sib
Member
I need to control an SMC EX250-SEN1 SI unit from a Linux computer running custom network software that I am writing with socket level TCP/IP network code. I already figured out how to talk to the EX250-SEN1 including getting the following encapsulation commands to work: List Services, List Identity, Register Session, and Send RR Data. With Send RR Data I can query all the attributes of the Identity Object, read the values of the inputs at assembly object instance 100, and read the value of the outputs at assembly object instance 150.
I cannot figure out how to set the outputs. I tried the "Send RR Data" command and used "Set Attribute Single". I set my path to 3 words with assembly object 4, instance 150, and attribute 3 (I guessed this attribute value which seemed to work for reading inputs). Then I tacked on 4 bytes of data at the end of the packet. The EX250-SEN1 replies back with a success code, but the outputs don't change.
Is there something I am missing here? Do I need to set a timeout or use a different command other than "Send RR Data"? I don't have a copy of the Ethernet/IP spec, so I am guessing at a lot of the commands and values. Wireshark has helped me immensely to form my packets correctly. I just can't get the output bits to switch to a high state. How do I get the outputs to switch on? By the way, I do have 24V hooked up to the solenoid power, if that matters, and I have a bunch of solenoids in the block.
Attached is a text file from Wireshark showing some Ethernet/IP packets going back and forth between my PC and the EX250-SEN1. It starts out registering a session, and then I do a couple of Get Attribute Single commands and try to do a Set Attribute Single command to set the outputs. But when I read back the value of the outputs, you can see they are all 0.
The following is a dump of my Send RR Data packet, and the reply from the EX250-SEN1:
No. Time Source Destination Protocol Info
3674 4620.093402 192.168.1.11 192.168.1.30 CIP Set Attribute Single
Frame 3674 (106 bytes on wire, 106 bytes captured)
Ethernet II, Src: 192.168.1.11 (00:14:22:e0:c8:34), Dst: 192.168.1.30 (00:30:11:02:63:6c)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.30 (192.168.1.30)
Transmission Control Protocol, Src Port: 1645 (1645), Dst Port: 44818 (44818), Seq: 173, Ack: 192, Len: 52
EtherNet/IP (Industrial Protocol), Session: 0x70021A00, Send RR Data
Encapsulation Header
Command: Send RR Data (0x006f)
Length: 28
Session Handle: 0x70021a00
Status: Success (0x00000000)
Sender Context: C0A8010B00000000
Options: 0x00000000
Command Specific Data
Interface Handle: CIP (0x00000000)
Timeout: 0
Item Count: 2
Type ID: Null Address Item (0x0000)
Length: 0
Type ID: Unconnected Data Item (0x00b2)
Length: 12
Common Industrial Protocol
Service: Set Attribute Single (Request)
0... .... = Request/Response: Request (0x00)
.001 0000 = Service: Set Attribute Single (0x10)
Request Path Size: 3 (words)
Request Path: Assembly Object, Instance: 0x96, Attribute: 0x03
8-Bit Logical Class Segment (0x20)
Class: Assembly Object (0x04)
8-Bit Logical Instance Segment (0x24)
Instance: 0x96
8-Bit Logical Attribute Segment (0x30)
Attribute: 0x03
Command Specific Data
Data: FFFFFFFF
0000 00 30 11 02 63 6c 00 14 22 e0 c8 34 08 00 45 00 .0..cl.."..4..E.
0010 00 5c b4 d6 40 00 80 06 c2 4b c0 a8 01 0b c0 a8 .\[email protected]......
0020 01 1e 06 6d af 12 1b 8f 5f c6 00 d2 61 69 50 18 ...m...._...aiP.
0030 fe 7d 83 c8 00 00 6f 00 1c 00 00 1a 02 70 00 00 .}....o......p..
0040 00 00 c0 a8 01 0b 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 00 02 00 00 00 00 00 b2 00 0c 00 10 03 ................
0060 20 04 24 96 30 03 ff ff ff ff .$.0.....
No. Time Source Destination Protocol Info
3675 4620.096872 192.168.1.30 192.168.1.11 CIP Success
Frame 3675 (98 bytes on wire, 98 bytes captured)
Ethernet II, Src: 192.168.1.30 (00:30:11:02:63:6c), Dst: 192.168.1.11 (00:14:22:e0:c8:34)
Internet Protocol, Src: 192.168.1.30 (192.168.1.30), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: 44818 (44818), Dst Port: 1645 (1645), Seq: 192, Ack: 225, Len: 44
EtherNet/IP (Industrial Protocol), Session: 0x70021A00, Send RR Data
Encapsulation Header
Command: Send RR Data (0x006f)
Length: 20
Session Handle: 0x70021a00
Status: Success (0x00000000)
Sender Context: C0A8010B00000000
Options: 0x00000000
Command Specific Data
Interface Handle: CIP (0x00000000)
Timeout: 0
Item Count: 2
Type ID: Null Address Item (0x0000)
Length: 0
Type ID: Unconnected Data Item (0x00b2)
Length: 4
Common Industrial Protocol
Service: Set Attribute Single (Response)
1... .... = Request/Response: Response (0x01)
.001 0000 = Service: Set Attribute Single (0x10)
Status: Success
General Status: Success (0x00)
Additional Status Size: 0 (word)
0000 00 14 22 e0 c8 34 00 30 11 02 63 6c 08 00 45 00 .."..4.0..cl..E.
0010 00 54 01 00 00 00 1e 06 18 2b c0 a8 01 1e c0 a8 .T.......+......
0020 01 0b af 12 06 6d 00 d2 61 69 1b 8f 5f fa 50 18 .....m..ai.._.P.
0030 10 00 f9 a2 00 00 6f 00 14 00 00 1a 02 70 00 00 ......o......p..
0040 00 00 c0 a8 01 0b 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 00 02 00 00 00 00 00 b2 00 04 00 90 00 ................
0060 00 00 ..
Thanks for any help you may have!
-Mark
I cannot figure out how to set the outputs. I tried the "Send RR Data" command and used "Set Attribute Single". I set my path to 3 words with assembly object 4, instance 150, and attribute 3 (I guessed this attribute value which seemed to work for reading inputs). Then I tacked on 4 bytes of data at the end of the packet. The EX250-SEN1 replies back with a success code, but the outputs don't change.
Is there something I am missing here? Do I need to set a timeout or use a different command other than "Send RR Data"? I don't have a copy of the Ethernet/IP spec, so I am guessing at a lot of the commands and values. Wireshark has helped me immensely to form my packets correctly. I just can't get the output bits to switch to a high state. How do I get the outputs to switch on? By the way, I do have 24V hooked up to the solenoid power, if that matters, and I have a bunch of solenoids in the block.
Attached is a text file from Wireshark showing some Ethernet/IP packets going back and forth between my PC and the EX250-SEN1. It starts out registering a session, and then I do a couple of Get Attribute Single commands and try to do a Set Attribute Single command to set the outputs. But when I read back the value of the outputs, you can see they are all 0.
The following is a dump of my Send RR Data packet, and the reply from the EX250-SEN1:
No. Time Source Destination Protocol Info
3674 4620.093402 192.168.1.11 192.168.1.30 CIP Set Attribute Single
Frame 3674 (106 bytes on wire, 106 bytes captured)
Ethernet II, Src: 192.168.1.11 (00:14:22:e0:c8:34), Dst: 192.168.1.30 (00:30:11:02:63:6c)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.30 (192.168.1.30)
Transmission Control Protocol, Src Port: 1645 (1645), Dst Port: 44818 (44818), Seq: 173, Ack: 192, Len: 52
EtherNet/IP (Industrial Protocol), Session: 0x70021A00, Send RR Data
Encapsulation Header
Command: Send RR Data (0x006f)
Length: 28
Session Handle: 0x70021a00
Status: Success (0x00000000)
Sender Context: C0A8010B00000000
Options: 0x00000000
Command Specific Data
Interface Handle: CIP (0x00000000)
Timeout: 0
Item Count: 2
Type ID: Null Address Item (0x0000)
Length: 0
Type ID: Unconnected Data Item (0x00b2)
Length: 12
Common Industrial Protocol
Service: Set Attribute Single (Request)
0... .... = Request/Response: Request (0x00)
.001 0000 = Service: Set Attribute Single (0x10)
Request Path Size: 3 (words)
Request Path: Assembly Object, Instance: 0x96, Attribute: 0x03
8-Bit Logical Class Segment (0x20)
Class: Assembly Object (0x04)
8-Bit Logical Instance Segment (0x24)
Instance: 0x96
8-Bit Logical Attribute Segment (0x30)
Attribute: 0x03
Command Specific Data
Data: FFFFFFFF
0000 00 30 11 02 63 6c 00 14 22 e0 c8 34 08 00 45 00 .0..cl.."..4..E.
0010 00 5c b4 d6 40 00 80 06 c2 4b c0 a8 01 0b c0 a8 .\[email protected]......
0020 01 1e 06 6d af 12 1b 8f 5f c6 00 d2 61 69 50 18 ...m...._...aiP.
0030 fe 7d 83 c8 00 00 6f 00 1c 00 00 1a 02 70 00 00 .}....o......p..
0040 00 00 c0 a8 01 0b 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 00 02 00 00 00 00 00 b2 00 0c 00 10 03 ................
0060 20 04 24 96 30 03 ff ff ff ff .$.0.....
No. Time Source Destination Protocol Info
3675 4620.096872 192.168.1.30 192.168.1.11 CIP Success
Frame 3675 (98 bytes on wire, 98 bytes captured)
Ethernet II, Src: 192.168.1.30 (00:30:11:02:63:6c), Dst: 192.168.1.11 (00:14:22:e0:c8:34)
Internet Protocol, Src: 192.168.1.30 (192.168.1.30), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: 44818 (44818), Dst Port: 1645 (1645), Seq: 192, Ack: 225, Len: 44
EtherNet/IP (Industrial Protocol), Session: 0x70021A00, Send RR Data
Encapsulation Header
Command: Send RR Data (0x006f)
Length: 20
Session Handle: 0x70021a00
Status: Success (0x00000000)
Sender Context: C0A8010B00000000
Options: 0x00000000
Command Specific Data
Interface Handle: CIP (0x00000000)
Timeout: 0
Item Count: 2
Type ID: Null Address Item (0x0000)
Length: 0
Type ID: Unconnected Data Item (0x00b2)
Length: 4
Common Industrial Protocol
Service: Set Attribute Single (Response)
1... .... = Request/Response: Response (0x01)
.001 0000 = Service: Set Attribute Single (0x10)
Status: Success
General Status: Success (0x00)
Additional Status Size: 0 (word)
0000 00 14 22 e0 c8 34 00 30 11 02 63 6c 08 00 45 00 .."..4.0..cl..E.
0010 00 54 01 00 00 00 1e 06 18 2b c0 a8 01 1e c0 a8 .T.......+......
0020 01 0b af 12 06 6d 00 d2 61 69 1b 8f 5f fa 50 18 .....m..ai.._.P.
0030 10 00 f9 a2 00 00 6f 00 14 00 00 1a 02 70 00 00 ......o......p..
0040 00 00 c0 a8 01 0b 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 00 02 00 00 00 00 00 b2 00 04 00 90 00 ................
0060 00 00 ..
Thanks for any help you may have!
-Mark
