How to Get Tag Handle from AB PLC?

[chenhg]

Hello all:
I'am new to CIP protocol.Currently I want to read tag value from AB PLC not using RSLinx.When I put the tag name as address into the read command(0x4C),I can get the value.But I found that someother tool use some 32bit handle instead of tag name to get the value.I think using the 32bit handle may be faster than using tagname.So the problem comes out,I don't know which CMD is used to get the handle.
Anyone Can help me?Thanks very much.

 

[genghis]

Hi Chenhg,

I can't help much but i'll give my two cents:

I believe what you are wanting to do is read a tag using a non-symbolic address. I have not done this before using the CIP 0x4c Read Service, I have only done symbolic reads. I know for a fact it will be faster than using a symbolic tag read so you are correct there.

Kepware server uses this form of non-symbolic addressing in it's Physical Blocking/Non-blocking modes. However this means that in order to use a physical memory address, Kepware needs to do a complete PLC project upload in order to know where in the address space the tag exists.

I believe if you wanted to use a physical address you would need to do the same. However I am still unsure of what type of CIP service you use in order to read a tag using a physical address. I suppose sniffing some CIP traffic using a network analyzer (like Wireshark) would be a start.

You should be able to decode the CIP traffic and find what parts you need to reconstruct. However like I said above, you will still need to obtain the physical address in the PLC somehow.

I know of a trick that may work for you until you find a workaround. If you have a way of finding the physical address by either sniffing some CIP traffic ahead of time, you could then hardcode that physical address in your program just to get things started. Obviously this isn't a permanent solution.

For example, if you have experience with Kepware server you could set up a OPC tag that reads from the PLC tag you want, set the Kepware channel to physical blocking and then watch the CIP traffic to find the physical address and which CIP service is used. I find this method exceptionally good for diagnosing the way the CIP protocol works.


Anyway, Good luck,

genghis

 

[Eddie Willers]

If you attempt to go around the Tag Database, you risk corrupting the user program because you don't control memory allocation.

Do not do this.

Use the guidelines described in the Logix 5000 Data Access documentation.

 

[genghis]

Eddie, yes you are quite right.

Disregard that post above Chenhg.