Reading and Writing I/O tags in PLC

[sban346 0]

I am reading and writing to I/O tags in Logix5571 using python. While dissecting using Wireshark, I could see that the Symbol Class(0x6b) is being accessed with Service Codes 0x4c and 0x4d. I am confused about the following:

1. Is this the convention in which I/O tags are accessed, as in using the Symbol Class? Is it not Assembly Class? I have read that while doing implicit messaging, Assembly Class is used to access the I/O tags, is it different for the explicit messaging?

2. The services 0x4c and 0x4d are specific to Symbol Class? 

3. How to know what are the instances and attributes present in this class?

[pturmel 157]

When reading from the processor, the I/O data has been brought into tags, so you are using the tag data access.  See this public Rockwell document:

 

https://literature.rockwellautomation.com/idc/groups/literature/documents/pm/1756-pm020_-en-p.pdf

 

If you were to read directly from the I/O device, you would use parameter instances or assemblies, per the EDS file.

[sban346 0]

So, for explicit messaging, we do not use classes and instances to access the tag information? Since CIP uses the concept of objects and classes for communicating between CIP devices, I was hoping to there would be a class that is used to access these tags.

[pturmel 157]

At the first level in the Logix controller, a user may use an ANSI Symbol Segment containing a tag name in place of the symbol class and instance that the data access manual describes.  Using the class and instance is recommended for best performance.  When supplying additional path segments for array subscripts (Member segments) or named structure elements (additional ANSI Symbol segments), they are simply concatenated with the first level segment(s) to form a complete application path within the CIP request.  That CIP request must use the documented Logix tag read, write, or modify service codes and payload formats.

The data access document I linked is a complicated slog, but I encourage you to read the whole thing if you are going to be doing tag access from a third party stack.

Some additional information you may find useful:

• The Symbol class and Template class in the real Logix products I have in my lab do not implement "Get Attribute Single".  You must use "Get Attribute List" or "Get Instance Attribute List" as shown in that manual.
• There are undocumented attributes on both classes.  I encourage you to experiment.  I consider attribute #8 on the symbol class to be essential:  reading it yields an array of three UDINTs (as twelve bytes) that supply the array dimensions for the tag, with zeroes for unused subscript levels.  (All zeros if not an array.)
• Most devices that are intended to be used with implicit connections (I/O adapters) also support "Get Attribute Single" and/or "Set Attribute Single" for assembly buffers.  Attribute #3 of the desired assembly instance.  Reads or writes the entire data buffer.  (Writes to the output assembly will be rejected if an implicit connection owns it.)