: 5

 

 

 

 

Destination unit address: FE hex (or 10 hex)

 

D00004

= 0000 hex

Response, communications port 0, no retries

 

D00005

= 00A0 hex

Response monitoring time: 16.0 s

Response

D02000 = 2801 hex

Command code

 

D02001

= 0000 hex

FINS completion code

 

D02002

= 0000 hex

Transport ID

 

D02003

= 001D hex

Number of bytes received: 29 bytes

 

D02004

= 8100 hex

Service code (response): 81 hex

 

 

 

 

Reserved: 00 hex

 

D02005

= 0000 hex

General status: 00 hex

 

 

 

 

Reserved: 00 hex

Words C+6 to C+18 contain the service response data.

D02006: 2F00 hex

D02007: 0C00 hex

D02008: 0C00 hex

D02009: 0101 hex

D020010: 3000 hex

D020011: 5303 hex

D020012: 0011 hex

D020013: 0A43 hex

D020014: 5331 hex

D020015: 572D hex

D020016: 4549 hex

D020017: 5032 hex

D020018: 3100 hex

246

Sending Explicit Messages

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Section 9-1

Program Example

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

A20011

 

 

 

 

 

 

 

 

(071)

 

 

 

 

 

 

 

 

 

 

 

 

Sets 0000 in D00000 to D02999.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

000000

 

 

 

 

 

 

 

 

 

 

BSET #0000 D00000 D02999

 

 

 

First Cycle Flag

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0028

D00000

 

 

Sets 0028 in D00000. (Number of send data bytes: 40)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

Sets 0064 in D00001. (Number of receive data bytes: 100).

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0064

D00001

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Sets 0001 in D00002. (Destination network address: 01).

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0001

D00002

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Sets 0510 in D00003. (Destination node address: 05, destination unit address: 10)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0510

D00003

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Sets 0000 in D00004.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0000

D00004

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

(Response required, port number 0, number of retries = 0)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Sets 00A0 in D00005. (Response monitoring time: 16.0 s)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#00A0

D00005

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#2810

D1000

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0000

D1001

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#05DC

D1002

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#5202

D1003

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#2006

D1004

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#2401

D1005

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0A0C

D1006

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0600

D1007

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0102

D1008

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#2001

D1009

 

 

 

 

Command data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#2401

D1010

 

 

 

 

Set the CIP UCMM MESSAGE SEND command's command data

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0800

D1011

 

 

 

 

in words D01000 to D01019 in routing data format.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#120D

D1012

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#3139

D1013

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#322E

D1014

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#3136

D1015

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#382E

D1016

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#3235

D1017

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#302E

D1018

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

 

 

 

 

 

Execution

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#3200

D1019

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(021)

 

 

 

 

 

 

 

 

Moves 0001 into CIO 0000.

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

#0001

0000

 

 

 

condition

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

000000

A20200

151100

 

 

(490)

 

 

 

 

 

 

 

 

 

 

 

 

Sends 8 bytes of command data to destination node address 06, receives

000013

 

 

 

 

 

 

 

 

 

 

CMND D01000 D02000 D00000

 

 

 

 

 

 

Communications

Online Flag

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

14 bytes of response data, and stores it in the local node starting at D02000.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(D00000 is control data.)

 

 

 

 

Enabled Flag

(n+11, bit 00)

 

 

 

 

 

 

 

 

 

 

(025)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

000001

A20200

A21900

 

 

 

 

 

 

(021)

 

 

 

ASL

0000

 

 

 

Shifts the contents of CIO 0000 one bit to the left.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Copies the completion code (network communications error response code)

000018

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

MOV

A203

D00006

 

 

 

 

 

 

Communications

Network Communication

 

 

 

 

 

 

(026)

 

 

 

 

from A203 to D00006.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Enabled Flag

Execution Error Flag

 

 

 

 

 

 

 

 

ASR

0000

 

 

 

Shifts the contents of CIO 0000 one bit to the right and

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

000024

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(001)

 

 

 

retries in the next cycle (CIO 000000 ON).

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

END

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

247

Receiving Explicit Messages

Section 9-2

9-2Receiving Explicit Messages

The CS/CJ-seriesEtherNet/IP Units andbuilt-inEtherNet/IP ports are equipped with a PLC Object that is functionally compatible withCS/CJ-seriesDeviceNet Units. The Unit will receive messages addressed to the PLC Object, process service requests addressed to the CPU Unit, and return responses. TheCS/CJ-seriesEtherNet/IP Units andbuilt-inEtherNet/IP ports support CIP unconnected message (UCMM) communications and CIP connected (Class 3) communications as reception functions.

The following services are provided by the PLC Object.

CPU Unit status read/write

CPU Unit I/O memory read/write

CPU Unit error log read/clear

Explicit messages can be received from the following sources:

EtherNet/IP nodes made by other manufacturers

OMRON PLCs with a CS/CJ-seriesEtherNet/IP Unit or a CPU Unit with abuilt-inEtherNet/IP port. (Messages fromCS/CJ-seriesEtherNet/IP Units andbuilt-inEtherNet/IP ports must be CIP unconnected messages (UCMM).)*

*Messages from CS/CJ-seriesEtherNet/IP Units andbuilt-inEtherNet/IP ports must be CIP unconnected messages (UCMM).

Example

CS/CJ-series

CS/CJ-series

 

 

EtherNet/IP Unit

EtherNet/IP Unit

CS/CJ-series

Other company's

CS/CJ-series

CPU Unit

 

Ethernet node

CPU Unit

Explicit messages can be sent.

Explicit message

Ethernet (EtherNet/IP)

Note For an EtherNet/IP Unit orbuilt-inEtherNet/IP port with version 2.0 or higher, change the class ID of the PLC Object from 2F hex to C4 hex.

When using a PLC Object with a DeviceNet Unit or EtherNet/IP Unit with version 1.0, and converting to EtherNet/IP Unit or built-inEtherNet/IP port with a version 2.0 or higher, the class ID must be changed according to the communications application.

248

Receiving Explicit Messages

Section 9-2

9-2-1List of PLC Object Services

PLC Objects provide the following services.

Status Read/Write for CPU Units

Services

Service

Class ID

Instance ID

Request

Contents

 

code

 

 

service data

 

 

 

 

 

 

 

CPU Unit Informa-

0E Hex

C4 Hex

00 Hex

Attribute ID =

Reads the operating mode of the

tion Read

 

(2F Hex)

 

64 Hex

CPU Unit.

 

 

(See note.)

 

 

 

 

 

 

Attribute ID =

Reads if there is a fatal or non-fatal

 

 

 

 

 

 

 

 

65 Hex

error in the CPU Unit.

 

 

 

 

 

 

 

 

 

 

Attribute ID =

Reads CPU Unit model.

 

 

 

 

66 Hex

 

 

 

 

 

 

 

CPU Unit Write

10 Hex

 

 

Attribute ID =

Changes the operating mode of the

 

 

 

 

64 Hex,

CPU Unit.

 

 

 

 

Attribute Value

 

 

 

 

 

 

 

 

 

 

 

Attribute ID =

Clears errors.

 

 

 

 

65 Hex

 

 

 

 

 

Attribute Value

 

 

 

 

 

 

 

CPU Unit Status

40 Hex

 

 

None

Reads the detailed status of the CPU

Read

 

 

 

 

Unit.

 

 

 

 

 

Operation status: Stop, run, CPU

 

 

 

 

 

standby

 

 

 

 

 

Operating modes: PROGRAM, MON-

 

 

 

 

 

ITOR, RUN

 

 

 

 

 

Fatal error information: Error flags,

 

 

 

 

 

including memory errors, I/O bus

 

 

 

 

 

errors, system errors

 

 

 

 

 

Messages: Message No. when MSB

 

 

 

 

 

instruction executed by CPU Unit

 

 

 

 

 

Error codes: Error code for the most

 

 

 

 

 

serious errors

 

 

 

 

 

Error messages: Messages stored in

 

 

 

 

 

CPU Unit when FAL/FALS instruction

 

 

 

 

 

executed

 

 

 

 

 

 

249

Receiving Explicit Messages

 

 

Section 9-2

I/O Memory Read/Write for CPU Units

 

 

 

 

 

 

 

 

 

Service

Service

Class ID

Instance ID

Request

Contents

 

code

 

 

service

 

 

 

 

 

data

 

 

 

 

 

 

 

Byte Data Read

1C Hex

C4 Hex

Specifies

Address, No.

Reads the specified node data in byte units.

 

 

(2F Hex)

area (01 Hex

of read bytes

The word data is read in order, from high to

 

 

(See note.)

to 14 Hex)

 

low bytes.

 

 

 

 

 

Read data: 200 bytes max.

 

 

 

 

 

 

Word Data

1D Hex

 

 

Address, No.

Reads the specified node data in word

Read

 

 

 

of read

units. The word data is read in order, from

 

 

 

 

words

high to low bytes.

 

 

 

 

 

Read data: 200 bytes max.

 

 

 

 

 

 

Byte Data Write

1E Hex

 

 

Address,

Writes the specified node data in byte units.

 

 

 

 

byte data

The word data is specified in order, from

 

 

 

 

 

high to low bytes.

 

 

 

 

 

Write data: 200 bytes max.

 

 

 

 

 

 

Word Data Write

1F Hex

 

 

Address

Writes the specified node data in word

 

 

 

 

word data

units. The word data is specified in order,

 

 

 

 

 

from high to low bytes.

 

 

 

 

 

Write data: 200 bytes max.

 

 

 

 

 

 

Note With a EtherNet/IP Unit orbuilt-inEtherNet/IP port with unit version 2.0 or later, the PLC object class ID is C4 hex. (With unit version 1.0, the PLC object class ID is F2 hex.)

The commands and responses for the explicit messages that can be sent and received are described on the following pages.

In the following command and response formats, all boxes represent 1 byte each.

250

Receiving Explicit Messages

Section 9-2

CPU Information Read (Service Code: 0E Hex)

Reads CPU Unit information, including operating mode, fatal/non-fatalerrors, and the CPU Unit model.

Command Block

0E

C4

00

 

(2F)

 

 

(*)

(*)

 

The class ID depends on the unit version. Version 2.0: The class ID is C4.

Version 1.0: The class ID is 2F.

Class ID Attribute ID

Instance ID

Service Code

Note A body format of either 8 bits or 16 bits is possible.

Response Block

8E

 

 

Service Code

 

 

 

Attribute Value

 

Parameters

Service code (command, response): 0E Hex is specified for commands.

 

For responses, the highest bit be ON and 8E Hex will be returned.

 

Class ID (command): Always C4 (2F).

 

 

The class ID depends on the unit version. The class ID is C4 for unit version

 

2.0, and 2F for unit version 1.0.

 

 

Instance ID (command): Always 00 Hex.

 

 

Attribute ID (command): The read information is specified by the attribute ID.

 

The attribute IDs are listed in the following table.

 

 

 

 

 

 

Attribute ID (Hex)

Contents

Attribute value size

 

 

 

 

 

64

CPU Unit operating mode

1 word (2 bytes)

 

 

 

 

 

65

CPU Unit errors

1 word (2 bytes)

 

 

 

 

 

66

CPU Unit model

22 bytes

 

 

 

 

CPU Operating Mode (when Attribute ID = 64 Hex) Reads the CPU Unit operating mode.

CPU Unit Errors (when Attribute ID = 65 Hex)

Reads if there are any fatal or non-fatalerrors in the CPU Unit.

CPU Unit Model (when Attribute ID = 66 Hex) Reads the CPU Unit model.

Read data (response): The specified information is returned in order.

• CPU Unit operating mode (attribute ID = 64 Hex).

The CPU Unit operating mode is returned in 1-word(2-byte)hexadecimal format, as follows:

0001 Hex: PROGRAM mode; 0002 Hex: MONITOR mode;

0004 Hex: RUN mode

PROGRAM mode

MONITOR mode

RUN mode

251

Receiving Explicit Messages

Section 9-2

Note The codes for the above modes are1-word(2-byte)data and are returned in low byte first. For example, for PROGRAM mode, the code is returned as 01 Hex followed by 00 Hex.

• CPU Unit Errors (when Attribute ID = 65 Hex)

The CPU Unit fatal/non-fatalerror data is returned in1-word(2-byte)hexadecimal format, as follows:

01 Hex: Error; 00 Hex: No error.

1: Error

• CPU Unit Model (when Attribute ID = 66 Hex)

The CPU Unit model is returned in ASCII.

Size: 2 bytes (Always 1400 Hex) + Model: 20 bytes (fixed). Unused area is filled with 20 Hex (spaces) and returned.

20 bytes

Byte Byte

Byte Byte Byte

 

Unit name

CPU Unit Write (Service Code: 10 Hex)

This PLC Object service writes CPU Unit information, including the operating mode and clearing errors.

Command Block

 

10

 

C4

 

00

 

 

 

 

 

 

(2F)

 

 

 

 

 

 

 

 

 

(*)

 

(*)

 

 

 

 

 

 

 

 

 

 

Attribute ID

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Class ID

 

 

Service Code

 

 

 

Attribute Value

 

 

 

 

 

 

 

 

 

 

 

 

 

Instance ID

The class ID depends on the unit version. Version 2.0: The class ID is C4.

Version 1.0: The class ID is 2F.

 

Note A body format of either 8 bits or 16 bits is possible.

 

Response Block

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

90

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Service Code

 

Parameters

 

Service code (command, response): 10 Hex is specified for commands. For

 

 

responses, the highest bit will turn ON and 90E Hex will be returned.

 

 

Class ID (command): Always C4 (2F).

 

 

 

The class ID depends on the unit version. The class ID is C4 for unit version

 

 

2.0, and 2F for unit version 1.0.

 

 

 

Instance ID (command): Always 00 Hex.

 

 

 

Attribute ID (command): Information to write is specified by the attribute ID.

 

 

The attribute IDs are listed in the following table.

 

 

 

 

 

 

 

 

 

Attribute ID (Hex)

 

Contents

Attribute value size

 

 

 

 

 

 

 

64

CPU Unit operating mode

1 word (2 bytes)

 

 

 

 

 

 

 

65

CPU Unit errors

1 word (2 bytes)

 

 

 

 

 

 

 

 

252

Receiving Explicit Messages

Section 9-2

CPU Operating Mode (Attribute ID = 64 Hex) Changes the CPU Unit operating mode.

The Attribute Values are as follows:

0001 Hex: PROGRAM mode; 0002 Hex: MONITOR mode;

0004 Hex: RUN mode

Note The specified code for the above operating modes are1-word(2-bytedata, and are specified with the low byte first. For example, for PROGRAM mode, the code is specified as 01 Hex followed by 00 Hex. Accordingly, the low to high bytes for the above codes are set as high to low bytes in I/O memory, when setting the codes as data for operand S of CMND(490).

Clearing CPU Unit Errors (when Attribute ID = 65 Hex)

Clears any fatal or non-fatalerrors in the CPU Unit. Sets the error clear code to Attribute Value. The error clear codes are listed in the following table.

Error code

Data cleared

(Hex)

 

 

 

FFFE

Current error (clears the highest priority error)

 

 

0008B

Interrupt task error

 

 

009A

Basic I/O error

 

 

009B

PLC Setup error

 

 

02F0

Inner Board non-fatalerror

 

 

0300 to 035F

Special I/O Unit error

 

 

00A0 to 00A1

SYSMAC BUS error

 

 

0500 to 055F

Special I/O Unit settings error

 

 

00E7

I/O verification error

 

When registered and actual I/O tables are different

 

When disconnecting or connecting I/O Units

 

 

00F7

Battery error

 

 

0200 to 020F

CS/CJ-seriesCPU Bus Unit error (last 2 digits are binary code for

 

the Unit No.)

 

For parity errors generated when data transferred between CS/CJ-

 

series CPU Bus Unit and CPU Unit

 

For watchdog timer errors in CS/CJ-seriesCPU Bus Unit

 

 

0400 to 040F

CPU Bus settings error (last 2 digits are binary code for the Unit

 

No.)

4101 to 42FF

System error (FAL): FAL instruction executed

 

 

 

Note Error clear codes are1-word(2-byte)data, so the above codes are specified with the low byte first. The low to high bytes for the above codes are set as high to low bytes in I/O memory, when setting the codes as data for operand S of CMND(490). For example, to specify battery error 00F7 Hex, specify the error code as F7 Hex followed by 00 Hex, as shown in the following diagram.

 

10

 

C4

 

00

 

65

 

F7

00

 

 

 

(2F)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Attribute ID

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Class ID

 

 

 

 

Service Code

 

 

 

 

Attribute Value

Instance ID

The class ID depends on the unit version. Version 2.0: The class ID is C4.

Version 1.0: The class ID is 2F.

253

Receiving Explicit Messages

Section 9-2

CPU Unit Status Read (Service Code: 40 Hex)

This PLC Object service reads status details (operation status, operating mode, fatal and non-fatalerrors, etc.) from the CPU Unit.

Command Block

40

 

C4

 

00

 

 

 

(2F)

 

 

The class ID depends on the unit version.

 

 

 

(*)

 

(*)

 

 

 

 

 

 

 

 

 

Version 2.0: The class ID is C4.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Version 1.0: The class ID is 2F.

 

 

 

 

 

 

 

 

 

 

Class ID

 

 

 

Service Code

 

 

 

 

 

 

 

Instance ID

 

 

Note A body format of either 8 bits or 16 bits is possible.

Response Block

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

C0

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Service Code

 

 

 

 

 

Detailed status

Parameters

 

Service code (command, response): 40 Hex is specified for commands. For

 

 

responses, the highest bit will turn ON and C0 Hex will be returned.

 

 

Class ID (command): Always C4 (2F).

 

 

The class ID depends on the unit version. The class ID is C4 for unit version

 

 

2.0, and 2F for unit version 1.0.

 

 

Instance ID (command): Always 00 Hex.

 

 

Read data (response): The read data is given in the following table. The data

 

 

is returned after the service code in the order shown in the table (high to low).

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Operation Status

 

 

 

 

 

 

 

RUN mode

 

 

 

 

 

 

 

Fatal error information (L)

 

 

 

 

 

 

 

Fatal error information (H)

 

 

 

 

 

 

 

Non-fatalerror information (L)

 

 

 

 

 

 

 

Non-fatalerror information (H)

 

 

 

 

 

 

 

Message exists/does not exist (L)

 

 

 

 

 

 

 

Message exists/does not exist (H)

 

 

 

 

 

 

 

Error code (L)

 

 

 

 

 

 

 

Error code (H)

 

 

 

 

 

 

 

Error message (16 bytes)

 

 

 

 

 

 

 

Operation status: Returns the operation status of the CPU Unit in1-byte

 

 

 

(2-digit)hexadecimal.

 

 

 

The values of bits 3 to 6 are not fixed. Always mask them when address-

 

 

 

ing the status data.

254