Discovering atomic parts of arrays and UDTs

gazroobari

Member
Join Date
Mar 2020
Location
Lancashire
Posts
13
Hi,

I'm enhancing an existing EtherNetIP driver which supports A-B CLX processors. The previous developer is no longer available !

The existing driver version successfully discovers all atomic tags (INT, LINT, DINT, BINARY, etc) such that I can read/write their values, but I now need to extend this discovery functionality so that I can access individual atomic elements of array types and user-defined types in the same way.

In the present global situation, I'm having to work from home which makes things somewhat more difficult, so I'd be grateful for any tech help that anyone here can give me.

So the command that's being sent to do the discovery of atomic type tags - before I enhance the driver - is as follows:

Entire EIP packet starts here:

6f 00 (COMMAND_UNCONNECTED_SEND: Send RR Data)
2c 00 (UNCONNECTED_SEND_PAYLOAD_LENGTH = decimal 44)

00 0a 02 11 (SESSION_HANDLE)
00 00 00 00 (STATUS = success)
00 00 00 00 00 00 00 00 (SENDER_CONTEXT)
00 00 00 00 (OPTIONS)

00 00 00 00 (INTERFACE HANDLE = CIP)
50 00 (UNCONNECTED_SEND_TIMEOUT = decimal 80)
02 00 (ITEM_COUNT = decimal 2)
00 00 (NULL_ADDRESS_ITEM_ID)
00 00 (NULL_ADDRESS_ITEM_LENGTH = decimal 0)
b2 00 (UNCONNECTED_DATA_ITEM_ID)
1c 00 (UNCONNECTED_DATA_ITEM_LENGTH_LENGTH = decimal 28)

Embedded CIP packet starts here:

52 (UNCONNECTED_SEND_SERVICE_CODE)
02 (REQUEST_PATH_SIZE_IN_WORDS = decimal 2)
20 (LOGICAL_SEGMENT)
06 (CONNECTION_MANAGER)
24 (INSTANCE_SEGMENT)
01 (INSTANCE_NUMBER = decimal 1)

07 (ACTUAL_TIMEOUT)
e9 (TIMEOUT_TICKS)

0e 00 (UNCONNECTED_SEND_REQUEST_SIZE_IN_WORDS = decimal 14)
55 (REQUEST_SERVICE_GET_INST_ATTRIB_LIST)
03 (REQUEST_PATH_SIZE_IN_WORDS = decimal 3)
20 (FIRST_LOGICAL_SEGMENT = 8-bit class segment)
6b (FIRST_LOGICAL_SEGMENT_CLASS)
25 00 (SECOND_LOGICAL_SEGMENT = 16-bit instance segment)
00 00 (SECOND_LOGICAL_SEGMENT_INSTANCE)

02 00 (GET_INSTANCE_ATTRIBUTE_LIST_REQUEST_DATA)
01 00 (GET_INSTANCE_ATTRIBUTE_LIST_ATTRIB_1)
02 00 (GET_INSTANCE_ATTRIBUTE_LIST_ATTRIB_2)

01 (ROUTE_PATH_SIZE_IN_WORDS = decimal 1)

00 (RESERVED_BYTE)

01 (ROUTE_PATH_PORT: Backplane 1)
00 (ROUTE_PATH_LINK_ADDRESS: 0)



The response to this is a sequence of a few tens of bytes which gives me a list of all the tag ids, names and types, as follows:

! i=0, tagId=fa1b0000, tagName=Program:MainProgram, tagType=6810
! i=1, tagId=20240000, tagName=Map:Local, tagType=6910
i=2, tagId=e92b0000, tagName=dintArr, tagType=2382
i=3, tagId=68310000, tagName=intArr, tagType=fa8e
* i=4, tagId=24590000, tagName=Int1, tagType=c300
i=5, tagId=4b7c0000, tagName=strArr, tagType=d58a
i=6, tagId=978a0000, tagName=st2, tagType=ce8f
! i=7, tagId=23b70000, tagName=Task:MainTask, tagType=7010
* i=8, tagId=d5bf0000, tagName=dint1, tagType=c400
i=9, tagId=1eda0000, tagName=udtTest, tagType=2089


I'm not interested in program-related data, which I've prefixed with an exclamation mark.

The standard atomic data types are easy to recognise by their tagType, and so its possible to add the definitions for those into my driver's tag database and start reading their values; I've prefixed these with an asterisk.

So that leaves me with an expected set of five tags (i = 2,3,5,6,9) that are arrays or UDTs.

My question is: how can I now loop through these five array and/or UDT tags and discover each child tag representing the atomic elements inside them ? Can someone help me understand the specific CIP request I need to do this, and how to format the payload for it ? And how do I know whether a tag type represents an array or UDT ?

Big ask, I realise, but I'm finding the CIP documentation opaque, to say the least, and could just do with a helping hand to steer me to the right place.

Thanks

Wireshark_Command_Sequence.PNG
 
@dmroeder

Brilliant - thank you. I'll check this out in combination with Wireshark and see if I can decipher the output together with the A-B 1756_Logix_5000 manual.
 
Be careful with snooping programs.
a co worker ran a similar program to locate devices on the network and it bogged down communications so bad we went looking for the culprit. the plant nearly shut down, the plc communications between systems, scada, SQL was that bad.


james
 

Similar Topics

When I try to discover the Panelview plus 7 standard 1000 DLR HMI, it come up with 'A profile must be installed before this device can be...
Replies
6
Views
2,397
Not sure if there are any other HP (RPN) calculator lovers out there but you can now get several types of classic calculator emulators on the...
Replies
18
Views
5,697
Hi guys, quick question I am programming a SLC5/03 (DH485) MSG block to pass some data (some bits). In the help file for this command it says...
Replies
6
Views
2,426
I am looking at an application where I will need to detect small hairline cracks in stamped metal parts. The sensing will need to be done in the...
Replies
10
Views
1,114
Hi, I searched in forum but haven't found anything similar.. I am looking for Eplan .edz files/macros. I don't have access to data portal so maybe...
Replies
2
Views
1,915
Back
Top Bottom