Practice: very first post: on EtherNet/IP solution Productivity PLC and ML1100/1400

GBolin1972

Member
Join Date
Aug 2017
Location
Nebraska
Posts
3
This is my first post on ANY forum and following the first private message I received I am posting this here so bear with me.

I have been working on making our new Productivity Family PLCs talk using EtherNet/IP to our Allen-Bradley Micrologix 1100, and 1400 PLCs.

Up to this point, I have not seen any successful information on this, so when I managed to get some success I figured I should share it. I am hoping this doesn't open up any IP rights' can of worms and I don't know how to tell but I share this to at least help fellow integrators and so I also being cautious with this.

I was able to setup a Productivity 2000 processor and have it read N7 and other files on several (10) ML1100s and 1400s using the Productivity as a client.

First setup, the Micrologix family plc as EtherNet/IP generic client using the default port 44818, and the applicable IPv4 address. I used a structure for the parameters.

Next setup an EMSG Instruction. Set it to the correct device name created above. Set the connection to "Unconnected MSG" and the service to "Generic". You should now have a Service ID of "75 dec, 0x4b". Next set the Class ID to "103 dec, 0x67". Do not use the Attribute ID. Finally, Set the Instance ID to "1 dec, 0x1". Most of this I discovered using packet/frame analysis with Wireshark.

The next thing you need to do is enable input and output. Depending on what you are needing to do the size of the data Arrays will vary. I will tackle a protected read with three address fields so I will need an output or "Command" array that is one row and 17 columns and is typed as an 8-bit Integer, 1 dimension array.

The initial values of this array are basically the same as the DF-1 commands (See Rockwell Publication 1770-6.5.16 of October 1996 page 7-17) However there is a header that must be added.

At this point I used another project called EtherNet/IP Explorer authored by Frederic Chaxel to find out the EtherNet/IP Identity parameters from the Productivity processor to help create the command string.

Pausing here depending on if I have done everything properly thus far (awaiting moderator feedback) I will post the structure of the input and output arrays and hopefully move this a proper thread as they are the key to this.

See Communicating with RA Products Using EtherNet/IP Explicit Messaging (Rev. 1.2) for help if turns out you need to proceed on your own.
 
Hi Everyone, this is my second post so please forgive me if I make mistakes on my posting in etiquette and/or protocol.

For those of you who saw my original “practice” post this is a follow up to that minus the excitement of making something work that it doesn’t seem anyone else has due to the sparse information on it.

The long story made short is that I was working making Productivity Family PLCs act as a EtherNet/IP client and query data on an Allen-Bradley Micrologix 1100/1400 and SLC-505 processors as servers and managed to make it work. Most of this was research and looking at communications using Wireshark.
This was of course using unconnected explicit messaging to read N7 and files of other types.
1. First, I set up the Micrologix family plc as EtherNet/IP generic client in the Productivity Suite project using the default port 44818, and the applicable IPv4 address. I used a structure for the parameters.
2. Second, I setup an EMSG Instruction and set it to the correct device name created in step one. In the popup I set the connection to "Unconnected MSG" and the service to "Generic". You should have a Service ID of "75 dec, 0x4b" and a Class ID of "103 dec, 0x67". Do not use the Attribute ID. The Instance ID should be "1 dec, 0x1". Enable input and output. Depending on what you are needing to do the size of the Input “response” an output “Command” data arrays will varyin size and structure.
3. I found out how DF-1 commands were encapsulated so I constructed an output/command array that is an 8-bit unsigned integer 1-dimension array with 17 columns to tackle a protected read with three address fields so I will need an output or "Command" array that is one row and 17 columns and is typed as an 8-bit Integer, 1 dimension array.

The initial values of this array are basically the same as the DF-1 commands (See Rockwell Publication 1770-6.5.16 of October 1996 page 7-17) However, there is a header that must be added. Also see “Communicating with RA Products Using EtherNet/IP Explicit Messaging (Rev. 1.2)”

At this point I used another project called EtherNet/IP Explorer authored by Frederic Chaxel to find out the EtherNet/IP Identity parameters from the Productivity processor to help create the command string.

In decimal form my array looks like (where n = RTC seconds, abcd represents bytes of the CIP Serial with “a” being Most Significant):
7,148,2,d,c,b,a,15,0,n,0,162,2,7,137,0,0

The first seven bytes are normally the header:
Element 1 = Number of bytes in Header = 7 d, 0x07
Element 2 = Least significant byte of CIP Vendor ID = 148 d, 0x94 -found w/ EtherNet/IP Explorer
Element 3 = Most significant byte of CIP Vendor ID = 2 d, 0x02 -found w/ EtherNet/IP Explorer
Element 4 = Least significant byte of CIP Serial Num. = “d” value -found w/ EtherNet/IP Explorer
Element 5 = next to LSB of CIP Serial Number = “c” value -found w/ EtherNet/IP Explorer
Element 6 = next to MSB of CIP Serial Number = “b” value -found w/ EtherNet/IP Explorer
Element 7 = Most significant byte of CIP Serial Num. = “b” value -found w/ EtherNet/IP Explorer
Note: the next 10 bytes make up the command
Element 8 = Command Byte = 15 d, 0x0F (will be the same for reads and writes)
Element 9 = STS Byte = 0 d, 0x00 (Normally 0)
Element 10 = LSB of TNS/TNSW= “n” value ( I use RTC seconds for this)
Element 11 = MSB of TNS/TNSW= 0 d, 0x00 ( I leave at zero)
Element 12 = Function Byte = 162 d, 0xA2 -funct. code for protected read with 3 address fields
Element 13 = Number of bytes being queried = 2 d, 0x02 - I used 2 bytes originally for one int16
NOTE: Watch your data types here and calculate correct bytes for the data type and multiply by the number of elements of that type you are asking for and this is limited to about 230 bytes
Element 14 = The index number of file = 7d, 0x07 (using N7 in this example)
Element 15 = File data type = 137d, 0x89
Note See pg 7-17 in Rockwell Publication 1770-6.5.16 of October 1996 for element 15
Element 16 = This is the start element number = 0d, 0x00 (starting at N7:0 in this case)
Element 17 = This would be the bit level address = 0d, 0x00 (leave at “0” if not using)
4. Next the input/response/reply array is the same 8-bit unsigned 1-dimensional array that I create to be 250 columns BUT I only use what is needed of it. You will need to set the size to the number of bytes you requested plus the 13 overhead bytes that the targeted PLC will send. The first 11 bytes is the target PLC’s copying original header, then its 4 byte reply command. Byte 12 will be the error code if byte 9 the STS byte indicates an Ext STS error, otherwise it will begin the requested data. Remember the requested data is in LSB then MSB format.
5. Use the Pack Word Array to change the reply data to Integer 16-bit. Start with column 12 -254 on the source and start at element 1 in your Int/Word16 destination array that is sized correctly array using the pack type “Byte (8-bit) to Word (16-bit).

Let me know if you are able to reproduce this because I have 11 Allen Bradley PLCs being queried by my Productivity 2000 P2-550 and responding with desired data.
 
Last edited:
Thank you GBolin1972 for your time and also for sharing your notes so generously.

I use your parameters for the communication and it works, I got some values in but I have not figured out what they mean. The parameters are as in your post (2. Second, I setup an EMSG Instruction and set it to the correct device name created in step one. In the popup I set the connection to "Unconnected MSG" and the service to "Generic". You should have a Service ID of "75 dec, 0x4b" and a Class ID of "103 dec, 0x67". Do not use the Attribute ID. The Instance ID should be "1 dec, 0x1". Enable input and output. Depending on what you are needing to do the size of the Input “response” an output “Command” data arrays will varyin size and structure.)

I also tried another way which set the ML1400 as scanner and Productivity as adapter and it works too, I attached two screenshots for someone who might need it.

ml1400.png p1-540.png
 

Similar Topics

Compactlogix controller, program has 28 conveyors that use TON's to start the conveyors. The TT sounds a warning horn during start and the DN...
Replies
7
Views
127
Out of interest, I'd like some thoughts on what would be considered best practice with regards to a 2-position turntable control scheme (see...
Replies
17
Views
1,032
I'm looking for some starter kits but there aren't so many on the market, so I'm thinking about buying individual components for my needs. I just...
Replies
15
Views
2,370
I'm building a S7-300 rack to work on my Siemens Classic Step 7 programming skills. I've worked now and then with Siemens hardware, usually...
Replies
19
Views
6,435
Hello everyone, I am looking to get a job as a junior automation engineer. I know the basics of PLC programming with Rockwell and Siemens PLCs...
Replies
4
Views
1,725
Back
Top Bottom