NJ to ML1400 CIP Read

[Paul@electrotech 0]

Omron NJ processor needed to Read data file from Allen Bradley MicroLogix 1400 PLC over EIP.

This method uses CPUCMMSend Function block to send a CIP message to the ML1400 to read 64 words of data from file register N32:0

Since our NJ PLC is using a CJ1W-EIP21 SIOU module for the EIP connection the RoutePath also needed to be determined.

 

Explicit CIPUCMM Send to Micrologix 1400 PLC to Read
Function Block Variable Name	Variable Name	Input	Description
CIPUCMMSend
RoutePath	RoutePathName	01/	When using an EtherNet/IP unit a connection is routed through the CPU backplane port (01)
		#10/	Unit number of EtherNet/IP unit + 10 (Unit number 00 + 10 gives #10)
		02/	When communcating through EtherNet/IP the communcation port route code is 02
		192.168.1.14	Target IP address of Micrologix 1400 PLC
TimeOut		UINT#20	Timeout time
ServiceCode	ServCode	4B (Hex)	PCCC Service Code - CreateSocket (75 dec)
			When configuring a MSG Command in RS Logix 500 as "unconnected MSG" and "Generic"
RqPath	ReqPath:	(Hex)	the given Service code and Class ID are 4B (75 dec) and 67 (103 dec), respsectively.
	ClassID	67
	InstanceID	01	Should be set to 01 (1 dec)
	AttributeID	00	Do not use the Attribute ID
	isAttributeID	FALSE
ServiceDat	SrcMessage:	(Hex)	Command message to the Micrologix 1400
	SrcMessage[0]	07	Number of bytes in header is 7 (dec)
	SrcMessage[1]	01	Second byte of Vendor ID
	SrcMessage[2]	00	First byte of Vendor ID
	SrcMessage[3]	0d	First byte of CIP Serial Number
	SrcMessage[4]	0c	Second byte of CIP Serial Number
	SrcMessage[5]	0b	Third byte of CIP Serial Number
	SrcMessage[6]	0b	Last byte of CIP Serial Number
	SrcMessage[7]	0F	Command Byte (15 dec) (Will be the same for read and write)
	SrcMessage[8]	00	Status Byte (Normally 0)
	SrcMessage[9]	4C	LSB of TNS/TNSW
	SrcMessage[10]	00	MSB of TNS/TNSW
	SrcMessage[11]	A2	Function byte (Protected Read with 3 address fields)
	SrcMessage[12]	82	Number of bytes to be Read (130 dec)
	SrcMessage[13]	20	The index number of file (32 dec) in our case N:32
	SrcMessage[14]	89	File data type (137 dec) is type integer, N
	SrcMessage[15]	00	Start element number (If it was 02 then would start at N32:2)
	SrcMessage[16]	00	Bit level address
Size	SrcSize	UINT#11	Size determines how many elements from the SrcMessage are sent (17 dec)
RespServiceDat	RespDat:
	RespDat[0..10]		First 11 bytes in the response are the header we sent but will return a command byte of 4F
	RespDat[11..150]		The rest of the response data is the requested information from N32:00-N32:64 but is byte swapped
AryByteTo
In		RespDat[11]	Takes the response data from after header as the input
Size		UINT#139	Size determines the number of elements input from RespDat. In our case RespDat[11..150]
Order		_eBYTE_ORDER#_LOW_HIGH	Byte swaps each pair of bytes to form correct WORDs
OutVal	ResDatWord		Outputs the read data in an array of WORDs

[photovoltaic 120]

Are you needing help or just telling us how to do it?

[Paul@electrotech 0]

Hi, Just telling you how we did it as there was very little information on the CIP message codes from ODVA and Rockwell.

Managed to back engineer from codes embedded in the Rockwell Message instruction.

[photovoltaic 120]

Thanks for sharing. On a side note there are function blocks for the NJ/NX to read or write SLC and MicroLogix PLCs.

[Paul@electrotech 0]

Thanks photovoltaic, We searched high and low for function blocks but couldn't find any - not even from Omron. Could you please direct me to their location. 

 

[photovoltaic 120]

For the ML1400 you can use Modbus TCP : https://www.myomron.com/index.php?article=1245&action=kb

The FBs for the SLC/ML address-based messaging over Ethernet I will send to you.