Bug in V35 MSG to SLC 5?

[RetiQlum2]

I'm trying to read/write to an SLC5 with a ControlLogix L71 V35 plc that fails.

The exact same code works on an L82S with V32.

Is there a known bug here?

 

[Ken Roach]

Is there an error message or code from the MESSAGE tag (.ERR and .EXERR) that indicate the nature of the failure ?

What is the address and size of the Data Table you are reading or writing ? Do both reads and writes fail ? Are you using the SLC-500 Typed Read and Typed Write command types, or another command type ?

The principal difference in messaging between a 1756-L71 and a 1756-L82S would be the originating port; the onboard port is available for the L82S, but you have to go through the 1756-ENxT module slot for the L71. So the CIP Path might be different, and need to be altered when the program is migrated/copied/duplicated.

I am not aware of anything specifically different or a known defect in SLC-500 messaging between those models or firmware versions. I haven't worked for RA for a very long time so I don't have access to the internal knowledgebase articles.

 

[RetiQlum2]

Is there an error message or code from the MESSAGE tag (.ERR and .EXERR) that indicate the nature of the failure ?

What is the address and size of the Data Table you are reading or writing ? Do both reads and writes fail ? Are you using the SLC-500 Typed Read and Typed Write command types, or another command type ?

The principal difference in messaging between a 1756-L71 and a 1756-L82S would be the originating port; the onboard port is available for the L82S, but you have to go through the 1756-ENxT module slot for the L71. So the CIP Path might be different, and need to be altered when the program is migrated/copied/duplicated.

I am not aware of anything specifically different or a known defect in SLC-500 messaging between those models or firmware versions. I haven't worked for RA for a very long time so I don't have access to the internal knowledgebase articles.

Both Reads and writes fail.

The extended error is 16#0008_0311.

SLC typed read and write (same error.)

The EN2T is in slot 1, but I've tried both 1,<IP ADDRESS> and 2,<IP ADDRESS>

 

[RetiQlum2]

Could a mismatch between the PLC rev of the card and the firmware cause this? I haven't looked yet. I'm spitballing.

 

[RetiQlum2]

Should it be 1,2, <IP ADDRESS> ?

 

[Ken Roach]

>The EN2T is in slot 1, but I've tried both 1,<IP ADDRESS> and 2,<IP ADDRESS>

CIP Paths are pairs of values that represent a Port and an Address.

For a 1756-L71 that has a 1756-EN2T in Slot 1 (the second slot of the chassis, remember that they start at 0), and an SLC-5/05 as the target address, the CIP Path would be

1, 1, 2, <IP Address>

That means that the message goes from the CPU to Port 1 (the backplane), then to Slot 1 (the 1756-EN2T), then to Port 2 (the Ethernet port of the -EN2T), and to the IP Address of the SLC-5/05.

The error code 16#0008 means "Unsupported Service". That might mean that the CIP Path actually leads to something that doesn't support SLC-500 Typed Data Table Read/Write.

Is this the same SLC-5/05 in both instances ? Before 2000 or so the SLC-5/05 only supported the legacy CSPv4 Ethernet protocol (TCP Port 2222), before it got "dual stack" firmware that also supports messaging over CIP (TCP Port 44818). Any "Series C" hardware that has "EtherNet/IP" or "10/100" markings will support CIP. You can check the embedded web page, or use netcat (Linux) or PowerShell test-NetConnection (Windows) to check the TCP ports that are open on the SLC.

 

[RetiQlum2]

>The EN2T is in slot 1, but I've tried both 1,<IP ADDRESS> and 2,<IP ADDRESS>

CIP Paths are pairs of values that represent a Port and an Address.

For a 1756-L71 that has a 1756-EN2T in Slot 1 (the second slot of the chassis, remember that they start at 0), and an SLC-5/05 as the target address, the CIP Path would be

1, 1, 2, <IP Address>

That means that the message goes from the CPU to Port 1 (the backplane), then to Slot 1 (the 1756-EN2T), then to Port 2 (the Ethernet port of the -EN2T), and to the IP Address of the SLC-5/05.

The error code 16#0008 means "Unsupported Service". That might mean that the CIP Path actually leads to something that doesn't support SLC-500 Typed Data Table Read/Write.

Is this the same SLC-5/05 in both instances ? Before 2000 or so the SLC-5/05 only supported the legacy CSPv4 Ethernet protocol (TCP Port 2222), before it got "dual stack" firmware that also supports messaging over CIP (TCP Port 44818). Any "Series C" hardware that has "EtherNet/IP" or "10/100" markings will support CIP. You can check the embedded web page, or use netcat (Linux) or PowerShell test-NetConnection (Windows) to check the TCP ports that are open on the SLC.

Got it. Thanks.

 

[Ken Roach]

I think this is probably a CIP path problem.

2, <IP Address> would work with a 1756-L82S because it has an Ethernet port on the front, which is Port 2. That wouldn't work for a 1756-L71 because it doesn't have a front port of any kind and would probably respond to its own message, including with "What ? SLC Read ? I don't do that. 16#0008, pal.".

 

[Ken Roach]

Also, check the "Connected Message" box in the MSG configuration; SLC's might need Unconnected messaging.

 

[ASF]

Your path is almost certainly the culprit.

In an L8 processor, assuming the message is going out the onboard ethernet port, the path is simply "out the front door [onboard ethernet] of the processor and down the wire to this IP address". I don't know the port numbers for the onboard ethernet port off the top of my head, but it will look like 2,<IP ADDRESS> as you are trying.

In an L7 processor, the message has to go out the EN2T module. So the path from the processor looks like "out the back door of the processor (onto the backplane), along the backplane to slot 1 (which is your EN2T module), then out the front door of the EN2T module (EN2T ethernet port) and down the wire to this IP address". So your path will look more like 1,1,2,<IP ADDRESS> (again, those port numbers are not necessarily correct, just an example to illustrate).

The simple way to work your path out is to add the SLC to your ethernet tree, browse and point the MSG instruction to that device, and then delete it from the tree. The path will be constructed for you.

Edit: I'm getting slow. Ken typed two posts before I got mine in!

 

[RetiQlum2]

Your path is almost certainly the culprit.

In an L8 processor, assuming the message is going out the onboard ethernet port, the path is simply "out the front door [onboard ethernet] of the processor and down the wire to this IP address". I don't know the port numbers for the onboard ethernet port off the top of my head, but it will look like 2,<IP ADDRESS> as you are trying.

In an L7 processor, the message has to go out the EN2T module. So the path from the processor looks like "out the back door of the processor (onto the backplane), along the backplane to slot 1 (which is your EN2T module), then out the front door of the EN2T module (EN2T ethernet port) and down the wire to this IP address". So your path will look more like 1,1,2,<IP ADDRESS> (again, those port numbers are not necessarily correct, just an example to illustrate).

The simple way to work your path out is to add the SLC to your ethernet tree, browse and point the MSG instruction to that device, and then delete it from the tree. The path will be constructed for you.

Edit: I'm getting slow. Ken typed two posts before I got mine in!

Yes, that was it. Thanks.