Read Tags from AB PLC using Netbiter with EtherNet/IP - Class, Instance, Attribute

I have a Netbiter device that has EtherNet/IP that I want to use to grab data from an Allen-Bradley Compactlogix.

Unfortunately it asks for the Class, Instance, and Attribute for the address of the tag in the compactlogix. See picture below.

I don't know what to put in the boxes with the "???" . How do i know which hex values do i need to use to identify a tag in the compactlogix using Class, Instance, and Attribute?

To address a Tag, you need to use the 0x4C Tag Read service, which encodes the Tag Name in its address segments.

If all you have is a Class, Instance, and Attribute you're only going to be able to get to objects that are accessible using services like "Get Attribute Single" or "Set Attribute Single". That's typically going to be an object in an I/O module or a drive or a sensor.

All the documentation I've seen for NetBiter stops after they describe their cloud-based VLAN and Remote Access functions.

What exact device and feature does that screenshot come from ?

Ken Roach said:

To address a Tag, you need to use the 0x4C Tag Read service, which encodes the Tag Name in its address segments.

If all you have is a Class, Instance, and Attribute you're only going to be able to get to objects that are accessible using services like "Get Attribute Single" or "Set Attribute Single". That's typically going to be an object in an I/O module or a drive or a sensor.

All the documentation I've seen for NetBiter stops after they describe their cloud-based VLAN and Remote Access functions.

What exact device and feature does that screenshot come from ?

Click to expand...

Its from the netbiter EC310 and the screenshot is from the EC310's configuration webpage for setting up tags in the netbiter.

Thanks for that info.

All of the documentation I can find stops at the Remote Access feature, using their hosted VPN to link up ControlLogix to RSLogix 5000.

HMS seldom promises more than they deliver. Have you talked to their Support guys ?

Ken Roach said:

Thanks for that info.

All of the documentation I can find stops at the Remote Access feature, using their hosted VPN to link up ControlLogix to RSLogix 5000.

HMS seldom promises more than they deliver. Have you talked to their Support guys ?

Click to expand...

Yes, i've emailed them and they said they were working on it but I need to check with them again. At some point they told me allen-bradley is suppose to provide these parameter values but allen-bradley told me the third party vendors should provide me with this information.

At some point they told me Allen-Bradley is suppose to provide these parameter values but Allen-Bradley told me the third party vendors should provide me with this information.

Click to expand...

The classic "Milwaukee Standoff".

My job used to be to solve those kinds of problems.

For kicks, let's see if we can get the basic function shown on that configuration webpage working.

Enter Class = 1, Instance = 1, Attribute = 1 is the "Vendor ID". It should receive the integer value 1, because Allen-Bradley is Vendor ID #1 at the ODVA.

Change the Attribute to 6 to read something more unique; that's the Serial Number.

If you can get those values to appear, you know that the basic CIP Object connectivity is working and we can move on to trying to figure out if there's supposed to be a way to read controller tags as well.

Ken,
I have been looking at this thread all day. I am also interested in this subject. Does RA have a manual or anything that gives the CIP Object info for the data in the processor? I looked for one and I couldn't find it.

Since user tags are not hard coded registers, the way N7 or B3 registers were in the past. How could there be a CIP Object for them? I imagine that there would be a object for the "user" memory area of the Processor but how would you pick a particular tag? I would think that he would have to "Map" his tags to some kind of "system" or hard coded register to be able to get them via CIP.

Am I off base here? Enlighten us master!!

Ken Roach said:

The classic "Milwaukee Standoff".

My job used to be to solve those kinds of problems.

For kicks, let's see if we can get the basic function shown on that configuration webpage working.

Enter Class = 1, Instance = 1, Attribute = 1 is the "Vendor ID". It should receive the integer value 1, because Allen-Bradley is Vendor ID #1 at the ODVA.

Change the Attribute to 6 to read something more unique; that's the Serial Number.

If you can get those values to appear, you know that the basic CIP Object connectivity is working and we can move on to trying to figure out if there's supposed to be a way to read controller tags as well.

Click to expand...

Ok, thank you, i'll give this a try.

I'm not really qualified to talk about how tag data access is done because I'm not a software developer. Probably Archie Jacobs could describe the process in detail. But the topic has come up, so here are some (non-exhaustive, simplified) comments.

It's easy to focus on the addressing syntax and forget that most automation protocols start with a "Service".

Like in Modbus... you're "reading register 40001" but really the protocol is sending a request to "execute service code 0x03, Offset 1, length 1".

It's the same principle in ControlLogix. The client software or communications driver needs to send a Service code along with the Class/Instance/Attribute address data, and any arguments or data payloads that go with it.

The NetBiter doesn't seem to provide a place to specify the Service Code by name or by number; it just has Class, Instance and Attribute. When that's all you see, it usually means that only the services Read Attribute Single and Write Attribute Single have been implemented.

Those are great for simple devices. In an AC drive, for example, Class 0x0F is the Parameter Class. The Instance number is the Parameter number, and the actual value of the parameter is Attribute 1.

A lot of third party devices make use of Class 0x64, the "Vendor Defined" object, and use it in a similar way where parameter "P0001" is Class 0x64, Instance 0x01, Attribute 0x01.

The ControlLogix tag database is too complex and flexible to be represented by a simple object like that.

Instead, you have to send a service like "Data Table Read", along with the Class, Instance, and Attribute for an 'ANSI Symbolic Identifier' and the data payload with that symbolic identifier, aka the Tag Name.

The RSLogix 5000 Data Access Manual (1756-PM020) is the published and supported reference manual for using CIP to perform these services.

I haven't even touched on the unconnected message manager object, the session registration protocol, the multiple service group code, or the physical memory optimization method.

What I'm curious about is what other options are on the combo-box drop down menu that is labeled "EtherNet/IP".

If one of them is "PCCC", then we have a good chance of setting up the NetBiter to treat the ControlLogix like a PLC-5/SLC500/MicroLogix controller and emulate their B or N or F data tables.

I also saw that the NetBiter just got its ODVA conformance test (which doesn't tell you much) in mid-December, and that the firmware that supports EtherNet/IP has only been out for a few weeks.

That makes it a little more forgivable that the documentation isn't easy to Google, but they really should have the user manual or some sort of example of how the device has been tested.

Why not just write a message instruction in the CLX. I did this with a Wago PLC last week. It's really very simple.

Good luck,

Yosi

Ken,
I got a "1" for the tag with an address of 01,01,01
I setup another tag with the address of 01,01,06 but i did not get a value, it seems to be blank. I have the tag as 16 bit, maybe i should try a different data length. Edit: I tried it with a 32 bit and i got a serial number back after reading from ODVA document that stated the serial is a 32 bit number, my result was "1615776900"

There is no "PCCC" option, just EtherNet/IP, modbus, and virtual ec300 series. I'm trying to get this to work for ethernet/ip, i realize modbus would probably work if i get a modbus server module for the AB PLC but we want to use ethernet/ip.


To (8{)} ( .),
What do you mean write a message instruction in the PLC? The netbiter is suppose to be the client and pull data from the PLC like an HMI. I shouldn't have to do anything in the PLC, but i'm open to ideas. Even if i were to write a message instruction that WRITES to the netbiter, i wouldn't have any idea what to put for the parameters for services like table write or cip generic. The netbiter does not give me any type of address register table.

I've got a bad feeling that the EtherNet/IP implementation on the NetBiter is not fully baked, or worse, was done without understanding the necessary functionality to exchange data with a ControlLogix.

While the product does have an ODVA Certificate of Compliance, and it can be said to "communicate on EtherNet/IP" in a limited way, I cannot see a way for it to communicate in any meaningful way to a ControlLogix CPU.

Is there any way you can intercept the traffic between the NetBiter and the ControlLogix with Wireshark and post the result here ? I expect that the NetBiter is using only CIP Service 0x0E (Get Attribute Single) but it would be interesting to see for sure.

I don't really want to speculate about why this feature is the way it is; my experience with HMS Fieldbus has always been positive and professional.

How much data do you have to transfer ?

If this were my system, I would get an HMS Anybus-Xgateway with EtherNet/IP Adapter/Slave on both sides to give myself a way to present a ControlLogix-controlled data object as an ordinary CIP Assembly Object.

As far as I can tell, neither the AnyBus Communicator nor the Anybus-X Modbus TCP devices will give you the necessary Modbus RTU Slave or Modbus/TCP Server functionality that the NetBiter can talk to.

A Red Lion DataStation Plus would also give you a way to bridge between ControlLogix and Modbus/TCP or Modbus RTU in order to get this system running.

There might be some method to address ControlLogix data storage memory with a simple Class/Instance/Attribute object identifier and the Get Attribute Single service that I am not aware of. I don't think there is, and I've done quite a lot of research on the topic in the past. But I am not a Rockwell Automation employee or an expert on EtherNet/IP communications driver development. If anyone else knows a way, or if HMS comes through with an explanation, I am eager to be wrong.

This is what I did...

To read data set
• the Service Type to : Get Attribute Single
• Class : 4
• Instance: 110
• Attribute 3

To write data set
• The Service type to : Set Attribute Single
• Class : 4
• Instance: 111
• Attribute 3

Good Luck,

Yosi