cyberdrag

plc Understanding 3E frame for FX5U PLC over SLMP

4 posts in this topic

I did a lot of research for being able to control my Mitsubishi FX-5U PLC.

I want to control it over network using SLMP with 3E frame messaging, but I am unable to understand the message frame.

I am referring this manual. But despite spending days I haven't been able to understand how to control the PLC using SLMP.

I understand that if I use this message frame, I will be able to read data on D200 register, and it does work successfully.

50 00 00 FF FF 03 00 0C 00 10 00 01 04 00 00 C8 00 00 A8 01 00

But, I just don't understand, how to access and control the devices on X and Y. Lets say I have to read data from all inputs (X) or write data to all/few output (Y) at once.

I tried resolving this issue by trying to write to outputs, Y1 and Y2, and set them to high, but it doesn't work (Below frame is in ASCII format)

50 00 00 FF FF 03 00 0D 00 00 10 14 01 00 01 Y* 00 00 01 00 02 11

I know I am doing it wrong, so want to know really what am I doing wrong

Share this post


Link to post
Share on other sites

Hello,

Here is a breakdown of 3E to a Q, writing Y12. I "think" it is correct.

 

Y12.png

Share this post


Link to post
Share on other sites

Posted (edited)

51 minutes ago, Mark- said:

Hello,

Here is a breakdown of 3E to a Q, writing Y12. I "think" it is correct.

 

Y12.png

Hey @Mark-, thanks for sharing this, I did try as per your suggestions - my code now has this frame structure:

//50 00 01 01 FF 03 00 0D 00 00 00 01 14 01 00 12 00 00 9C 01 00 10

//C# Code
byte[] payload = new byte[] { 0x50, 0x00, 0x01, 0x01, 0xFF, 0x03, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x01, 0x14, 0x01, 0x00, 0x12, 0x00, 0x00, 0x9C, 0x01, 0x00, 0x10 };

Upon execution, I got an error (ERR LED on the PLC is on), and the response was as per below:

D0 00 01 01 FF 03 00 11 00 5F C0 01 01 FF 03 00 01 20 01 00 00 00

I can also see, the request data length is 13 as per above table, however I see that from CPU Timer to Final data, the length is actually 14 bytes. Can you please help me resolve this?

Another detail I'd like to point out here is, in GX Works 3, I have Parameter > FX5UCPU > Module Parameter > Ethernet Port > Basic Settings > Communication Data Code set to "Binary". I hope this is okay?

Edited by cyberdrag

Share this post


Link to post
Share on other sites
19 minutes ago, cyberdrag said:

I can also see, the request data length is 13 as per above table, however I see that from CPU Timer to Final data, the length is actually 14 bytes. Can you please help me resolve this?

Another detail I'd like to point out here is, in GX Works 3, I have Parameter > FX5UCPU > Module Parameter > Ethernet Port > Basic Settings > Communication Data Code set to "Binary". I hope this is okay?

Ummm the byte count starting at 9 to 21(inclusive) is 13 bytes.... so not sure what you are saying.

If the binary read works the binary format is correct.

You can download our demo of PeakHMI, use the "Q" Ethernet drive to read/write different areas of memory, use Wireshark to see the data packets. Assuming no difference for FX5, not tested here.

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now