Mark-

> I'm just trying to understand the variation and how/why commands are changing. I assume you are reading the specifications? Do you have a binary file 32 in the the PLC?

10 02 01 29 0F 00 40 00 AB 02 03 85 FF 00 00 00 01 00 01 00 10 03 82 CF 10 02 01 29 0F 00 40 00 AB 02 03 85 FF 00 00 00 02 00 02 00 10 03 36 CF The first line is bit 0 and the second is bit 1. The mask clears the other bits of the element.  

Show the command you are using for bit 1.

From the DF1 guide: E Command cannot be executed  

The command is OK. What is the result of issuing the command? The result could be a garbled response, error code or ... If the result is nothing, it could be the cable is not correct/connected, the device is powered off, bad serial port, etc.. Lots of possible reasons. We have a free DF1 slave program that might help https://www.hmisys.com/downloads/PeakHMISlaveSimulatorInstall.exe    

Hello, For CLX you can fetch the UDT sizes and member names/data types and UDT that contain UDT. I posted a program a few years ago that would fetch what the controller contained. The program had one error that I fixed in my code but did not revisit the posted program. I thought I posted it on this site. LogixTagRead.exe. PM if you want me to email it to you.

> I don't know if there is any piracy law in SAUDI Arabia https://www.arabnews.com/new-law-enacted-stamp-out-piracy-saudi-arabia  

How about ethics? Let someone steal your "managements" property. See what happens. Not to mention, virus, malware, ransomware, key monitors, etc. a frequently hidden in cracked software.

Hello, Does anyone have the Triconex Tristation serial cable pinout? The cable part number is 1600080-0xx.  

I am partial to PeakHMI.

http://preserve.mactech.com/articles/mactech/Vol.09/09.04/CRC/index.html  

Perhaps it would help to include the HMI brand/type/model used.

Hello, > He would like to know the commands in order to read or write the data and the TCP/IP data structures and frames. AB Ethernet/IP protocol is used. He is in for a long road if he wants to write a stack/driver to read/write data. Not impossible. The protocol implements the full 7 layer OSI model. He does not need to implement all layers but, the layers must be handled in the request/response data packets. There are a few open source projects floating around that might help him. Not sure if any support the 8xx line. Or he might try PeakHMI.

Hello, A port of our free MODBUS RTU serial slave has been posted to Github if anyone is interested. https://github.com/EverestSoftwareLLC/PeakHMIMODBUSSerialSlaveRTULinux  

Indeed. I have written many programs and seen many programs written by others. In one group of logic designers we had a fellow we affectionately named the "Not King". He loved "nots". Used them more than anyone. Another group we had a fellow, the "One-shot King". Same as the last. Used more "one-shots" than all others. Still both of this guys designed solid logic that worked, passed all testing, could be maintained/modified without trouble and has also be proven by the test of time. So many times I have heard folks criticize logic/implementation/etc. only because it was not the way that person would have done it.  My2c.

If the OS is Windows CE, search for how to disable SNMP in CE. A SWAG.

Correct. The master controls all the data flow on the loop. If a slave could initiate communications on the loop collisions would occur. MODBUS is a very simple master/slave protocol.

Hello, PeakHMI has a Master K driver.  

Hello, IIRC, to write a string the data format is parameter count, structure code, element count, length count and then characters (as bytes). You write to the tag name. Download the PeakHMI demo installer and install it. Create an AB Logix port, create one string, execute a point test and capture the request/response in Wireshark.  That will give you the read exchange. For a write, create a screen with a button, add the write command, start runtime, activate the button and view the Wireshark capture. Contact support if you need any help.

Hello, Download the demo for PeakHMI and use it to capture packets in Wireshark. If you need any help contact PeakHMI support.  

Hello,   PeakHMI  

Omni has some registers that are regular MODBUS and other registers that are Enron MODBUS. Omni produces the "MODBUS database addresses and index numbers" user manual for the flow computer/firmware revisions. For example: Depending on the register index, requesting 1 register could get you 1, 2, 4 or 8 words (1 word = 16 bits).

Hello,   Does anyone know the supported attribute values and definitions for the CIP Get_Instance_Attribute_List (0x55) service?   Attribute 1 and 2 are defined in a public AB documents and 8 appears to be array dimensions. 7 could be data size in bytes, a total guess.    

Hi, PeakHMI might work for you.  

It might help to state the manufacture/brand, model, version, etc.