Rockwell Automation 1756 ControlLogix, 1756 GuardLogix, 1769 CompactLogix, 1769 Compact GuardLogix, 1789 SoftLogix Programming Manual
...
Programming Manual
Logix 5000 Controllers Data Access
1756 ControlLogix, 1756 GuardLogix, 1769 CompactLogix,
1769 Compact GuardLogix, 1789 SoftLogix, 5069
CompactLogix, 5069 Compact GuardLogix, Studio 5000
Logix Emulate
Original Instructions
Logix 5000 Controllers Data Access
personal injury or death, property damage, or economic loss.
Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.
temperatures.
for Personal Protective Equipment (PPE).
Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to familiarize
themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws, and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to
be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be
impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use
or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software
described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is
prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss.
Identifies information that is critical for successful application and understanding of the product.
Labels may also be on or inside the equipment to provide specific precautions.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous
ARC FLASH HAZARD:
will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and
Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash
2 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
Change
Topic
Updated branding.
Throughout
Summary of Changes
This manual includes new and updated information. Use these reference
tables to locate changed information.
Grammatical and editorial style changes are not included in this summary.
Global changes
This table identifies changes that apply to all information about a subject in
the manual and the reason for the change. For example, the addition of new
supported hardware, a software design change, or additional reference
material would result in changes to all of the topics that deal with that subject.
Updated Legal notices. Legal notices on page 10
New or enhanced features
None in this version.
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 3
Summary of Changes
CIP services
Table of Contents
Preface
Studio 5000 environment .......................................................................... 9
Additional resources ................................................................................... 9
Legal notices ...............................................................................................10
Chapter 1
CIP Services Overview ............................................................................... 11
CIP Data Types ..................................................................................... 11
Atomic data type sizes ................................................................... 12
Logix 5000 data .................................................................................... 12
Tag type service parameter ................................................................. 13
Tag type service parameter values used with Logix controllers . 13
Analysis ................................................................................................. 13
Segment Encoding ............................................................................... 13
Logical Segments ........................................................................... 14
Symbolic Segments ........................................................................ 14
CIP Service Request/Response Format .............................................. 15
Services Supported by Logix 5000 Controllers ........................................ 16
Read Tag Service .................................................................................. 18
Example Using Symbolic Segment Addressing .......................... 18
Example Using Symbol Instance Addressing .............................. 18
Read Tag Service Error Codes ....................................................... 19
Read Tag Fragmented Service ............................................................. 19
Example Using Symbolic Segment Addressing ......................... 20
Example Using Symbol Instance Addressing .............................. 21
Read Tag Fragmented Service Error Codes .................................23
Write Tag Service ................................................................................ 24
Example Using Symbolic Segment Addressing ......................... 24
Example Using Symbol Instance Addressing ............................. 24
Write Tag Service Error Codes .................................................... 25
Write Tag Fragmented Service .......................................................... 25
Example Using Symbolic Segment Addressing ......................... 26
Example Using Symbol Instance Addressing ............................. 27
Write Tag Fragmented Service Error Codes............................... 29
Read Modify Write Tag Service.......................................................... 30
Service Request Parameters ......................................................... 30
Example ......................................................................................... 30
Read Modify Write Tag Service Error Codes ............................... 31
Multiple Service Packet Service .................................................... 31
Example .......................................................................................... 31
Logix Data Structures ................................................................................32
Work with Data Structures ................................................................. 33
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 5
Table of Contents
CIP Services and
CIP Addressing Examples
User-created Tags
Tag type service parameters for structure ......................................... 34
Chapter 2
How tags are organized in the controller ................................................ 37
Symbol object ...................................................................................... 38
Template object ................................................................................... 38
Create and maintain a symbol object list ................................................ 40
Step 1: Find user-created controller scope tags in a Logix 5000
controller ..................................................................................................... 41
Retrieve all symbol object instances ................................................... 41
Example of retrieving the first group of tags .................................... 42
Analysis ................................................................................................ 42
Continue the retrieval process ...................................................... 43
Step 2: Isolate user-created tags from system tags/identifying
structured tags ............................................................................................44
Symbol Type Attribute .........................................................................44
Eliminate tags by applying rules.................................................. 46
Step 3: Determine the structure makeup for a specific structure .......... 47
Example of reading template attributes ............................................ 47
Analysis ................................................................................................ 48
Structure data format ................................................................... 49
Contents of the member information ......................................... 50
Example of retrieving member information .............................. 50
Example ......................................................................................... 50
More about BOOLS in UDTs ........................................................ 52
Step 4: Determine the data packing of the members of a structure when
accessed as a whole..................................................................................... 53
Example of reading an entire structure ............................................. 53
Step 5: Determine when the tags list and structure information need
refreshing .................................................................................................... 54
How to detect changes ......................................................................... 54
6 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
Chapter 3
Atomic Members of Predefined Data Types ............................................ 57
Example 1 (Symbolic Segment Addressing Method)......................... 57
Example 2 (Symbol Instance Addressing Method) .......................... 58
Example 3 (Symbolic Segment Addressing Method) ....................... 58
Example 4 (Symbolic Segment Addressing Method) ........................59
Example 5 (Symbol Instance Addressing Method) ............................59
Example 6 (Symbolic Segment Addressing Method) ....................... 60
Example 7 (Symbolic Segment Addressing Method) ........................ 61
Example 8 (Both Addressing Methods) .............................................. 61
CIP Over the Controller
Serial Port
Index
Table of Contents
Example 9 (Both Addressing Methods) ............................................. 62
Example 10 (Symbolic Segment Addressing Method) with BOOLs 62
Access User-Defined Structures ................................................................ 63
Example 1 ............................................................................................. 64
Example 2............................................................................................. 64
Example 3 ..............................................................................................65
Example 4 ..............................................................................................65
Example 5 ............................................................................................. 66
Example 6 ............................................................................................. 66
Chapter 4
Unconnected Messaging (UCMM) through PCCC ................................ 69
Connected Explicit Messages through PCCC ......................................... 70
Fragmentation Protocol ........................................................................... 72
PCCC Commands ....................................................................................... 73
Supported Subset of PCCC Commands ................................................... 73
Initial Fields of All PCCC Commands ....................................................... 74
PLC-2 Communication Commands .......................................................... 75
Unprotected Read (CMD=01, 41; FNC not present) ........................... 75
Protected Write (CMD=00, 40; FNC not present) ............................. 75
Unprotected Write (CMD=08, 48; FNC not present) ........................ 75
Protected Bit Write (CMD=02, 42; FNC not present) ........................ 76
Unprotected Bit Write (CMD=05, 45; FNC not present) ................... 76
PLC-5 Communication Commands .......................................................... 77
Addressing examples ........................................................................... 77
Read Modify Write N (CMD=0F, 4F; FNC=79) .................................. 78
Typed Read (CMD=0F, 4F; FNC=68) ................................................... 79
Typed Write (CMD=0F, 4F; FNC=67) .................................................. 79
Word Range Read (CMD=0F, 4F; FNC=01) ........................................ 79
Word Range Write (CMD=0F, 4F; FNC=00) ..................................... 80
Bit Write (CMD=0F, 4F; FNC=02) ...................................................... 80
SLC Communication Commands ............................................................. 81
SLC Protected Typed Logical Read with 3 Address Fields (CMD=0F,
4F; FNC=A2) .......................................................................................... 81
SLC Protected Typed Logical Write with 3 Address Fields(CMD=0F,
4F, FNC=AA) ........................................................................................ 82
SLC Protected Typed Logical Read with 2 Address Fields (CMD=0F,
4F; FNC=A1) ......................................................................................... 82
SLC Protected Typed Logical Write with 2 Address Fields (CMD=0F,
4F; FNC=A9) ......................................................................................... 83
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 7
Resource
Description
at http://ab.rockwellautomation.com
and other certification details.
Studio 5000 environment
Additional resources
Preface
Before using this document:
• Have a thorough understanding of CIP and EtherNet/IP.
• Have purchased a copy of the pertinent volumes of the CIP Networks
Library.
• Be properly licensed through ODVA to use the CIP technology.
For more information on the CIP Networks Library and CIP technologies,
contact ODVA at http://www.odva.org/
The Studio 5000 Automation Engineering & Design Environment® combines
engineering and design elements into a common environment. The first
element is the Studio 5000 Logix Designer® application. The Logix Designer
application is the rebranding of RSLogix 5000® software and will continue to
be the product to program Logix 5000™ controllers for discrete, process,
batch, motion, safety, and drive-based solutions.
.
The Studio 5000® environment is the foundation for the future of
Rockwell Automation® engineering design tools and capabilities. The Studio
5000 environment is the one place for design engineers to develop all
elements of their control system.
These documents contain additional information concerning related
Rockwell Automation products.
Industrial Automation Wiring and Grounding
Guidelines, publication 1770-4.1
Product Certifications webpage, available
Provides general guidelines for installing a Rockwell
Automation industrial system.
Provides declarations of conformity, certificates,
View or download publications
at http://www.rockwellautomation.com/literature
. To order paper copies of
technical documentation, contact the local Rockwell Automation distributor
or sales representative.
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 9
Preface
Legal notices
Rockwell Automation publishes legal notices, such as privacy policies, license
agreements, trademark disclosures, and other terms and conditions on
the Legal Notices
page of the Rockwell Automation website.
End User License Agreement (EULA)
You can view the Rockwell Automation End User License Agreement (EULA)
by opening the license.rtf file located in your product's install folder on your
hard drive.
The default location of this file is:
C:\Program Files (x86)\Common Files\Rockwell\license.rtf.
Open Source Software Licenses
The software included in this product contains copyrighted software that is
licensed under one or more open source licenses.
You can view a full list of all open source software used in this product and
their corresponding licenses by opening the oss_license.txt file located your
product's OPENSOURCE folder on your hard drive. This file is divided into
these sections:
• Components
Includes the name of the open source component, its version number,
and the type of license.
• Copyright Text
Includes the name of the open source component, its version number,
and the copyright declaration.
• Licenses
Includes the name of the license, the list of open source components
citing the license, and the terms of the license.
The default location of this file is:
C:\Program Files (x86)\Common Files\Rockwell\Help\<product
name>\Release Notes\OPENSOURCE\oss_licenses.txt.
You may obtain Corresponding Source code for open source packages
included in this product from their respective project web site(s).
Alternatively, you may obtain complete Corresponding Source code by
contacting Rockwell Automation via the Contact form on the Rockwell
Automation website:
http://www.rockwellautomation.com/global/aboutus/contact/contact.page. Please include "Open Source" as part of the request
text.
10 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
CIP Services Overview
CIP Data Types
Chapter 1
CIP services
Communicating with Logix 5000 controllers require using CIP explicit
messaging. This chapter describes the subset of the CIP explicit messaging
constructs for understanding the service explanations that follow.
See also
CIP services overview on page 11
Tag type service parameter on page 13
Analysis on page 13
Segment Encoding on page 13
CIP Service Request/Response Format on page 15
Before using CIP services, review introductory information:
• CIP data types
• Logix 5000 data
• Tag Type Service parameter
• Segment encoding
• CIP Service Request/Response format
Data type information is very important in all aspects of CIP communication.
The type information is used for reading, writing, and, if necessary,
deciphering structures. The Logix 5000 controller supports these data types.
• Atomic. A bit, byte, 16-bit word, or 32-bit word, each of which stores a
single value. (CIP refers to these as Elementary Data Types.)
• Structure. A grouping of different data types that functions as a single
unit and serves a specific purpose. Depending on the needs of the
application, create additional structures, which are referred to as userdefined structures.
• Array. A sequence of elements, each of which is the same data type.
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 11
• Define data in one, two, or three dimensions, as required (one
dimension is the most common).
• Use atomic or structure data types.
Data in the controller is organized as tags. The tags come in two basic types:
atomic and structure. Atomic types can be arrayed or singular, and are very
Chapter 1 CIP services
To store a
Use this data type
8-bit integer
SINT
16-bit integer
INT
32-bit integer
DINT
32-bit float
REAL
64-bit integer
LINT
Atomic data type sizes
Logix 5000 data
easy to work with. Structure types provide a great deal of flexibility, but are
more challenging to access. See the Atomic data type sizes table for details.
See also
CIP services overview on page 11
Atomic data type sizes on page 12
Logix 5000 data on page 12
Use the atomic data type sizes table for the data type value to use to store a
bit.
Bit BOOL
Bit array DWORD (32-bit boolean array)
The Logix 5000 controller stores data in tags, in contrast to a PLC-5 or SLC
controller, which stores data in data files. Logix 5000 tags have these
properties:
• Name that identifies the data:
• Up to 40 characters in length.
• Scope:
• Controller (global), accessed directly.
• Program (local), which cannot be directly accessed, but can be
copied to a controller scope tag.
• Data type, which defines the organization of the data.
See CIP data types for more information.
In the Logix Designer application, version 21.00.00 and later, and in RSLogix
5000 software, version 18.00.00 and later, external access to controller scoped
tags is user selectable. If a tag’s External Access attribute is set to None, then
the tag cannot be accessed from outside the controller.
For more information about external access to controller scoped tags see the
Logix 5000 Controllers I/O and Tag Data Programming Manual
, publication
1756-PM004.
12 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
For more information about tags and data types, see the Logix 5000
Controllers Design Considerations Reference Manual, publication 1756RM094.
Data Type
Tag Type Value
Size of Transmitted Data
INT
0x00C3
2 bytes
DINT
0x00C4
4 bytes
REAL
0x00CA
4 bytes
bytes = Multi-byte data values are transmitted low-byte first
Tag type service parameter
Tag type service parameter
Analysis
Segment Encoding
Chapter 1 CIP services
See also
CIP data types on page 11
The Read tag, Write Tag, Read Tag Fragmented, Write Tag Fragmented, and
Read-Modify-Write Tag services require a service parameter that identifies
the data type of the tag being referenced. This tag type parameter is:
• A 16-bit value for atomic tags
• Two 16-bit values for structured tags
The value used for structures is a calculated value. For details, see Tag type
service parameters for structures.
The tag type values used for atomic tags and the resulting data size are shown
in the table shown in Tag type service parameter values used with Logix controllers.
See also
Tag type service parameters for structures on page 34
values used with
Logix controllers
Use this table for date types, tag type values, and size of transmitted data for
Logix controllers.
BOOL 0x0nc1
The BOOL value includes an additional
field (n) for specifying the bit position
within the SINT (n = 0-7).
SINT 0x00C2 1 byte
DWORD 0x00D3 4 bytes
LINT 0x00C5 8 bytes
1 byte
These values are based on the CIP Data Type Reporting Values that are
defined in Volume 1, Appendix C of the CIP Networks Library, but are extended
to 16-bits.
The Request Path in a CIP explicit message contains addressing information
indicating which internal resource in the target node directs the service. This
addressing information is organized by using Logical Segments, Symbolic
Segments, or both.
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 13
For more detailed information about segments, see the CIP Networks Library,
Volume 1, Appendix C.
Chapter 1 CIP services
Segment Type
Value
Byte Order Representation of Element ID Value (low byte first)
0 1 … n n+1
16-bit Element ID
0x29
00
Low
High
N/A
N/A
Segment Type
Value
Byte Order Representation of Class ID Value (low byte first)
0 1 … n n+1
8-bit Class ID
0x20
Value
N/A
N/A
N/A
N/A
16-bit Class ID
0x21
00
Low
High
N/A
N/A
Segment Type
Value
Byte Order Representation of Instance ID Value (low byte first)
0 1 … n n+1
16-bit Instance ID
0x25
00
Low
High
N/A
N/A
Segment Type
Value
Byte Order Representation of Attribute ID Value (low byte first)
0 1 … n n+1
16-bit Attribute ID
0x31
00
Low
High
N/A
N/A
Logical Segments
Symbolic Segments
The following is a summary of the Logical Segment types defined by CIP that
are supported by the Logix 5000 controller.
See also
CIP services overview on page 11
These tables explain the Logical Segments. Not all segment types defined by
CIP are supported by Logix 5000 controllers.
8-bit Element ID 0x28 Value N/A N/A N/A N/A
32-bit Element ID 0x2A 00 Lowest Low High Highest
8-bit Instance ID 0x24 Value N/A N/A N/A N/A
8-bit Attribute ID 0x30 Value N/A N/A N/A N/A
See also
CIP services on page 11
Segment Encoding on page 13
CIP defines a way to reference items by their symbolic name. The segment
used is the ANSI Extended Symbol Segment defined in the CIP Networks
Library, Volume 1, Appendix C.
14 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
Segment Type
Value
Byte Order Representation (low byte first)
0 1 … N N+1
Symbolic
Message Request
Description
Request Service
Indicates to the object referenced in the request path to perform a task. The CIP
are not found in the CIP Networks Library.
Symbolic segments or both.
service-specific data.
CIP Service
Chapter 1 CIP services
The Read/Write tags services can use these segments in the request path to
indicate which target tag to operate on. When addressing an arrayed tag, the
Logical Segment for Element ID is also used with the Symbolic Segment.
Request/Response Format
ANSI Extended
0x91 Length 1st char … Nth Char (1)
See also
Segment Encoding on page 13
All CIP services follow the Message Router Request/Response format defined
in the CIP Networks Library, Volume 1, Chapter 2. For complete descriptions, see
the CIP Networks Library. All requests take this form.
Field
or the device manufacturer define these tasks. Most of the services covered in
this manual are defined by the Rockwell Automation vendor-specific objects, and
Request Path Size A byte value that indicates the number of 16-bit words in the Request Path.
Request Path A variable sized field that consists of one or more segments. The path references
the item that services operate on in the controller. The path contains Logical or
Request Data The service-specific data that is delivered to the object referenced in the
Request Path. This field only appears in the message frame if a service has
This same form is used for ControlNet and EtherNet/IP communication CIPbased networks. Requests received through the serial port use another
protocol.
Use the CIP service format for CIP-explicit messages and to deliver connected
or unconnected messages to the controller. The mechanisms for doing this are
CIP-network specific. For example, for EtherNet/IP access, see the CIP
Networks Library, Volume 1 unconnected, Chapter 3 and the EtherNet/IP Adaptation
of CIP, Volume 2.
For more information about using the EtherNet/IP network to communicate
with the controller, see
http://www.rockwellautomation.com/rockwellautomation/solutionsservices/oem/design-develop-deliver/information-enabled-solutions.page.
We recommend using connected messaging whenever possible. Be aware that
the information presented here does not replace the need to be properly
authorized by ODVA, Inc. to use the Ethernet/IP protocol.
The examples used throughout the manual show only the explicit message
protocol elements and not the network-specific details. The exception to this is
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 15
Chapter 1 CIP services
Message Response
Description
Extended Status Size
An 8-bit value that indicates how many 16-bit values follow in the additional status
field. For status=0 (success) this is 0.
when the size field is > 0.
frame if a service has service-specific data.
Addressing Method
How it Works
When to Use
Symbolic Segment
Uses the name of the tag in an ASCII format using
the controller
For best performance in applications that access
the information in CIP Over the Controller Serial Port, which shows more details
of unconnected versus connected explicit messages, and of the PCCC and DF1
layers. All responses take the general form as shown in the table.
Field
Reply Service The request service with the MSB set to 1.
00 Reserved.
General Status An 8-bit value indicating success or error status. The CIP Networks Library,
Volume 1, Appendix B has a list of the general status codes. The object class
specified in the request path defines any extended status codes for each service
defined for that class.
Extended Status The array of 16-bit values that describe the general status code. Only present
Reply Data The data returned by the service request. This field only appears in the message
See also
Services Supported by Logix 5000 Controllers
CIP Over the Controller Serial Port on page 69
PCCC Commands on page 73
These sections describe the inherent mode of communication and addressing
of the Logix 5000 controller. The following vendor-specific services operate
on tags in the controller using symbolic addressing:
• Read Tag Service (0x4c)
• Read Tag Fragmented Service (0x52)
• Write Tag Service (0x4d)
• Write Tag Fragmented Service (0x53)
• Read Modify Write Tag Service (0x4e)
The first four services preceding can be used with two addressing methods:
• Symbolic Segment Addressing
• Symbol Instance Addressing (available in version 21 and later.)
This table describes the addressing methods.
•
ANSI Extended Symbolic Segments
• Allows direct access to the tags as displayed in
the Logix Designer application Data Monitor
• The number of characters in the name affects:
• Packet size
• The number of services that can fit in the
Multiple Service Packet service
The parsing time of the incoming message in
•
•
small to moderate amounts of data.
• For improving performance by organizing the data
into user-defined structures and accessing those
structures.
16 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
Addressing Method
How it Works
When to Use
Service
Service name in earlier versions of this manual,
Service name in Logix Designer
Read Tag Service
CIP Read Data
CIP Data Table Read
Multiple Service Packet Service
Multiple Service Packet Service
Multi-Request Service
Chapter 1 CIP services
Symbol Instance • Uses the instance ID of the symbol class for the
tag you want to access.
• The client application that accesses the
controller
• Retrieve the symbol instance information from
•
must
:
the controller to associate the name of the tag
with its instance ID
Use the instance ID to access the tag.
Also use the Multiple Service Packet Service (0x0a) to combine multiple requests
in one message frame. This improves performance when accessing many tags
by minimizing the time to transmit and process multiple packets. The number
of requests that are included is limited by the size of each request. This
depends on the content of the request. For example, the number of characters
in the tag names impacts the number of requests combined by the Multiple
Service Packet Service. For further information, see Multiple Service Packet
Service.
These services have more descriptive names than earlier versions of this
publication.
For best performance in applications that access a
large number of tags.
Read Tag Fragmented Service Read Data Fragmented Format N/A
Write Tag Service CIP Write Data CIP Data Table Write
Write Tag Fragmented Service Write Data Fragmented Format N/A
For further information on services, refer to the services topics in this chapter.
For examples showing more complex addressing using both types of
addressing, see CIP Addressing Examples.
For further information on the Request Data and Reply Data, refer to the
examples in this chapter.
See also
Multiple Service Packet Service on page 31
CIP Addressing Examples on page 57
Read Tag Service on page 18
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 17
Read Tag Fragmented Service on page 19
Write Tag Service on page 24
Chapter 1 CIP services
1st Message Request Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Request Path Size
06
Request Path is 6 words (12 bytes) long
Request Data
01 00
Number of elements to read (1)
1st Message Reply Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Reserved
00
Reply Data
C4 00
DINT Tag Type Value
Read Tag Service
Example Using Symbolic
Example Using Symbol
The Read Tag Service reads the data associated with the tag specified in the
path.
• Any data that fits into the reply packet is returned, even if it does not
all fit.
• If all the data does not fit into the packet, the error 0x06 is returned
along with the data.
• When reading a two or three dimensional array of data, all dimensions
must be specified.
• When reading a BOOL tag, the values returned for 0 and 1 are 0 and
0xFF, respectively.
See also
Services Supported by Logix 5000 Controllers on page 16
Example Using Symbolic Segment Addressing on page 18
Example Using Symbol Instance Addressing on page 18
Segment Addressing
Request Service 4C Read Tag Service (Request)
Request Path 91 0A 54 6F 74 61 6C 43 6F 75 6E 74 ANSI Ext. Symbolic Segment for
Reply Service CC Read Tag Service (Reply)
General Status 00 Success
Extended Status Size 00 No extended status
Read a single tag named rate using Symbolic Segment Addressing. The tag
has a data type of DINT and a value of 534. The value used for Instance ID was
determined using methods described in CIP Services and User-created Tags.
TotalCount
16 02 00 00 0000216 = 534 decimal
See also
Instance Addressing
18 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
CIP Services and User-created Tags on page 37
Read a single tag named rate using Symbol Instance Addressing. The tag has a
data type of DINT and a value of 534.
1st Message Request Field
Bytes (in hex)
Description - Symbol Instance Addressing
Request Path Size
03
Request Path is 3 words (6 bytes) long
1st Message Reply Field
Bytes (in hex)
Description - Symbol Instance Addressing
Reserved
00
Extended Status Size
00
No extended status
Reply Data
C4 00
DINT Tag Type Value
Error Code (Hex)
Extended Error (Hex)
Description of Error
0x05
0x0000
Request Path destination unknown: Probably instance number is not present.
0x06
N/A
Insufficient Packet Space: Not enough room in the response buffer for all the data.
0x13
N/A
Insufficient Request Data: Data too short for expected parameters.
Read Tag Service
Read Tag
Request Service 4C Read Tag Service (Request)
Chapter 1 CIP services
Request Path 20 6B
25 00 8F F6
Request Data 01 00 Number of elements to read (1)
Logical Segment for Symbol Class ID
Logical Segment for Instance ID of the tag
Reply Service CC Read Tag Service (Reply)
General Status 00 Success
16 02 00 00 0000216 = 534 decimal
See also
Read Tag Service on page 18
Services Supported by Logix 5000 Controllers on page 16
Both Symbolic Segment Addressing and Symbol Instance Addressing may
return these errors.
Error Codes
rate
0x04 0x0000 A syntax error was detected decoding the Request Path.
0x26 N/A The Request Path Size received was shorter or longer than expected.
0xFF 0x2105 General Error: Access beyond end of the object.
See also
Read Tag Service on page 18
The Read Tag Fragmented Service enables client applications to read a tag
with data that does not fit into a single packet (approximately 500 bytes). The
Fragmented Service
client must issue a series of requests to the controller to retrieve the data
using this service. The client must change the Offset field value with each
request by the number of bytes transferred in the response to the previous
request.
The Byte Offset field is expressed in number of bytes regardless of the data
type being read. In the example following, the data type being read is SINT,
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 19
Chapter 1 CIP services
1st Message Request Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Request Path Size
06
Request Path is 6 words (12 bytes) long
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
ANSI Ext. Symbolic Segment for
TotalCount
00 00 00 00
Start at this byte offset (0) and return as much as will fit
1st Message Reply Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Reserved
00
Extended Status Size
00
No extended status
2nd Message Request Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Request Path Size
06
Request Path is 6 words (12 bytes) long
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
ANSI Ext. Symbolic Segment for
TotalCount
2nd Message Reply Field
Bytes (in hex)
Description - Symbolic Segment Addressing
General Status
06
Reply Data Too Large
Extended Status Size
00
No extended status
Example Using Symbolic
Segment Addressing
Request Service 52 Read Tag Fragmented Service (Request)
Request Data D6 06 Number of elements to read (1750)
which happens to be a byte. The elements and offset are in the same units,
which is not the case for other data types.
See also
CIP services on page 11
Services Supported by Logix 5000 Controllers on page 16
Reading the tag TotalCount that has 1750 SINTs consists of these four service
requests with service data, as shown in the tables.
Reply Service D2 Read Tag Fragmented Service (Reply)
General Status 06 Reply Data Too Large
Reply Data C2 00 SINT Tag Type Value
nn nn nn…nn Data for Elements 0 through 489
Request Service 52 Read Tag Fragmented Service (Request)
Request Data D6 06 Number of elements to read (1750)
EA 01 00 00 Start at this byte offset (490) and return as much as will fit
Reply Service D2 Read Tag Fragmented Service (Reply)
Reserved 00
Reply Data C2 00 SINT Tag Type Value
20 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
nn nn nn…nn Data for Elements 490 through 979
3rd Message Request Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Request Path Size
06
Request Path is 6 words (12 bytes) long
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
ANSI Ext. Symbolic Segment for
TotalCount
3rd Message Reply Field
Bytes (in hex)
Description - Symbolic Segment Addressing
4th Message Request Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Request Path Size
06
Request Path is 6 words (12 bytes) long
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
ANSI Ext. Symbolic Segment for
TotalCount
4th Message Reply Field
Bytes (in hex)
Description - Symbolic Segment Addressing
General Status
00
Success
1st Message Request Field
Bytes (in hex)
Description - Symbol Instance Addressing
Example Using Symbol
Request Service 52 Read Tag Fragmented Service (Request)
Request Data D6 06 Number of elements to read (1750)
D4 03 00 00 Start at this offset (980) and return as much as will fit
Chapter 1 CIP services
Reply Service D2 Read Tag Fragmented Service (Reply)
Reserved 00
General Status 06 Reply Data Too Large
Extended Status Size 00 No extended status
Reply Data C2 00 SINT Tag Type Value
nn nn nn…nn Data for Elements 980 through 1469
Request Service 52 Read Tag Fragmented Service (Request)
Request Data D6 06 Number of elements to read (1750)
BE 05 00 00 Start at this offset (1470) and return as much as will fit
Reply Service D2 Read Tag Fragmented Service (Reply)
Reserved 00
Extended Status Size 00 No extended status
Reply Data C2 00 SINT Tag Type Value
nn nn nn…nn Data for Elements 1470 through1749
See also
Read Tag Fragmented Service Error Codes on page 23
Instance Addressing
Request Service 52 Read Tag Fragmented Service (Request)
Request Path Size 03 Request Path is 3 words (6 bytes) long
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 21
Reading the tag TotalCount that has 1750 SINTs using Symbol Instance
Addressing would consist of these four service requests with service data, as
shown in the tables. The value used for Instance ID was determined using
methods described in CIP Services and User-created Tags.
Chapter 1 CIP services
1st Message Request Field
Bytes (in hex)
Description - Symbol Instance Addressing
Data Offset
00 00 00 00
Start at this element (0) and return as much will fit
1st Message Reply Field
Bytes (in hex)
Description - Symbol Instance Addressing
Reserved
00
General Status
06
Reply Data Too Large
Extended Status Size
00
No extended status
nn nn nn…nn
Data for Elements 0 thorough 489
2nd Message Request Field
Bytes (in hex)
Description - Symbol Instance Addressing
Data Offset
EA 01 00 00
Start at this element (490) and return as much will fit
2nd Message Reply Field
Bytes (in hex)
Description - Symbol Instance Addressing
Reserved
00 General Status
06
Reply Data Too Large
3rd Message Request Field
Bytes (in hex)
Description - Symbol Instance Addressing
Request Service
52
Read Tag Fragmented Service (Request)
Request Path Size
03
Request Path is 3 words (6 bytes) long
3rd Message Reply Field
Bytes (in hex)
Description - Symbol Instance Addressing
Reserved
00
Request Path 20 6B
25 00 1A E0
Logical Segment for Symbol Class ID
Logical Segment for Instance ID for the tag
Request Data D6 06 Number of elements to read (1750)
Reply Service D2 Read Tag Fragmented Service (Reply)
Reply Data C2 00 SINT Tag Type Value
Request Service 52 Read Tag Fragmented Service (Request)
Request Path Size 03 Request Path is 3 words (6 bytes) long
Request Path 20 6B
25 00 1A E0
Request Data D6 06 Number of elements to read (1750)
Logical Segment for Symbol Class ID
Logical Segment for Instance ID for the tag
TotalCount
TotalCount
)
Reply Service D2 Read Tag Fragmented Service (Reply)
Extended Status Size 00 No extended status
Reply Data C2 00 SINT Tag Type Value
nn nn nn…nn Data for Element 490 through 979
Request Path 20 6B
25 00 1A E0
Request Data D6 06 Number of elements to read (1750)
Data Offset D4 03 00 00 Start at this element (980) and return as much will fit
Logical Segment for Symbol Class ID
Logical Segment for Instance ID for the tag
TotalCount
Reply Service D2 Read Tag Fragmented Service (Reply)
22 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
General Status
06
Reply Data Too Large
Extended Status Size
00
No extended status
4th Message Request Field
Bytes (in hex)
Description - Symbol Instance Addressing
Data Offset
BE 05 00 00
Start at this element (1470) and return as much will fit
4th Message Reply Field
Bytes (in hex)
Description - Symbol Instance Addressing
Reserved
00 General Status
06
Reply Data Too Large
Error Code (Hex)
Extended Error (Hex)
Description of Error
0x05
0x0000
Request Path destination unknown: probably instance number is not present.
0x06
N/A
Insufficient Packet Space: Not enough room in the response buffer for all the data.
0x13
N/A
Insufficient Request Data: Data too short for expected parameters.
0x26
N/A
The Request Path Size received was shorter or longer than expected.
Read Tag Fragmented
Reply Data C2 00 SINT Tag Type Value
nn nn nn…nn Data for Elements 980 through 1469
Chapter 1 CIP services
Request Service 52 Read Tag Fragmented Service (Request)
Request Path Size 03 Request Path is 3 words (6 bytes) long
Request Path 20 6B
25 00 1A E0
Request Data D6 06 Number of elements to read (1750)
Logical Segment for Symbol Class ID
Logical Segment for Instance ID for the tag
Reply Service D2 Read Tag Fragmented Service (Reply)
TotalCount
Extended Status Size 00 No extended status
Reply Data C2 00 SINT Tag Type Value
nn nn nn…nn Data for Elements 1490 through 1749
Each response, except the last one, shows the General Status of 06, Reply Data
Too Large, to indicate that more data is present than is in this particular frame.
The last response shows the General Status of 0 indicating that the data read
did not exceed the message size limit. This means that the entire sequence of
bytes has been read.
See also
CIP Services and User-created Tags on page 37
The Symbolic Segment Addressing and Symbol Instance Addressing may
return these errors.
Service Error Codes
0x04 0x0000 A syntax error was detected decoding the Request Path.
0xFF 0x2105 General Error: Number of Elements or Byte Offset is beyond the end of the requested tag.
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 23
Chapter 1 CIP services
Message Request Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Request Path Size
06
Request Path is 6 words (12 bytes) long
0E 00 00 00
Data 0000000E=14 decimal
Message Reply Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Reserved
00
General Status
00
Success
Message Request Field
Bytes (in hex)
Description - Symbol Instance Addressing
Write Tag Service
Example Using Symbolic
Segment Addressing
See also
CIP services on page 11
Services Supported by Logix 5000 Controllers on page 16
The Write Tag Service writes the data associated with the tag specified in the
path. The tag type must match for the write to occur. The controller validates
the tag type matches before executing the service.
• When writing a two or three dimensional array of data, all dimensions
must be specified.
• When writing to a BOOL tag, any non-zero value is interpreted as 1.
See also
Write Tag Service Error Codes on page 25
Write the value of 14 to a DINT tag named CartonSize using Symbolic Segment
Addressing.
Request Service 4D Write Tag Service (Request)
Request Path 91 0A 43 61 72 74 6F 6E 53 69 7A 65 ANSI Ext. Symbolic Segment for
Request Data C4 00 DINT Tag Type Value
01 00 Number of elements to write (1)
Reply Service CD Write Tag Service (Reply)
Extended Status Size 00 No extended status
See also
Write Tag Service on page 24
Example Using Symbol Instance Addressing
Write the value of 14 to a DINT tag named CartonSize using Symbolic Instance
Addressing. The value used for Instance ID was determined using methods
described in CIP Services and User-created Tags.
CartonSize
Request Service 4D Write Tag Service (Request)
Request Path Size 03 Request Path is 3 words (6 bytes) long
24 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
Message Request Field
Bytes (in hex)
Description - Symbol Instance Addressing
Message Reply Field
Bytes (in hex)
Description - Symbol Instance Addressing
Reserved
00
Extended Status Size
00
No extended status
Error Code (Hex)
Extended Error (Hex)
Description of Error
0x10
0x2101
Device state conflict: keyswitch position: The requestor is changing force
0xFF
0x2107
General Error: Tag type used n request does not match the target tag’s data type.
Write Tag Service
Write Tag
Chapter 1 CIP services
Error Codes
Request Path 20 6B
25 00 36 71
Request Data C4 00 DINT Tag Type Value
01 00 Number of elements to write (1)
0E 00 00 00 Data 0000000E=14 decimal
Logical Segment for Symbol Class ID
Logical Segment for Instance ID for the tag
Reply Service CD Write Tag Service (Reply)
General Status 00 Success
See also
CIP Services and User-created Tags on page 37
The Symbolic Segment Addressing and Symbol Instance Addressing may
returns these error codes.
CartonSize
0x04 0x0000 A syntax error was detected decoding the Request Path.
0x05 0x0000 Request Path destination unknown: Probably instance number is not present.
0x10 0x2802 Device state conflict: Safety Status: The controller is in a state in which Safety
0x13 N/A Insufficient Request Data: Data too short for expected parameters.
0x26 N/A The Request Path Size received was shorter or longer than expected.
0xFF 0x2105 General Error: Number of Elements extends beyond the end of the requested tag.
Fragmented Service
information in HARD RUN mode.
Memory cannot be modified.
See also
Write Tag Service on page 24
The Write Tag Fragmented Service enables client applications to write to a tag
in the controller whose data will not fit into a single packet (approximately
500 bytes). The client must issue a series of requests to the controller to write
all data using this service.
The Request Service, Request Path Size, Request Path, and Number of
Elements fields remain the same for each request. The client must change the
byte offset field value with each request by the number of bytes it transferred
in the previous request.
Rockwell Automation Publication 1756-PM020G-EN-P - September 2020 25
Chapter 1 CIP services
1st Message Request Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
ANSI Ext. Symbolic Segment for
TotalCount
00 00 00 00
Start at this offset.
nn, nn, …nn
Element Data for Elements 0 through 473
1st Message Reply Field
Bytes (in hex)
Description - Symbolic Segment Addressing
2nd Message Request Field
Bytes (in hex)
Description - Symbolic Segment Addressing
2nd Message Reply Field
Bytes (in hex)
Description - Symbolic Segment Addressing
Example Using Symbolic
Segment Addressing
Request Service 53 Read Tag Fragmented Service (Request)
Request Path Size 06 Request Path is 6 words (12 bytes) long
The Byte Offset field is expressed in number of bytes regardless of the data
type being read. In the examples that follow, the data type being read is SINT,
which happens to be a byte. In this case, the elements and offset are in the
same units, which is not the case for other data types.
See also
Example Using Symbolic Segment Addressing on page 26
Example Using Symbol Instance Addressing on page 27
Writing 1750 SINTs to the tag TotalCount using Symbolic Segment Addressing
would consist of the following four service requests with service data as
shown in the tables that follow. The value used for Instance ID was
determined using methods described in CIP Services and User-created Tags.
Request Data C2 00 SINT Tag Type Value
D6 06 Total number of elements to write (1750)
Reply Service D3 Write Tag Fragmented Service (Reply)
Reserved 00
General Status 00 Success
Extended Status Size 00 No extended status
Request Service 53 Write Tag Fragmented Service (Request)
Request Path Size 06 Request Path is 6 words (12 bytes) long
Request Path 91 0A 54 6F 74 61 6C 43 6F 75 6E 74 ANSI Ext. Symbolic Segment for
Request Data C2 00 SINT Tag Type Value
D6 06 Total number of elements to write (1750)
DA 01 00 00 Start at this offset.
nn, nn, …nn Element Data for Elements 474 through 947
TotalCount
Reply Service D3 Write Tag Fragmented Service (Reply)
Reserved 00
General Status 00 Success
26 Rockwell Automation Publication 1756-PM020G-EN-P - September 2020
Loading...