cardosocea
Member
The lengths people go to just to continue to work with Fisher Price automation products...
Array Visitors - useful? mad useful? maddeningly useless?
- Thread starter JeremyM
- Start date
JeremyM
Lifetime Supporting Member
OP
Best we can do is work with the tools and on occasion find and apply cool stuff like undocumented "CanBeNull" attributes.
Uploaded a fixed sample.
Lesson learned: an OTE on null reference (even behind XRP check) will cause a major fault. Has to be OTL/OTU pair. Easy fix, but easy to miss.
With this, one can cast the generic bytes of a parameter value to any provided references to baked-in types (or another parameter payload).
Last edited:
Just because you seem like the type that would be interested:
Any bit level instruction (XIC, XIO, OTE) except OTL/OTU with an invalid indirect addressing pointer will cause a major fault, even if that instruction is preceded by an AFI.
Any integer level instructions with an invalid indirect addressing pointer will only cause a major fault if it is forced to be evaluated (i.e. the rung on which it resides is scanned, and the rung-in condition to the instruction is true).
I learned this the hard way.
JeremyM
Lifetime Supporting Member
OP
Good info.
I discovered this weekend that if you pass MESSAGE or MODULE into AOIs, you can then COP these InOuts to a DINT, revealing their data table address (or CIP class instance). Haven’t ironed it conclusively but these values are definitely unique among all instances.
You can do the same to a MESSAGE outside of an AOI.
MODULE appears to require being passed into something before you can resolve it.
I discovered this weekend that if you pass MESSAGE or MODULE into AOIs, you can then COP these InOuts to a DINT, revealing their data table address (or CIP class instance). Haven’t ironed it conclusively but these values are definitely unique among all instances.
You can do the same to a MESSAGE outside of an AOI.
MODULE appears to require being passed into something before you can resolve it.
Last edited:
tlf30
Lifetime Supporting Member
Wow, I'm interested. Have you tried with other types of InOuts?
I would be interested in comparing this to a symbol dump of the controller and seeing if a hidden symbol's data could be accessed this way.
I would be interested in comparing this to a symbol dump of the controller and seeing if a hidden symbol's data could be accessed this way.
Contr_Conn
Member
How do you know the DINT array size needed?
JeremyM
Lifetime Supporting Member
OP
MESSAGE is 240 bytes and MODULE is 4 bytes.
tlf30
Lifetime Supporting Member
I'm going to have to try this on the bench. With the messages, could this method be used to access the service field? I imaging it is stored somewhere in the symbol, but perhaps not.
JeremyM
Lifetime Supporting Member
OP
It's not stored in the MESSAGE structure. In fact, a MESSAGE isn't actually a tag in the usual sense. It's a 1:1 reference to an object of a Message class that happens to have some serviceable attributes (Path, Status, .EN, and so on). This is why you can't make arrays of them, nor make them members of a UDT/AOI.
So when you call MSG(MyMsg) instruction, the MyMsg [i.e. MESSAGE] user data is passed-by-reference to the Message class, then the class goes on to look up the actual, internal Message instance with the MESSAGE's hidden reference-to, and then it applies the valid/applicable user data/configuration to it (based on service code) before finally transmitting the CIP connection bytes. It then returns, by reference-to your MESSAGE, the result code, etc.
So when you call MSG(MyMsg) instruction, the MyMsg [i.e. MESSAGE] user data is passed-by-reference to the Message class, then the class goes on to look up the actual, internal Message instance with the MESSAGE's hidden reference-to, and then it applies the valid/applicable user data/configuration to it (based on service code) before finally transmitting the CIP connection bytes. It then returns, by reference-to your MESSAGE, the result code, etc.
Last edited:
tlf30
Lifetime Supporting Member
Oh, now that is fascinating. Do you know which class that is? A quick look at the ADF files, it looks like class 0x8D. Now I am wondering if I can use a message to reconfigure a message
I wonder what the message instruction does to the CIP object, send a start service command? I wonder if messages can actually be triggered with other messages?
I wonder what the message instruction does to the CIP object, send a start service command? I wonder if messages can actually be triggered with other messages?
JeremyM
Lifetime Supporting Member
OP
Notice how the MESSAGE structure has no data that describes a CIP generic MESSAGE's source/response data arrays?
Those fields you fill in are also just references to tag data instances. Both of those, and the service code, are passed directly to the applicable Message class object from *your Studio session* with yet another service code when you hit 'apply.'
This is why you can't change source/destination data tags programmatically (they're pointers), but can still change source length to inform the actual Message instance of how far to iterate over source data when you use something like CIP service 0x03.
Those fields you fill in are also just references to tag data instances. Both of those, and the service code, are passed directly to the applicable Message class object from *your Studio session* with yet another service code when you hit 'apply.'
This is why you can't change source/destination data tags programmatically (they're pointers), but can still change source length to inform the actual Message instance of how far to iterate over source data when you use something like CIP service 0x03.
Last edited:
tlf30
Lifetime Supporting Member
Very fascinating insight, thank you. Tonight when I have some time I WILL be messing with this on my test bench. I have several initial thoughts on how to "use" this. I wonder if I can make an AOI for reconfiguring messages. It would be quite interesting. Perhaps not practical, but interesting nonetheless.
JeremyM
Lifetime Supporting Member
OP
What you can do, and what I think is the starting point, is to COP(Msg, DINT, 1).
For every MESSAGE in your project, this produces the unique, hidden value found in its first 4 bytes.
You can't do the reverse by COP(Something, Msg, 1), nor can you COP(Msg1, Msg2, 1).
You also cannot do CIP data table reads/writes against MESSAGE instances.
All access beyond the user parameter structure we call a MESSAGE must be done with other messages to the class itself.
For every MESSAGE in your project, this produces the unique, hidden value found in its first 4 bytes.
You can't do the reverse by COP(Something, Msg, 1), nor can you COP(Msg1, Msg2, 1).
You also cannot do CIP data table reads/writes against MESSAGE instances.
All access beyond the user parameter structure we call a MESSAGE must be done with other messages to the class itself.
Last edited:
JeremyM
Lifetime Supporting Member
OP
So those first 4 bytes weren't the way, but their uniqueness make them useful because...
... I figured out how to change a message programmatically.
... I figured out how to change a message programmatically.
Last edited:
Similar Topics
Hi, I'm having an issue in crimson 3.0 when I create a programme using a case statement referencing a fault word that each bit needs to change the...
I am trying to copy an array of real numbers into a UDT with a real data type element. I have attached a snip below showing my COP instruction...
I have an array of 55 REAL values. Is there a way to multiply based on the array location ?
I have 55 transfer belts that are equally spaced...
Hello everyone,
I'm working on a project that involves controlling an array of nozzles within a CNC environment, where the nozzles travel along a...
Hi.
I'm using a Modbus ProSoft where I basically map data to a big INT array.
Example, where GX_I_63HPU is a REAL, MNETC.DATA.WriteData[200] an...