Read Tag from Rockwell PLC from Codesys?

[drbitboy]

Originally Posted by AlfredoQuintero

... which would require an eternal device ...

Wow, I want one of those, but if it R-A makes then no one could afford it.

[AlfredoQuintero]

Originally Posted by drbitboy

Wow, I want one of those, but if it R-A makes then no one could afford it.

You got me there!!! Of course I meant "external...". Before posting I checked the post and let that one go. Thanks for noticing.

[theColonel26]

For the record I am still here. I just haven't gotten back to working on this project. Also the whole point of this thread was doing it directly. I guess I wasn't completely clear on that in my original post.


I have other project chaos to wrangle.

OT: Who the hell would ever want to be a project manager it stuck. I have to wear many hats, project manager is not one I enjoy.

[AlfredoQuintero]

theColonel26, good you are sticking around because I have good news. I was about to roll-up my sleeves and try PCCC mapped tags, but after dusting-off the PCCC spec I realized it would be more difficult than I thought. So I setup one particular third-party (non-Rockwell) Windows application that can read Logix tags and did a bit of Wirehsark analysis. Then I realized that if one is able to find out the instance of the symbol class (class ID 0x6b) for the particular tag within the Logix processor, then you can access the data with a non-documented (or maybe it is documented but I need to study further) service 0x52. Have a look at the screenshot below. It is really cool. I need to find out how to write data to a particular tag, then I will write the Codesys program, for which I should be able to use the 3S libraries.

[AlfredoQuintero]

And this is how to send data to a Logix tag. In this case the tag FromCodesys_20words was assigned instance 11 by the Logix application. The service for writing data to a tag is 0x53. I think 0xC4 is the datatype DWORD in CIP spec (...yes it is, just checked the spec.) and 0x14 is the 20 words that are being sent to this tag.

[AustralIan]

Alfredo, your suggestion to find the instance number, is exactly steps 1 through 5 of this document.

Originally Posted by AustralIan

I think you would need to implement chapter 2 of 1756-pm020 .

An alternative is this code here, which can read any tag in a single message.
http://www.plctalk.net/qanda/showpos...3&postcount=10

[AlfredoQuintero]

AustralIan, thank you very much. Now that I have done all I did I can more or less understand this code. For a practical application in Codesys though, do you think it is necessary to automate the process to find out the instance. I would do this part manually because the instance of the tag should not change once the Logix program is ready.

[AlfredoQuintero]

I was able to write a program which can read data from Logix tags into Codesys variables using ENIP.Generic_Service. However now I realize this service cannot be used to send data from Codesys variables into Logix tags, because this ENIP.Generic_Service is not generic enough, as it only supports logical segments with Class, Instance and Attribute or Class and Instance elements in the CIP path. For the service 0x53 it is necessary the support for Member in the CIP logical path. Let's hope 3S adds in the future a variant of this ENIP.Generic_Service function with a more flexible CIP path structure. Hope this is helpful.

[AustralIan]

Hi Alfredo, Colonel.
Can you check out my READ_TAG / WRITE_TAG FB's?
It needs that dummy DINT[2] in the CLX to establish a connection.

So far I think it will only work with non-structured, non-array datatypes. And only controller scope tags.
Let me know if you need arrays, structs, or DINT.Bit and I will see what I can do adding these on.

[AlfredoQuintero]

Originally Posted by AustralIan

Hi Alfredo, Colonel.
Can you check out my READ_TAG / WRITE_TAG FB's?
It needs that dummy DINT[2] in the CLX to establish a connection.

So far I think it will only work with non-structured, non-array datatypes. And only controller scope tags.
Let me know if you need arrays, structs, or DINT.Bit and I will see what I can do adding these on.

Hello AustralIan: Thanks very much for your program. I have been studying it for hours and amongst other things it was useful to disabuse me of my delusion that I had in-depth understanding of CIP protocol. By studying your code I realize I am just scratching the surface. Thanks for taking the time; I think this program is brilliant and I am learning a lot thanks to it.

I have tried to make it work. So far I have only tested the reading of Logix tags. I can only get the first DWORD of the tag. I will modify the program to be able to pass the number of elements to read or write. I had an issue with the write function which crashed the PLC application There may be some pointer issue there. I intend to post the program when I get it working.

By the way how do you attach screenshot files with only a link to them? I always get the screenshot below the text.

[drbitboy]

Originally Posted by AlfredoQuintero

By the way how do you attach screenshot files with only a link to them? I always get the screenshot below the text.

Based on observations:


When there is only one image attachment in the pos, the forum software shows the image to the image at the end (unless it was inserted earlier). If there is more than one attachment, then the forum software displays links to all attachmnets, including any images, at the end.

[AlfredoQuintero]

Originally Posted by drbitboy

Based on observations:
When there is only one image attachment in the pos, the forum software shows the image to the image at the end (unless it was inserted earlier). If there is more than one attachment, then the forum software displays links to all attachmnets, including any images, at the end.

Thanks.

[AustralIan]

Hi Alfredo, Thanks for debugging it and adding some features .
I could not find a cause of PLC crash in the WRITE_TAG()... but there was an error. Line 122 of WRITE_TAG should read:

IF Response[4] = 16#CD AND Response[5] = 0 AND Response[6] = 0 AND Response[7] = 0 THEN

[AlfredoQuintero]

Hello AustralIan and theColonel26:
I have added more features to AustralIan's program.
Now you can pass the pointer of global variables in the Codesys PLC application to the read and write functions for Logix so you can get the process data neatly separated from the protocol overhead.
I have not tested with data types other than DWORD, so for different data types there may be some issues that would need to be tweaked.
I hope this is helpful.