plc Understanding 3E frame for FX5U PLC over SLMP

[cyberdrag 0]

I did a lot of research for being able to control my Mitsubishi FX-5U PLC.

I want to control it over network using SLMP with 3E frame messaging, but I am unable to understand the message frame.

I am referring this manual. But despite spending days I haven't been able to understand how to control the PLC using SLMP.

I understand that if I use this message frame, I will be able to read data on D200 register, and it does work successfully.

50 00 00 FF FF 03 00 0C 00 10 00 01 04 00 00 C8 00 00 A8 01 00

But, I just don't understand, how to access and control the devices on X and Y. Lets say I have to read data from all inputs (X) or write data to all/few output (Y) at once.

I tried resolving this issue by trying to write to outputs, Y1 and Y2, and set them to high, but it doesn't work (Below frame is in ASCII format)

50 00 00 FF FF 03 00 0D 00 00 10 14 01 00 01 Y* 00 00 01 00 02 11

I know I am doing it wrong, so want to know really what am I doing wrong

[Mark- 17]

Hello,

Here is a breakdown of 3E to a Q, writing Y12. I "think" it is correct.

 

[cyberdrag 0]

51 minutes ago, Mark- said:

Hello,

Here is a breakdown of 3E to a Q, writing Y12. I "think" it is correct.

 

Hey @Mark-, thanks for sharing this, I did try as per your suggestions - my code now has this frame structure:

//50 00 01 01 FF 03 00 0D 00 00 00 01 14 01 00 12 00 00 9C 01 00 10

//C# Code
byte[] payload = new byte[] { 0x50, 0x00, 0x01, 0x01, 0xFF, 0x03, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x01, 0x14, 0x01, 0x00, 0x12, 0x00, 0x00, 0x9C, 0x01, 0x00, 0x10 };

Upon execution, I got an error (ERR LED on the PLC is on), and the response was as per below:

D0 00 01 01 FF 03 00 11 00 5F C0 01 01 FF 03 00 01 20 01 00 00 00

I can also see, the request data length is 13 as per above table, however I see that from CPU Timer to Final data, the length is actually 14 bytes. Can you please help me resolve this?

Another detail I'd like to point out here is, in GX Works 3, I have Parameter > FX5UCPU > Module Parameter > Ethernet Port > Basic Settings > Communication Data Code set to "Binary". I hope this is okay?

Edited 28 May 2021 by cyberdrag

[Mark- 17]

19 minutes ago, cyberdrag said:

I can also see, the request data length is 13 as per above table, however I see that from CPU Timer to Final data, the length is actually 14 bytes. Can you please help me resolve this?

Another detail I'd like to point out here is, in GX Works 3, I have Parameter > FX5UCPU > Module Parameter > Ethernet Port > Basic Settings > Communication Data Code set to "Binary". I hope this is okay?

Ummm the byte count starting at 9 to 21(inclusive) is 13 bytes.... so not sure what you are saying.

If the binary read works the binary format is correct.

You can download our demo of PeakHMI, use the "Q" Ethernet drive to read/write different areas of memory, use Wireshark to see the data packets. Assuming no difference for FX5, not tested here.