Logix5000 Data Access

Catalog Numbers 1756 ControlLogix, 1756 GuardLogix,

1768 CompactLogix, 1768 CompactLogix, 1769 CompactLogix,
1789 SoftLogix, 1794 FlexLogix
Programming Manual

Important User Information

Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety Guidelines
for the Application, Installation and Maintenance of Solid State Controls (publication SGI-1.1 available from your local Rockwell
Automation sales office or online at http://www.rockwellautomation.com/literature/) describes some important differences
between solid state equipment and hard-wired electromechanical devices. Because of this difference, and also because of the
wide variety of uses for solid state equipment, all persons responsible for applying this equipment must satisfy themselves that
each intended application of this equipment is acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use
or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software
described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is
prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNING

Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property damage, or economic loss.

IMPORTANT

Identifies information that is critical for successful application and understanding of the product.

ATTENTION

Identifies information about practices or circumstances that can lead to personal injury or death, property damage,
or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence

SHOCK HAZARD

Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may
be present.
BURN HAZARD

Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach
dangerous temperatures.

Allen-Bradley, Rockwell Automation, Logix5000, RSLogix 5000, PLC-5, ControlLogix, PLC-2, SLC, and TechConnect are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.

Table of Contents
Preface

Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Who Should Use This Manual. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Chapter 1
CIP Services

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
CIP Services Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
CIP Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Logix5000 Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Data Type Reporting Value. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Segment Encoding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
CIP Service Request/Response Format . . . . . . . . . . . . . . . . . . . . . 14
Services Supported by Logix5000 Controllers . . . . . . . . . . . . . . . . . . . 16
Read Tag Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Read Tag Fragmented Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Write Tag Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Write Tag Fragmented Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Read Modify Write Tag Service . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Multiple Service Packet Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Logix Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Chapter 2
CIP Addressing Examples

Access Atomic Tags and Atomic Members of

Pre-defined Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Access User-defined Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Chapter 3
CIP Over the Controller Serial Port Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Unconnected Messaging (UCMM) via PCCC. . . . . . . . . . . . . . . . . . . . 45
Connected Explicit Messages via PCCC . . . . . . . . . . . . . . . . . . . . . . . . 47
Fragmentation Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Chapter 4
PCCC Commands

Publication 1756-PM020A-EN-P - October 2009

PLC-2 Communication Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Unprotected Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Protected Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Unprotected Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Protected Bit Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Unprotected Bit Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
PLC-5 Communication Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Read Modify Write. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Read Modify Write N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Typed Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Typed Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
3

Table of Contents

Word Range Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Word Range Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Bit Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
SLC Communication Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
SLC Protected Typed Logical Read with 3 Address Fields . . . . . . 62
SLC Protected Typed Logical Write with 3 Address Fields . . . . . 62
SLC Protected Typed Logical Read with 2 Address Fields . . . . . . 62
SLC Protected Typed Logical Write with 2 Address Fields . . . . . 63
Addressing Examples for PCCC Messages . . . . . . . . . . . . . . . . . . 63

Publication 1756-PM020A-EN-P - October 2009

Preface

Purpose

This manual describes how to access data within a controller from another
product or application that connects to the controller through the
EtherNet/IP network or the serial port. The following methods of data access
from a Logix5000 controller are described in this manual:
Control and Information Protocol (CIP)
This native mode of communication for Logix5000 controllers is based
on the CIP common protocol of these networks:
EtherNet/IP
ControlNet
DeviceNet
These services are also supported over the DF1 serial port by using
Programmable Controller Communication Commands.
The EtherNet/IP network (CIP over standard Ethernet network) is the
preferred method of data access and therefore the focus of this manual.
The ControlNet network can also be used for data access, but generally
speaking, not the DeviceNet network.
Programmable Controller Communication Commands (PCCC), for
compatibility with PLC and SLC controllers:
CIP Over the Controller Serial Port on page 45
PLC-2 Communication Commands on page 51
PLC-5 Communication Commands on page 55
SLC Communication Commands on page 61
The DF1/PCCC method via the serial port is sometimes the most
convenient way to access the controller, typically because of physical
proximity, but it requires using multiple protocols and can require that
tags be mapped to data tables, which is an extra configuration step.
PCCC commands can also be encapsulated in CIP messages and sent
over a CIP network. The commands shown here are not described in
that context.
Visit http://www.rockwellautomation.com/enabled/guides.html for
more information.

5Publication 1756-PM020A-EN-P - October 2009

Preface

This manual is one of a set of related manuals that show common procedures
for programming and operating Logix5000 controllers. For a complete list of
common procedures manuals, see the Logix5000 Controllers Common
Procedures Programming Manual, publication 1756-PM001.
The term Logix5000 controller refers to any controller that is based on the
Logix5000 operating system, such as:

Who Should Use This

Manual

CompactLogix controllers.
ControlLogix controllers.
DriveLogix controllers.
FlexLogix controllers.
SoftLogix5800 controllers.

Before using this document, make sure you:

have a thorough understanding of CIP.
have purchased a copy of the pertinent volumes of the CIP Networks
Library.
are properly licensed through ODVA to use the technology.
For more information on the CIP Networks Library and CIP technologies,
contact ODVA at http://www.odva.org/.

Publication 1756-PM020A-EN-P - October 2009

Preface

Additional Resources

Some of the information in this manual is covered in more detail in the CIP
specification (listed below). In case of discrepancies, the specification is the
authoritative source of information.
For additional information, refer to the following manuals.
Resource

Author

DF1 Protocol and Command Set Reference Manual, 1770-6.5.16

Rockwell Automation

Logix5000 Controllers Common Procedures Programming

Manual, 1756-PM001

Rockwell Automation

Integration with ControlLogix Programmable Automation

Controllers Using EtherNet/IP,
http://www.rockwellautomation.com/enabled/guides.html

Rockwell Automation

Logix5000 Controllers Design Considerations Reference Manual

(Chapter 3, Guidelines for Data Types), 1756-RM094

Rockwell Automation

The Common Industrial Protocol, Pub 122(1)

ODVA

The Common Industrial Protocol (CIP) and the Family of CIP

Networks, Pub 123(1)

ODVA

EtherNet/IP Quick Start for Vendors Handbook, Pub 213(1)

ODVA

CIP Networks Library (Specifications) - subscription required,

Volumes 1 and 2

ODVA

(1)

To locate publications on the ODVA website, use the Search function and type 'pub ###', where ### is the
publication number.

You can view or download Rockwell Automation publications at

http://www.rockwellautomation.com/literature/. To order paper copies of
technical documentation, contact your local Rockwell Automation distributor
or sales representative.
You can view or download ODVA publications at http://www.odva.org/.

Publication 1756-PM020A-EN-P - October 2009

Preface

Glossary

This document uses the following acronyms and terms.

Term

Definition

CIP

Common Industrial Protocol.

Data Type
Reporting Value

Used to indicate the data type of parameters used in Tag services.

These reporting values are defined in the Data Type Reporting
chapter of Appendix B of the CIP Networks Library, Volume 1. The
Data Type Reporting Values for atomic data types are given, and the
values used for structures are calculated, in the specification.

PCCC

Programmable Controller Communication Command.

PLC-2

An older, chassis-based, modular programmable controller.

PLC-5

A chassis-based, modular programmable controller.

SLC

A small, chassis-based, modular programmable controller.

STS/EXT STS

Status of the message transmission.

tag

Character name of data.

UDT

User-defined data type.

Publication 1756-PM020A-EN-P - October 2009

Chapter

CIP Services

Introduction

Communicating with the Logix5000 controller requires using CIP explicit

messaging, which is described in great detail in the CIP Specification. This
section highlights the subset of the CIP explicit messaging constructs that are
pertinent for understanding the service explanations that follow. This is not
meant to replace the need to understand CIP explicit messaging, which can be
found by reading the materials referenced in Additional Resources on page 7.

CIP Services Overview

Before you use CIP services, review the following introductory information.

9Publication 1756-PM020A-EN-P - October 2009

Topic

Page

CIP Data Types

10

Logix5000 Data

11

Data Type Reporting Value

12

Segment Encoding

13

CIP Service Request/Response Format

14

Chapter 1

CIP Services

CIP Data Types

Data type information is very important in all aspects of CIP communication.
The type information is used for reading, writing, and, if necessary,
deciphering structures. The Logix5000 controller supports a large variety of
data types.
Atomic - a bit, byte, 16-bit word, or 32-bit word, each of which stores a
single value. (CIP refers to these as Elementary Data Types)
Structure - a grouping of different data types that functions as a single
unit and serves a specific purpose. Depending on the needs of your
application, you can create additional structures, which are referred to as
user-defined structures.
Array - a sequence of elements, each of which is the same data type.
You can define data in one, two, or three dimensions, as required
(one dimension is the most common).
You can use either atomic or structure data types.
Data in the controller is organized as tags. The tags come in two basic types:
atomic and structures. Atomic types can be arrayed or singular, and are very
easy to work with. Structure types provide a great deal of flexibility, but are
more challenging to access. The following table identifies the atomic data type
sizes.
Atomic Data Type Sizes

10

To store a

Use this data type

Bit

BOOL

Bit array

DWORD (32-bit boolean array)

8-bit integer

SINT

16-bit integer

INT

32-bit integer

DINT

32-bit float

REAL

64-bit integer

LINT

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Logix5000 Data
The Logix5000 controller stores data in tags, in contrast to a PLC-5 or SLC
controller, which stores data in data files. Logix5000 tags have these properties:
Name that identifies the data:
up to 40 characters in length.
does not include a file number.
Scope:
Controller (global), which you can access directly.
Program (local), which cannot be directly accessed, but can be copied
to a controller scope tag.
Data type, which defines the organization of the data.
See CIP Data Types on page 10 for more information.
Public versus Private - Tags created as Private cannot be accessed by
using the methods described here.
For more information about tags and data types, see Chapter 3 of the
Logix5000 Controllers Design Considerations Reference Manual, publication
1756-RM094.

Publication 1756-PM020A-EN-P - October 2009

11

Chapter 1

CIP Services

Data Type Reporting Value

Read Tag, Write Tag, Read Tag Fragmented, Write Tag Fragmented, and
Read Modify Write services require a Data Type Reporting code that identifies
the data type of the data supplied with the request/response. There are two
types of data, Elementary (atomic) and Constructed (structures).
The following shows the data format and Data Type Reporting Values
returned for all the atomic types supported in the Logix controller. Also shown
is the byte order (low byte first) when transmitted within a message packet. For
more information on Data Type Reporting and byte ordering, see Appendix C
of the CIP Networks Library, Volume 1.
CIP Data Type Reporting Values Used with Logix Controllers
Data
Type

Data
Reporting
Value

Reserved Byte Order

BOOL

0xc1

00

Value

SINT

0xc2

00

Value

INT

0xc3

00

Low

High

DINT

0xc4

00

Lowest

Low

High

Highest

REAL

0xca

00

Lowest

Low

High

Highest

DWORD 0xd3

00

Lowest

Low

High

Highest

LINT

00

Lowest

0xC5

Highest

Data Type Reporting Values for structured data types are described in Logix
Data Structures on page 31.

12

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Segment Encoding
The Request Path in a CIP explicit message contains addressing information
that indicates to which internal resource in the target node the service is
directed. This addressing information is organized by using segment encoding,
specifically Logical Segments and/or Symbolic Segments. Most of the services,
described later in this chapter, use Symbolic Segments, but several others use
Logical Segments. For more detailed information about segments, see the CIP
Networks Library, Volume 1, Appendix C. The following is a summary of the
segments important to the context of this manual.

Logical Segments
These tables explain the Logical Segments.
Element ID Logical Segment Encoding Used to Access Arrays and Structures in Logix Controllers
Segment Type

Value

Byte Order Representation of Element ID Value (low byte first)

0

n+1

8-bit Element ID

0x28

Value

N/a

N/a

N/a

N/a

16-bit Element ID

0x29

00

Low

High

N/a

N/a

32-bit Element ID

0x2A

00

Lowest

Low

High

Highest

Class ID Logical Segment Encoding Used to Address Object Classes in Logix Controllers
Segment Type

Value

Byte Order Representation of Class ID Value (low byte first)

0

n+1

8-bit Class ID

0x20

Value

N/a

N/a

N/a

N/a

16-bit Class ID

0x21

00

Low

High

N/a

N/a

32-bit Class ID

0x22

00

Lowest

Low

High

Highest

Instance ID Logical Segment Encoding Used to Address Instances of an Object in Logix Controllers
Segment Type

Value

Byte Order Representation of Instance ID Value (low byte first)

0

n+1

8-bit Instance ID

0x24

Value

N/a

N/a

N/a

N/a

16-bit Instance ID

0x25

00

Low

High

N/a

N/a

32-bit Instance ID

0x26

00

Lowest

Low

High

Highest

Attribute ID Logical Segment Encoding Used to Address Object Attributes in Logix Controllers
Segment Type

Value

Byte Order Representation of Attribute ID Value (low byte first)

0

n+1

8-bit Attribute ID

0x30

Value

N/a

N/a

N/a

N/a

16-bit Attribute ID

0x31

00

Low

High

N/a

N/a

32-bit Attribute ID

0x32

00

Lowest

Low

High

Highest

Publication 1756-PM020A-EN-P - October 2009

13

Chapter 1

CIP Services

Symbolic Segments
CIP also defines a way to reference items by their symbolic name. The segment
used is the ANSI Extended Symbol Segment defined in the CIP Networks
Library, Volume 1, Appendix C.
The Read/Write tags services use these segments in the request path to
indicate which target tag to operate on. When addressing an arrayed tag, the
Logical Segment for Element ID is also used with the Symbolic Segment.
ANSI Extended Symbolic Segment Encoding Used to Address Tags in Logix Controllers
Segment Type
ANSI Extended
Symbolic
(1)

Value
0x91

Byte Order Representation (low byte first)

0

N+1

Length

1st char

Nth Char

(1)

Optional pad byte (00) when length of string (length) is odd.

CIP Service Request/Response Format

All CIP services follow the Message Router Request/Response format defined
in the CIP Networks Library, Volume 1, Chapter 2. Refer to the CIP Networks
Library for a complete description.
All requests take the following form.

14

Message Field

Description

Request Service

Indicates to the object referenced in the request path what task is to

be performed. Services can be openly defined (see CIP Volume 1,
Appendix A) or object-class specific, as most of the services here
are.

Request Path Size

A byte value that indicates the number of 16-bit words in the

Request Path.

Request Path

A variable sized field that consists of one or more segments. The

path refers to the item in the controller that the service operates on.
It can contain Logical and/or Symbolic segments. See Segment
Encoding on page 13 for more information.

Request Data

The service-specific data to be delivered to the object referenced in

the Request Path. Some services have no service-specific data, so
this field is not present in the message frame.

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

This same form is used for ControlNet and EtherNet/IP communication,

both of which are CIP-based networks. Requests received via the serial port
use a different protocol, which is discussed in Chapter 3.
This service format is used for CIP explicit messages and can be delivered to
the controller as connected or unconnected messages. These are sometimes
referred to as 'Transport Class 3' and 'UCMM', respectively. The mechanisms
for doing this are CIP network specific. For example, for EtherNet/IP access,
see the CIP Networks Library, Volume 1, Chapter 3 and the EtherNet/IP
Adaptation of CIP, Volume 2 for more details. For information about using
the EtherNet/IP network to communicate with the controller see
http://www.rockwellautomation.com/enabled/guides.html.
The examples used throughout this document show only the explicit message
protocol elements and not the network specific details. The exception to this is
the information in Chapter 3, which shows more details of unconnected
versus connected explicit messages, and of the PCCC and DF1 layers.
All responses take the following general form.

Publication 1756-PM020A-EN-P - October 2009

Message Field

Description

Reply Service

The request service with the MSB set to 1.

00

Reserved.

General Status

An 8-bit value indicating success or error status. Appendix B of the

CIP Networks Library, Volume 1 has a list of the general status
codes. The object class specified in the request path defines any
extended status codes for each service defined for that class.

Extended Status
Size

An 8-bit value that indicates how many 16-bit values follow in the
additional status field. For status=0 (success) this will be 0.

Extended Status

The array of 16-bit values that further describe the general status
code. Only present when the size field is > 0.

Response Data

The data returned by the specific service request. Some services

have no service-specific reply data, so this field is not present in the
message frame.

15

Chapter 1

CIP Services

Services Supported
by Logix5000 Controllers

The following sections describe the inherent mode of communication and

addressing of the Logix5000 controller. The following vendor-specific services
operate on tags in the controller using symbolic addressing:

Read Tag Service (0x4c)

Read Tag Fragmented Service (0x52)
Write Tag Service (0x4d)
Write Tag Fragmented Service (0x53)
Read Modify Write (RMW) Tag Service (0x4e)

The Multiple Service Packet Service (0x0a) may also be used to combine
multiple requests in one message frame.
Previous Names of Tag Services
Service

In the previous version of this

manual, the service was called

In the Logix5000 software,

the service was called

Read Tag Service

CIP Read Data

CIP Data Table Read

Read Tag
Fragmented Service

Read Data Fragmented Format

N/A

Write Tag Service

CIP Write Data

CIP Data Table Write

Write Tag
Fragmented Service

Write Data Fragmented Format

N/A

Multiple Service
Packet Service

N/A

Multi-Request Service

The Request Data and Response Data shown in the examples below is shown
in the required order. Any deviation from the order shown will likely result in
an error.
This document assumes the following:
The client application knows the name of the tag or tags with which it
wants to interact.
For atomic tags, RSLogix 5000 software is used to determine the data
type, which determines the Data Type Reporting Value used in the Tag
Services.
For UDTs, the data order and type of the members in the UDT
corresponds to the order and type shown in RSLogix 5000 Tag Monitor.
This limited subset of UDTs is explained in Logix Data Structures on
page 31.
It is beyond the scope of this document to describe how to search for tags that
exist in the controller, and to programmatically determine the structure and
byte ordering of any kind of structure in the controller.

16

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Read Tag Service

The Read Tag Service reads the data associated with the tag specified in the
path.
Any data that fits into the reply packet is returned, even if it does not all
fit.
If all the data does not fit into the packet, the error 0x06 is returned
along with the data.
When reading a two or three dimensional array of data, all dimensions must be
specified.

Publication 1756-PM020A-EN-P - October 2009

17

Chapter 1

CIP Services

Example
Read a single tag named 'rate'. The tag has a data type of DINT and a value
of 534.
Request Format
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

03

Request Path is 4 words (8 bytes) long

Request Path

91 04 72 61 74 65

ANSI Ext. Symbolic Segment for 'rate'

Request Data

01 00

Number of elements to read (1)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

C4 00

DINT Data Type Reporting Value

16 02 00 00

0000216 = 534 decimal

Response Format

Read Tag Service Error Codes

Read Tag Service may return the following errors.
Error Code (Hex)

Extended Error (Hex)

Description of Error

0x04

0x0000

A syntax error was detected decoding the Request Path.

0x05

0x0000

Request Path destination unknown: Probably instance number is not

present.

0x06

N/A

Insufficient Packet Space: Not enough room in the response buffer for all
the data.

0x13

N/A

Insufficient Request Data: Data too short for expected parameters.

0x26

N/A

The Request Path Size received was shorter or longer than expected.

0xFF

0x2105

General Error: Access beyond end of the object.

18

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Read Tag Fragmented Service

The Read Tag Fragmented Service allows a client application to read a tag
whose data will not fit into a single packet (approximately 500 bytes). The
client must issue a series of requests to the controller to retrieve all of the data
using this service. The Service, Path, and Number of Elements fields remain
the same for each request. The client must change the Offset with each
request, by the number of bytes transferred in the response to the previous
request.

Example
Reading the tag 'TotalCount' that has 1750 SINTs would consist of the
following four service requests with service data as shown in the tables below.
First Fragment - Request Format
Message Request Field

Bytes

Description

Request Service

52

Read Tag Fragmented Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 54 6F 74 61 6C 43 6F 75 6E 74

ANSI Ext. Symbolic Segment for 'TotalCount'

Request Data

D6 06

Number of elements to read (1750)

00 00 00 00

Start at this element (0) and return as much will fit

First Fragment - Response Format

Message Reply Field

Bytes

Description

Reply Service

D2

Read Tag Fragmented Service (Reply)

Reserved

00

General Status

06

Reply Data Too Large

Extended Status Size

00

No extended status

Response Data

C2 00

SINT Data Type Reporting Value

nn nn nnnn

Element 0489

Publication 1756-PM020A-EN-P - October 2009

19

Chapter 1

CIP Services

Second Fragment - Request Format

Message Request Field

Bytes

Description

Request Service

52

Read Tag Fragmented Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 54 6F 74 61 6C 43 6F 75 6E 74

ANSI Ext. Symbolic Segment for 'TotalCount'

Request Data

D6 06

Number of elements to read (1750)

EA 01 00 00

Start at this element (490) and return as much will fit

Second Fragment - Response Format

Message Reply Field

Bytes

Description

Reply Service

D2

Read Tag Fragmented Service (Reply)

Reserved

00

General Status

06

Reply Data Too Large

Extended Status Size

00

No extended status

Response Data

C2 00

SINT Data Type Reporting Value

nn nn nnnn

Element 490979

Third Fragment - Request Format

Message Request Field

Bytes

Description

Request Service

52

Read Tag Fragmented Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 54 6F 74 61 6C 43 6F 75 6E 74

ANSI Ext. Symbolic Segment for 'TotalCount'

Request Data

D6 06

Number of elements to read (1750)

D4 03 00 00

Start at this element (980) and return as much will fit

Third Fragment - Response Format

Message Reply Field

Bytes

Description

Reply Service

D2

Read Tag Fragmented Service (Reply)

Reserved

00

General Status

06

Reply Data Too Large

Extended Status Size

00

No extended status

Response Data

C2 00

SINT Data Type Reporting Value

nn nn nnnn

Element 9801469

20

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Fourth Fragment - Request Format

Message Request Field

Bytes

Description

Request Service

52

Read Tag Fragmented Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 54 6F 74 61 6C 43 6F 75 6E 74

ANSI Ext. Symbolic Segment for 'TotalCount'

Request Data

D6 06

Number of elements to read (1750)

BE 05 00 00

Start at this element (1470) and return as much will fit

Fourth Fragment - Response Format

Message Reply Field

Bytes

Description

Reply Service

D2

Read Tag Fragmented Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

C2 00

SINT Data Type Reporting Value

nn nn nnnn

Element 14701749

Each response except the last one carries the Status of 06, 'Reply Data Too
Large' to indicate that more data is present than is in this particular frame. The
last response carries the Status of 0 indicating that the data read did not exceed
the message size limit, which indicates that the entire sequence of bytes has
been read.

Read Tag Fragmented Service Error Codes

The Read Tag Fragmented Service may return the following errors.
Error Code (Hex)

Extended Error (Hex)

Description of Error

0x04

0x0000

A syntax error was detected decoding the Request Path.

0x05

0x0000

Request Path destination unknown: probably instance number is not present.

0x06

N/A

Insufficient Packet Space: Not enough room in the response buffer for all the
data.

0x13

N/A

Insufficient Request Data: Data too short for expected parameters.

0x26

N/A

The Request Path Size received was shorter or longer than expected.

0xFF

0x2104

General Error: Offset is beyond end of the requested tag.

0xFF

0x2105

General Error: Offset plus Number of Elements extends beyond the end of the
requested tag.

Publication 1756-PM020A-EN-P - October 2009

21

Chapter 1

CIP Services

Write Tag Service

The Write Tag Service writes the data associated with the tag specified in the
path. The data type must match exactly for the write to occur; the controller
will validate the data type matches before executing the service.
When writing a two or three dimensional array of data, all dimensions must be
specified.

Example
Write the value of 14 to a DINT tag named 'CartonSize'.
Request Format
Message Request Field

Bytes (in hex)

Description

Request Service

4D

Write Tag Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 43 61 72 74 6F 6E 53 69 7A 65

ANSI Ext. Symbolic Segment for 'CartonSize'

Request Data

C4 00

DINT Data Type Reporting Value

01 00

Number of elements to write (1)

0E 00 00 00

Data 0000000E=14 decimal

Message Reply Field

Bytes (in hex)

Description

Reply Service

CD

Write Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Format

22

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Write Tag Service Error Codes

Write Tag Service may return the following errors.
Error Code (Hex)

Extended Error (Hex)

Description of Error

0x04

0x0000

A syntax error was detected decoding the Request Path.

0x05

0x0000

Request Path destination unknown: Probably instance number is not present.

0x10

0x2101

Device state conflict: keyswitch position: The requestor is attempting to change

force information in HARD RUN mode.

0x10

0x2802

Device state conflict: Safety Status: The controller is in a state in which Safety
Memory cannot be modified.

0x13

N/A

Insufficient Request Data: Data too short for expected parameters.

0x26

N/A

The Request Path Size received was shorter or longer than expected.

0xFF

0x2105

General Error: Offset plus Number of Elements extends beyond the end of the
requested tag.

0xFF

0x2107

General Error: Data type used in request does not match target tags data type.

Publication 1756-PM020A-EN-P - October 2009

23

Chapter 1

CIP Services

Write Tag Fragmented Service

The Write Tag Fragmented Service allows a client application to write to a tag
in the controller whose data will not fit into a single packet (approximately 500
bytes). The client must issue a series of requests to the controller to write all of
the data using this service. The Request Service, Request Pat Size, Request
Path, and Number of Elements fields remain the same for each request. The
Offset field changes with each request by the number of bytes it transferred in
the previous request.

Example
Writing 1750 SINTS to the tag 'TotalCount' would consist of the following
four service requests with service data as shown in the tables below.
First Fragment - Request Format
Message Request Field

Bytes

Description

Request Service

53

Write Tag Fragmented Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 54 6F 74 61 6C 43 6F 75 6E 74

ANSI Ext. Symbolic Segment for 'TotalCount'

Request Data

C2 00

SINT Data Type Reporting Value

D6 06

Total number of elements to write (1750)

00 00 00 00

Offset

nn, nn, nn

Element Data (0475)

First Fragment - Response Format

Message Reply Field

Bytes

Description

Reply Service

D3

Write Tag Fragmented Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

24

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Second Fragment - Request Format

Message Request Field

Bytes

Description

Request Service

53

Write Tag Fragmented Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 54 6F 74 61 6C 43 6F 75 6E 74

ANSI Ext. Symbolic Segment for 'TotalCount

Request Data

C2 00

SINT Data Type Reporting Value

D6 06

Total number of elements to write (1750)

DC 01 00 00

Offset

nn, nn, nn

Element Data (476951)

Second Fragment - Response Format

Message Reply Field

Bytes

Description

Reply Service

D3

Write Tag Fragmented Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Third Fragment - Request Format

Message Request Field

Bytes

Description

Request Service

53

Write Tag Fragmented Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 54 6F 74 61 6C 43 6F 75 6E 74

ANSI Ext. Symbolic Segment for 'TotalCount'

Request Data

C2 00

SINT Data Type Reporting Value

D6 06

Total number of elements to write (1750)

B8 03 00 00

Offset

nn, nn, nn

Element Data (9521427)

Third Fragment - Response Format

Message Reply Field

Bytes

Description

Reply Service

D3

Write Tag Fragmented Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Publication 1756-PM020A-EN-P - October 2009

25

Chapter 1

CIP Services

Fourth Fragment - Request Format

Message Request Field

Bytes

Description

Request Service

53

Write Tag Fragmented Service (Request)

Request Path Size

06

Request Path is 6 words (12 bytes) long

Request Path

91 0A 54 6F 74 61 6C 43 6F 75 6E 74

ANSI Ext. Symbolic Segment for 'TotalCount'

Request Data

C2 00

SINT Data Type Reporting Value

D6 06

Total number of elements to write (1750)

94 05 00 00

Offset

nn, nn, nn

Element data (14281749)

Fourth Fragment - Response Format

Message Reply Field

Bytes

Description

Reply Service

D3

Write Tag Fragmented Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

The response to each request carries a Status value of 00, 'Success' status
indication, to indicate that the write operation was successful. No other
Response Data is returned for this service.

Write Tag Fragmented Service Error Codes

Write Tag Fragmented Service may return the following errors.
Error Code (Hex)

Extended Error (Hex)

Description of Error

0x04

0x0000

A syntax error was detected decoding the Request Path.

0x05

0x0000

Request Path destination unknown: probably instance number is not present.

0x10

0x2101

Device state conflict: keyswitch position: The requestor is attempting to change

force information in HARD RUN mode.

0x10

0x2802

Device state conflict: Safety Status: The controller is in a state in which Safety
Memory cannot be modified.

0x13

N/A

Insufficient Request Data: Data too short for expected parameters.

0x26

N/A

The Request Path Size received was shorter or longer than expected.

0xFF

0x2104

General Error: Offset is beyond end of the requested tag.

0xFF

0x2105

General Error: Offset plus Number of Elements extends beyond the end of the
requested tag.

0xFF

0x2107

General Error: Data type used in request does not match the target tags data type.

26

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Read Modify Write Tag Service

The Read Modify Write Tag Service provides a means to modify Tag data with
individual bit resolution. Within ControlLogix, the Tag data is read, the or
modification masks are applied, and finally the data is written back to the Tag.
It can be used to modify a single bit within a Tag without disturbing other
data. Its purpose is similar to the PLC-5 style 'Read Modify Write' PCCC
command described in Chapter 4.

Service Request Parameters

Name

Description of Response Data

Semantics of Values

Size of masks

Size in bytes of modify masks

Only 1,2,4,8,12 accepted

OR masks

Array of OR modify masks

'1' mask sets bit to '1'

AND masks

Array of AND modify masks

'0' mask resets bit to '0'

The size of masks must be the same or smaller than the size of the data type
being accessed. For complete 'data integrity' (for example, to avoid the
possibility of a mix of old and new data when modifying dynamic data), the
size of the mask should match the size of the data type.

Publication 1756-PM020A-EN-P - October 2009

27

Chapter 1

CIP Services

Example
Set bit 2 and reset bit 5 of the DINT named 'ControlWord'.
Request Format
Message Request Field

Bytes (in hex)

Description

Request Service

4E

Read Modify Write Tag Service (Request)

Request Path Size

07

Request Path is 7 words (14 bytes) long

Request Path

91 0B 43 6F 6E 7H 72 6F 6C 57 6F 72 64 00 ANSI Ext. Symbolic Segment for 'ControlWord'

Request Data

04 00

Size of Masks (shall be 4)

04 00 00 00

Array of OR modify masks

DF FF FF FF

Array of AND modify masks

Message Reply Field

Bytes (in hex)

Description

Reply Service

CE

Read Modify Write Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Format

Read Modify Write Tag Service Error Codes

Read Modify Write Tag Service may return the following errors.
Error Code (Hex)

Extended Error (Hex)

Description of Error

0x03

N/A

Bad parameter, size > 12 or size greater than size of element.

0x04

0x0000

A syntax error was detected decoding the Request Path.

0x05

0x0000

Request Path destination unknown: Probably instance number is not

present.

0x10

0x2101

Device state conflict: keyswitch position: The requestor is attempting to

change force information in HARD RUN mode.

0x10

0x2802

Device state conflict: Safety Status: The controller is in a state in which

Safety Memory cannot be modified.

0x13

N/A

Insufficient Request Data: Data too short for expected parameters.

0x26

N/A

The Request Path Size received was shorter or longer than expected.

28

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Multiple Service Packet Service

The Multiple Service Packet Service carries more than one CIP request in a
single CIP explicit-message frame. Use this service to optimize CIP reads and
writes, by grouping service requests together for faster request processing.

Example
Request Format
Message Request Field Bytes (in hex)

Description

Request Service

0A

Multiple Service Packet Service (Request)

Request Path Size

02

Request Path is 2 words (4 bytes) long

Request Path

20 02 24 01

Logical Segment: CLass 0x02, Instance 01 (Message Router)

Request Data

02 00

Number of Services contained in this request

06 00
10 00

Offsets for each Service; from the start of the Request Data

4C
03 91 04 72 61 74 65
01 00

First Request: Read Tag Service

Tag name: 'parts'
Read 1 element

4C
07 91 0B 43 6F 6E 74 72
6F 6C 57 6F 72 64 00
01 00

Second Request: Read Tag Service

Tag name: 'ControlWord'
Read 1 element

The Multiple Service Packet Request Path contains the Message Router object
(Class 2, Instance 1). The Request Data field contains the Number of Services
followed by byte offsets to the start of each service, followed by each of the
CIP requests, each following the standard Message Router Request format.

Publication 1756-PM020A-EN-P - October 2009

29

Chapter 1

CIP Services

Response Format
Message Reply Field

Bytes (in hex)

Description

Reply Service

8A

Multiple Service Packet Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

02 00

Number of Service Replies

06 00
10 00

Offsets for each Service Reply; from the start of the Response Data

CC 00 00 00
C4 00
2A 00 00 00

Read Tag Service Reply, Status: Success

DINT Data Type Reporting Value
Value: 0x0000002A (42 decimal)

CC 00 00 00
C4 00
DC 01 00 00

Read Tag Service Reply, Status: Success

DINT Data Type Reporting Value
Value: 0x000001DC (476 decimal)

The Multiple Service Packet response follows the same Message Router
Response format as all CIP services; therefore, the General Status, Ext Status
Size fields are as described previously. The Response Data field contains the
number of service replies followed by the byte offset to the start of each reply
followed by each of the CIP responses, each following the standard Message
Router Response format.

30

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Logix Data Structures

Chapter 1

A structure is a compound data type that stores a group of possibly different

data types that function as a single unit and serve a specific purpose (for
example, a combination of values).
A structure contains one or more members.
Each member can be an:
atomic data type.
another structured data type.
a single dimension array of an atomic or structure data type.
For more information on data types, see Chapter 3 of the Logix5000
Controllers Design Considerations Reference Manual, publication
1756-RM094.
You can group most structures into arrays or use them in other structures. See
the Logix5000 Controllers Design Considerations Reference Manual,
publication 1756-RM094, for rules for creating structures, including what
types are not allowed.
The controller contains three basic types of structures:
Module-defined data types - created by adding modules to the I/O tree
Pre-defined data types - created by default in the controller (for
example, TON, CTU, and Motion)
User-defined data types - created by the user
The pre-defined and module-defined types, as well as Booleans, are difficult to
deal with for various reasons; therefore they are beyond the scope of this
document.
In RSLogix 5000 software, version 18 and later, controller scope tags can be
marked as Private, which means they cannot be accessed from outside the
controller. Therefore, a structure that contains tags marked as Private, cannot
be accessed.

Publication 1756-PM020A-EN-P - October 2009

31

Chapter 1

CIP Services

To simplify the task of accessing structured tags via a network, create UDTs
with members of these types only: atomic tags, arrays of atomic tags, other
UDTs of atomic tags, and arrays of UDTs of atomic tags. To include data
from a tag based on a pre-defined or module-defined structure in a UDT, use
ladder logic to copy the data from the member of the pre-defined or
module-defined tag to an atomic tag and include the atomic tag in the UDT.
Structures begin and end on 32-bit boundaries. A Logix5000 controller aligns
every data type along an 8-bit boundary for SINTs, a 16-bit boundary for
INTs, or a 32-bit boundary for DINTs and REALs. BOOLs also align on 8-bit
boundaries, but if they are placed next to each other in a user-defined
structure, they are mapped so that they share the same byte. Pad bits or bytes
are added where necessary to achieve this alignment according to these rules.
For more details, see the Guidelines for User-defined Structures section in
Chapter 3 of the Logix5000 Controllers Design Considerations Reference
Manual, publication 1756-RM094.
It is also important for the client application to understand the byte order of
the data in the structure, as it will be transmitted on the wire. If UDTs are
restricted to only atomic members or structures of atomic members and do
not include any module-defined or pre-defined data types, then the size and
byte order will be as shown in the Data Monitor view of the structure
definition in RSLogix 5000 software. However, the Data Monitor does not
show the pad bits or bytes included for the data alignment mentioned in the
paragraph above.
Writing to UDTs requires knowing the Data Type Encoding Value. This is a
calculated field that varies with the members and ordering of members in a
structure. Information about calculating this value for UDTs, can be found at
http://www.rockwellautomation.com/enabled/guides.html, in the
supplemental material located with this manual.

32

Publication 1756-PM020A-EN-P - October 2009

CIP Services

Chapter 1

Structures in the Logix system use Data Type Reporting Values for
constructed data types. These structures are referred to as Abbreviated
Encoding for Structure Data Information, or simply Abbreviated Types.
First byte indicates that a structure type follows.
Second byte indicates the size of the structure handle, which identifies
the structure for communication purposes.
A0

02

xx

yy

Where xx yy is the calculated structure handle. The Read Tag/Write Tag

services use a vendor-specific handle.
In Logix controllers, arrays report the data type of its members. An array
of atomic types reports the corresponding 2 byte code. An array of
structures report the corresponding 4 byte code.
In many situations, it is not necessary to calculate this value; for example, when
the UDT is stable (program development is done and the structure is not likely
to change). In this case, the simplest method of determining the Data Type
Encoding Value is to use the Read Tag Service to read the UDT. Once the
Data Type Encoding Value is obtained, it can be used later to write to the
UDT. In this case, you do not need the supplemental material mentioned
above.
IMPORTANT

Normally when the structure definition is modified, the Data

Type Reporting Value will change, and applications not aware
of the change, would error when accessing the data. However,
the Data Type Reporting Value is not unique to a data pattern,
so it is also possible that changes to the structure may not
result in a different Data Type Reporting Value. Also, it is
possible for two different structures to have the same Data
Type Reporting Value. So, while checking the Data Type
Reporting Value is helpful in detecting errors in accessing the
correct data, there are cases where certain errors would not be
detected.

See http://www.rockwellautomation.com/enabled/guides.html, for more

information on accessing structures.

Publication 1756-PM020A-EN-P - October 2009

33

Chapter 1

CIP Services

Notes:

34

Publication 1756-PM020A-EN-P - October 2009

Chapter

CIP Addressing Examples

The following examples show Request Path strings for various data accesses
using native CIP service requests and addressing.
These examples show only a portion of a message frame for requests and
responses. References to atomic data types that are not dimensioned (not an
array) are fairly straightforward to construct. References to arrays, portions of
arrays or atomic members of structures are not as straightforward. This section
will use examples to show how various references are constructed.
Visit http://www.rockwellautomation.com/enabled/guides.html to download:
the traffic capture files that contain these services.
the controller project file used as the target in these examples.

35Publication 1756-PM020A-EN-P - October 2009

35

Chapter 2

CIP Addressing Examples

Access Atomic Tags and

Atomic Members of
Pre-defined Data Types

The following examples access tags that return atomic data types.

Example 1
Read a single integer tag named 'parts'. The tag has a data type of INT and a
value of 572.

Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

04

Request Path is 4 words (8 bytes) long

Request Path

91 05 70 61 72 74 73 00

ANSI Ext. Symbolic Segment for 'parts'

Request Data

01 00

Number of elements to read (1)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

C3 00

INT Data Type Reporting Value

3C 02

023C = 572

Example 2
Write the value of 14.5 to the 6th element of an array of REALs named
'setpoints' (setpoints[5]).
Message Request Field

Bytes (in hex)

Description

Request Service

4D

Write Tag Service (Request)

Request Path Size

07

Request Path is 7 words (14 bytes) long

Request Path

91 09 73 65 74 70 6F 69 6E 74 73 00 28 05

ANSI Ext. Symbolic Segment for 'setpoints' and

the Member segment for '5'

Request Data

CA 00

REAL Data Type Reporting Value

01 00

Number of elements to write (1)

00 00 68 41

Data 14.5

Message Reply Field

Bytes (in hex)

Description

Reply Service

CD

Write Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

36

Publication 1756-PM020A-EN-P - October 2009

CIP Addressing Examples

Chapter 2

Example 3
Read element [0,1,257] of a three dimensional DINT array named 'profile'.
The value of the tag is 572.
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

09

Request Path is 9 words (18 bytes) long

Request Path

91 07 70 72 6f 66 69 6c 65 00
28 00
28 01
29 00 01 01

ANSI Ext. Symbolic Segment for 'profile'

Member Segment for 0
Member Segment for 1
Member Segment for 257

Request Data

02 00

Number of elements to read (2)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

C3 00

INT Data Type Reporting Value

F0 02 00 00
2C C7 00 00

0x000002F0 = 752 decimal

0x0000C72C=50988 decimal

Example 4
Read the accumulated value of a timer named 'dwell3' (dwell3.ACC).
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

07

Request Path is 7 words (14 bytes) long

Request Path

91 06 64 77 65 6C 6C 33
91 03 41 43 43 00

ANSI Ext. Symbolic Segment for 'dwell3',

ANSI Ext. Symbolic Segment for 'ACC'

Request Data

01 00

Number of elements to read (1)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

C4 00

DINT Data Type Reporting Value

25 02 00 00

0x00000252 = 549 decimal

Publication 1756-PM020A-EN-P - October 2009

37

Chapter 2

CIP Addressing Examples

Example 5
Write a preset value of 50 to the .PRE member of the counter 'ErrorLimit'
(ErrorLimit.PRE).
Message Request Field

Bytes (in hex)

Description

Request Service

4D

Read Tag Service (Request)

Request Path Size

09

Request Path is 9 words (18 bytes) long

Request Path

91 0a 45 72
72 6F 72 4C 69 60
69 74
91 03 50 52 45 00

ANSI Ext. Symbolic Segment for 'ErrorLimit'

Request Data

C4 00
01 00
32 00 00 00

DINT Data Type Reporting Value

Number of elements to write (1)
0x00000032 = 50 decimal

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

38

ANSI Ext. Symbolic Segment for 'PRE'

Publication 1756-PM020A-EN-P - October 2009

CIP Addressing Examples

Access User-defined
Structures

Chapter 2

This section shows examples of accessing simple structures to help illustrate

the message formats needed. The four structures below are defined and then
various members of the structures are accessed in the following examples.
Structure Name: STRUCT_A

Structure Name: STRUCT_B

Member

Data Type

Member

Data Type

limit4

Bit

pilot_on

Bit

limit7

Bit

hourlyCount

INT[12]

travel

DINT

rate

REAL

errors

DINT

wear

REAL

Structure Name: STRUCT_C

Structure Name: STRUCT_D

Member

Data Type

Member

Data Type

hours_full

Bit

myint

INT

today

STRUCT_B

myfloat

REAL

sampleTime

DINT

myarray

STRUCT_C[8]

shipped

DINT

mypid

REAL

For the controller project file and EtherNet/IP traffic capture files for all the
examples in this book, go to
http://www.rockwellautomation.com/enabled/guides.html.

Publication 1756-PM020A-EN-P - October 2009

39

Chapter 2

CIP Addressing Examples

Example 1
Read the tag 'struct1' that is a tag of type STRUCT_A. This reads the entire
structure.
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

05

Request Path is 5 words (10 bytes) long

Request Path

91 07 73 74 72 75 63 74 31 00

ANSI Ext. Symbolic Segment for 'struct1'

Request Data

01 00

Number of elements to read (1)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

A0 02 2C 0A

Abbreviated Type for STRUCT_A

03 00 00 00
55 00 00 00
AA 00 00 00
33 33 2B 41

limit4 and limit7 members (bits 0 and 1 respectively) (BOOL) = 1,

travel member (DINT) = 0x55 (85 decimal),
errors member (DINT) = 0xAA (170 decimal),
wear member (REAL) = 10.7 decimal

Example 2
Read the tag 'struct1.wear'.
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

08

Request Path is 8 words (16 bytes) long

Request Path

91 07 73 74 72 75 63 74 31 00
91 04 77 65 61 72

ANSI Ext. Symbolic Segment for 'struct1',

ANSI Ext. Symbolic Segment for 'wear'

Request Data

01 00

Number of elements to read (1)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

CA 00

REAL Data Type Reporting Value

33 33 2b 41

0x412B3333=10.7 decimal

40

Publication 1756-PM020A-EN-P - October 2009

CIP Addressing Examples

Chapter 2

Example 3
Read the tag 'str1Array[8].travel', which is a one dimensional array of struct_A.
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

0B

Request Path is 11 words (22 bytes) long

Request Path

91 09 73 74 72 31 41 72 72 61 79 00
28 08
91 06 74 72 61 76 65 6c

ANSI Ext. Symbolic Segment for 'str1Array',

Member ID for element 8,
ANSI Ext. Symbolic Segment for 'travel'

Request Data

01 00

Number of elements to read (1)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

C4 00

DINT Data Type Reporting Value

0F 27 00 00

0x0000270F=9999 decimal

Example 4
Read two elements of the tag 'struct2.hourlyCount[4]', which is a structure of
type struct_B.
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

0D

Request Path is 13 words (26 bytes) long

Request Path

91 07 73 74 72 75 63 74 32 00
91 0B 68 6f 75 72 6c 79 43 6F 75 6E 74 00
28 04

ANSI Ext. Symbolic Segment for 'struct2',

ANSI Ext. Symbolic Segment for 'hourlyCount',
Member Segment for element 4

Request Data

02 00

Number of elements to read (2)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

C3 00

INT Data Type Reporting Value

05 00
06 00

0x0005=5 decimal
0x0006=6 decimal

Publication 1756-PM020A-EN-P - October 2009

41

Chapter 2

CIP Addressing Examples

Example 5
Read the tag 'struct3.today.rate', which is a structure of type Struct_C.
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

0C

Request Path is 12 words (24 bytes) long

Request Path

91 07 73 74 72 75 63 74 33 00
91 05 74 6F 64 61 79 00
91 04 72 61 74 65

ANSI Ext. Symbolic Segment for 'struct3',

ANSI Ext. Symbolic Segment for 'today',
ANSI Ext. Symbolic Segment for 'rate'

Request Data

01 00

Number of elements to read (1)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

CA 00

REAL Data Type Reporting Value

00 00 80 41

0x41800000=16.0 decimal

42

Publication 1756-PM020A-EN-P - October 2009

CIP Addressing Examples

Chapter 2

Example 6
Read the tag 'myDstruct4[0].myarray[1].today.hourlyCount[3]' in the controller,
which is a one dimensional array of type Struct_0.
Message Request Field

Bytes (in hex)

Description

Request Service

4C

Read Tag Service (Request)

Request Path Size

19

Request Path is 25 words (50 bytes) long

Request Path

91 0A 6D 79 44 73 74 72 75 63 74 34
28 00
91 07 6D 79 61 72 72 61 79 00
28 01
91 05 74 6F 64 61 79 00
91 0B 68 6F 75 72 6C 79 43 6F 75 6E 74 00
28 03

ANSI Ext. Symbolic Segment for 'myDstruct4',

Element ID for element 0
ANSI Ext. Symbolic Segment for 'myarray'
Element ID for element 1
ANSI Ext. Symbolic Segment for 'today'
ANSI Ext. Symbolic Segment for 'hourlyCount'
Element ID for element 3

Request Data

01 00

Number of elements to read (1)

Message Reply Field

Bytes (in hex)

Description

Reply Service

CC

Read Tag Service (Reply)

Reserved

00

General Status

00

Success

Extended Status Size

00

No extended status

Response Data

C3 00

INT Data Type Reporting Value

D0 5C

0x5CD0=23760 decimal

Publication 1756-PM020A-EN-P - October 2009

43

Chapter 2

CIP Addressing Examples

Notes:

44

Publication 1756-PM020A-EN-P - October 2009

Chapter

CIP Over the Controller Serial Port

Introduction

The information in this chapter helps you to communicate with ControlLogix

controllers using CIP over the serial port. For more information about DFI,
refer to the DF1 Protocol and Command Set Reference Manual, publication
1770-6.5.16. For more information about CIP services used with Logix5000
controllers, see CIP Services on page 9.
The controller's serial port supports the DF1 protocol and PCCC commands.
CIP messages can also be delivered by encapsulating CIP explicit messages
inside of the PCCC commands 0x0A and 0x0B. All of the CIP services
described in Chapter 1 can be sent by using this method.
PCCC has an inherent format limit of 244 bytes of application data. If an
application tries to send a message larger than 244 bytes, an error is returned.
The PCCC commands described here were designed to support a PCCC
fragmentation protocol to allow the transmission of larger CIP messages (up
to 510 bytes). For more information, see Fragmentation Protocol on page 49.

Unconnected Messaging
(UCMM) via PCCC

45Publication 1756-PM020A-EN-P - October 2009

PCCC Command Code 0B provides CIP unconnected explicit-message

capability over the controller's serial port. This can be used for
infrequent requests to the controller (for example, to read or write
ControlLogix tags) or to establish an explicit message connection with the
controller (see Connected Explicit Messages via PCCC on page 47 for
connected communication).

45

Chapter 3

CIP Over the Controller Serial Port

The contents of this PCCC message is a CIP explicit-message service

request/response, such as those described earlier.
PCCC Command 0B Request Structure
Name

Type

Description of Request Parameter

CMD

USINT

Command = 0x0B

STS

USINT

Status (0 in request)

TNSW

UINT

Used to match response with request

FNC

USINT

Fragmentation protocol function

Extra

USINT

Additional information for fragmentation

protocol

Request Service

USINT

CIP Service Code

Request Path Size

USINT

Number of 16-bit words in the Request Path

Request Path

EPATH

Logical and/or Symbolic Segments

Service Request Data

Semantics of Values

See the DF1 Protocol and Command Set Reference

Manual, publication 1770-6.5.16

See CIP Services on page 9.

Service data as defined by the service. Size

and type varies

Similarly, the CIP service response is returned in a PCCC command

reply, as shown in the following table.
PCCC Command 0B Reply Structure
Name

Type

Description of Request Parameter

CMD

USINT

Response = 0x0B + 0x40

STS

USINT

Status (0 == Success)

TNSW

UINT

Used to match response with request

FNC

USINT

Fragmentation protocol function

Extra

USINT

Additional information for fragmentation

protocol

Reply Service

USINT

CIP Service Code + 0x80

Reserved

USINT

00

General Status

USINT

ss

Extended Status Size USINT

nn

Extended Status

Only present if Size > 0

Service Response
Data

Service determines whether present or not, and

the size/ data type

46

Semantics of Values
See the DF1 Protocol and Command Set Reference
Manual, publication 1770-6.5.16

See Fragmentation Protocol on page 49

See CIP Services on page 9

Publication 1756-PM020A-EN-P - October 2009

CIP Over the Controller Serial Port

Connected Explicit
Messages via PCCC

Chapter 3

PCCC Command Code 0A provides CIP explicit-message connection

behavior. The services described in CIP Services on page 9 are used within
these commands. For example, the only difference between connected explicit
messages via PCCC and an EtherNet/IP explicit message connection is the
wrapper that the CIP service is carried in. EtherNet/IP network uses Ethernet
and TCP/IP technology and this uses DF1 and PCCC.
TIP

We assume that you are familiar with CIP and the information
related to CIP that is discussed here. Therefore, the details of the
CIP portions of the frame will not be fully described here.
References to where more detailed information can be found are
provided below. If you are not familiar with CIP, a tutorial CD
ROM is available for purchase at
http://www.rockwellautomation.com/enabled/cipetraining.html.

The following table shows the fields used and where more
information can be found about specific fields of the command
structure.
PCCC Command 0A Structure
Name

Type

Description of Request Parameter

CMD

USINT

Command = 0x0A

STS(1)

USINT

Status (0 in request)

TNSW

UINT

Transaction sequence number

FNC

USINT

Fragmentation protocol function

Extra

USINT

Additional information for fragmentation

protocol

See Fragmentation Protocol on page 49

CID(2)

UINT

Connection ID

Determined in the Forward_Open

request/reply. One unique ID for requests
and another for replies. Refer to the CIP
Specification

Trans. Header **

UINT

Transport class 3 Sequence Count

Increments with each new data request,

echoed in response. Refer to Chapter 3 of
the CIP Specification

Data

CIP Explicit Message

See CIP Services on page 9

(1)

Only STS is supported; there is no EXT STS for this command.

(2)

These appear only in the First_req., First_response, and Only messages, if fragmentation is used.

Semantics of Values
See the DF1 Protocol and Command Set
Reference Manual, publication 1770-6.5.16

The CIP explicit message connection must be established before the 0A

command can be used. This is accomplished by sending the 0B command
(described earlier) to the controller with the CIP Forward_Open service
request. The successful Forward_Open response will provide the information
for the fields shown below. The Forward_Open service is described in Chapter
3 of the CIP Specification and in the aforementioned CIP tutorial CD.

Publication 1756-PM020A-EN-P - October 2009

47

Chapter 3

CIP Over the Controller Serial Port

The 0A command supports only Transport Class 3 connections to the

Message Router object. No other transport classes are supported. The
contents of the data field are CIP services that follow the CIP Service
Request/Response Format on page 14.
Like all CIP connections, there is an RPI value associated with the
connection that establishes the rate at which messages must be sent. If
they are not sent at this rate, timeouts can occur. The RPI timer should
be reset whenever a message is sent. If the timer ever reaches the RPI
value, the connection should retransmit the last sent message and
keep the same sequence count. Upon detecting the same sequence
count, the target will not reprocess the whole message; it just resends
the same response already sent (it looks to the responder like a retry
due to a lost response). The connection timeout should be short
enough that recovery from noise or a temporary disconnect is
relatively quick. It is better to scale the timeout to something
reasonable for noise recovery (20 seconds or so) and then do RPI rate
productions rather than allow connections to repeatedly time out.
The PCCC status (STS) in the PCCC response indicates the success or
failure of the PCCC system to deliver the data across the PCCC link. It
does not indicate the success or failure of the CIP service in the reply.
The status for that will be present in the CIP service response, within
the data field. See the CIP Services on page 9 for details.
Connections are usually kept open for very long periods of time.
However, it may be necessary for the client to close the connection
from time to time. In that case, the client application must close the
connection using the 0B command with a CIP Forward_Close service
request in it. It is not acceptable to allow connections to timeout
naturally and clean themselves up.
The following is an example of the fields for a CIP explicit message
connection using a Class 3 Transport encapsulated in PCCC sent
unfragmented, using DF1 Full Duplex on RS-232.
Brief Example of CIP in PCCC on DF1
Name

Type

Description of Request Parameter

DLE

USINT

ASCII escape character

STX

USINT

Start of message

DST

USINT

Address of destination

SRC

USINT

Address of source

CMD

USINT

Command = 0Ahex

STS

USINT

Status (0 in request)

TNSW

UINT

Transaction sequence number

48

Semantics of Values
See the DF1 Protocol and Command Set
Reference Manual, publication
1770-6.5.16

See the DF1 Protocol and Command Set

Reference Manual, publication
1770-6.5.16

Publication 1756-PM020A-EN-P - October 2009

CIP Over the Controller Serial Port

Chapter 3

Brief Example of CIP in PCCC on DF1

Name

Type

Description of Request Parameter

Semantics of Values

FNC

USINT

Fragmentation protocol function

Fragmentation Protocol
00hex ('Only' function)

Extra

USINT

Additional information for fragmentation

protocol

Fragmentation Protocol
00hex ('Only' has no Extra)

CID

UINT

O-T Connection ID

Transport Header

UINT

Transport class 3 Sequence Count

Request Service

USINT

CIP Service Code

Request Path Size

USINT

Number of 16-bit words in the Request Path

Request Path

EPATH

Logical and/or Symbolic Segments

Service Data

See CIP Specification

See CIP Services on page 9

Service data

DLE

USINT

ASCII escape character

ETX

USINT

End of message

BCC or CRC

USINT or UINT

Block Check Character

Cyclic Redundancy
Check

See DF1 Publication

Fragmentation Protocol

See the DF1 Protocol and Command Set

Reference Manual, publication
1770-6.5.16

The fragmentation protocol allows messages up to 510 bytes to be

sent over PCCC/DF1, which has an inherent limit of 240 bytes. It allows each
fragment to be identified as it is transferred, with each fragment being
acknowledged (Ack or Nak) before the next fragment is sent, and provides the
ability for the client device to abort the fragmentation sequence if necessary.
This fragmentation protocol is used only with the 0A and 0B PCCC
commands.
For more information on the PCCC fragmentation protocol, go to
http://www.rockwellautomation.com/enabled/guides.html. Look for
supplemental information on the Logix Data Access Manual.

Publication 1756-PM020A-EN-P - October 2009

49

Chapter 3

CIP Over the Controller Serial Port

Notes:

50

Publication 1756-PM020A-EN-P - October 2009

Chapter

PCCC Commands

PCCC commands are carried within DF1 packets to the serial port of the
Logix5000 controller. This option for accessing data table mappings inside the
Logix5000 controller is provided for backwards compatibility with our legacy
controllers that do not understand the native language of a Logix5000
controller, CIP. Other applications that worked with our legacy controllers
over serial port could, with proper mapping of Logix5000 tags to data tables,
be used to access information in the Logix5000 controller. For details on data
table mapping, see the Logix5000 Controllers Design Considerations
Reference Manual, publication 1756-RM094.
This is not the preferred method of interacting with Logix5000 controllers, but
is serviceable for many applications, especially where the legacy
communications product is not able to be modified, and where the Logix5000
customer is willing to do the extra configuration of data table mappings in the
Logix5000 controller. Likewise, remote applications that depend on serial
communication over a modem or serial radio link can also use this method.
For more information on PCCC commands, see the DF1 Protocol and
Command Set Reference Manual, publication 1770-6.5.16.

PLC-2 Communication
Commands

Use the PLC-2 commands to access one tag (only one tag) in a Logix5000
controller. In addition to sending the command, you must also map the
message to an INT (16 bit integer) tag in the Logix5000 controller.
Logix5000 controllers support the following PLC-2 commands:

Unprotected Read
Protected Write
Unprotected Write
Protected Bit Write
Unprotected Bit Write

Further details about these commands can be found in the DF1 Protocol and
Command Set Reference Manual, publication 1770-6.5.16.
These commands can arrive at the controller in the following ways:
Encapsulated inside a ControlNet message
Encapsulated inside a EtherNet/IP message
Via the RS-232 serial port
51Publication 1756-PM020A-EN-P - October 2009

51

Chapter 4

PCCC Commands

Unprotected Read
This command provides the read capability for the PLC-2 commands.

Request Format
CMD

STS

TNS

TNS

address

offset

size

Where:
CMD is an 8-bit command code.
STS is an 8-bit status code.
TNS is a 16-bit unique transaction identifier.
address offset is a 2-byte field that indicates byte offset from the start
of a file or tag.
size must be an even number of bytes.
See the DF1 Protocol and Command Set Reference Manual, publication
1770-6.5.16, for more information about these fields.

Reply Format
CMD

STS

TNS

TNS

data

Where data is up to 244 bytes.

Protected Write
This command provides a protected write capability for the PLC-2 commands.

Request Format
CMD

STS

TNS

TNS

address

offset

data

Reply Format
CMD

52

STS

TNS

TNS

Publication 1756-PM020A-EN-P - October 2009

PCCC Commands

Chapter 4

Unprotected Write
This command provides a basic write capability for the PLC-2 commands

Request Format
CMD

STS

TNS

TNS

address

offset

data

Reply Format
CMD

STS

TNS

TNS

Protected Bit Write

This command provides a protected bit write capability for the PLC-2
commands.

Request Format
repeatable up to 61 times
CMD
02

STS

TNS

TNS

PLC-2
address

set mask

reset mask

Where:
PLC-2 address is the typical 2 byte offset.
set mask is 1 byte.
reset mask is 1 byte.

Reply Format
CMD
42

Publication 1756-PM020A-EN-P - October 2009

STS

TNS

TNS

53

Chapter 4

PCCC Commands

Unprotected Bit Write

This command provides a bit write capability for the PLC-2 commands.

Request Format
repeatable up to 61 times
CMD
05

STS

TNS

TNS

PLC-2
address

set mask

reset mask

Where:
PLC-2 address is the typical 2 byte offset.
set mask is 1 byte.
reset mask is 1 byte.

Reply Format
CMD
45

54

STS

TNS

TNS

Publication 1756-PM020A-EN-P - October 2009

PCCC Commands

PLC-5 Communication
Commands

Chapter 4

Each PLC-5 command requires a system address in one of the following

forms:
Logical binary or logical ASCII, which addresses data by 'file', and
'element'.
The first level of the logical binary must always be 0. This is required
to access controller-scoped tags.
The second level is the 'file' number. This is also the level following
the letters in the logical ASCII form.
The next 1, 2, or 3 levels correspond to the array dimension indices
as follows: data[1][2][3].
Any subsequent levels of logical address access parts of the complex
types. Refer to CIP Data Types on page 10.
Refer to Map an Address on page 51.
Symbolic, which addresses data directly by a tag name.
The symbol string starts with a NULL character and ends with a
NULL character.
In the simplest case, the symbol string consists of just the tag name.
To address an array, delimit the array indices with square brackets.
The following examples depict symbolic addresses.
EXAMPLE

Symbolic addresses

tag_name
tag_name[x]
tag_name[x,y,z]
tag_name[x][y][z]

Logix5000 controllers support the following PLC-5 commands:

Publication 1756-PM020A-EN-P - October 2009

Read Modify Write

Read Modify Write N
Typed Read
Typed Write
Word Range Read
Word Range Write
Bit Write

55

Chapter 4

PCCC Commands

IMPORTANT

For the typed read and typed write commands, you can access
only the following data types:

SINT
INT
DINT
REAL

Read Modify Write

The PLC-5 system address field specifies the word that is to be modified. Each
PLC-5 system address is followed by an AND mask field and an OR mask
field (2 bytes each, low byte first). You can use more than one of these sets of
fields to specify more than one word to modify.
For each three field sequence (address, AND mask, OR mask), perform the
following procedure.
1. Copy the specified word.
2. Reset the bits specified in the AND mask.
3. Set the bits specified in the OR mask.
4. Write the word back.

Request Format

CMD
0F

STS

TNS

TNS

FNC
26

Repeatable up to 243 bytes

PLC-5
system
address

AND

mask

OR

mask

Where:
AND mask specifies which bits in the word to reset (0).
OR mask specifies which bits in the word to set (1).

Reply Format
CMD
4F

56

STS

TNS

TNS

EXT
STS

Publication 1756-PM020A-EN-P - October 2009

PCCC Commands

Chapter 4

Read Modify Write N

The PLC-5 system address specifies which word will be modified. A length
field follows each address. Valid lengths are 2 bytes and 4 bytes. The AND
mask and the OR mask follow the length field, respectively. These 4 fields can
be repeated up to a length of 243 bytes.
For each four field sequence (address, mask length, AND mask, OR mask),
perform the following procedure.
1. Copy the specified word.
2. Reset the bits specified in the AND mask.
3. Set the bits specified in the OR mask.
4. Write the word back.

Request Format
Repeatable up to 243 bytes
CMD
0F

STS

TNS

TNS

FNC
79

no. of
sets

PLC-5
system
address

mask
length

AND
mask

OR
mask

Where:
AND mask specifies which bits in the word to reset (0).
OR mask specifies which bits in the word to set (1).

Reply Format
Repeatable for each set, high word if necessary
EXT
STS

Publication 1756-PM020A-EN-P - October 2009

Reply

57

Chapter 4

PCCC Commands

Typed Read
The typed read command reads a block of data from the controller starting at
the PLC-5 system address plus the packet offset.

Request Format
CMD
0F

STS

TNS

TNS

FNC
68

packet

offset

total

transaction

PLC-5
system
address

size

Where size is the number of elements to read.

Reply Format
CMD
4F

STS

TNS

TNS

Where:
a indicates the type information or extended status if the command
errors.
b is the data bytes.

Typed Write
The typed write command writes a block of data to the controller starting at
the PLC-5 system address plus the packet offset.

Request Format
CMD
0F

STS

TNS

TNS

FNC
67

packet

offset

total

transaction

PLC-5
system
address

Where:
packet offset is in number of elements.
total transaction is in number of elements.
a indicates how many elements to write.
b is the data byte.

58

Publication 1756-PM020A-EN-P - October 2009

PCCC Commands

Chapter 4

Reply Format
Extended status exists only if there is an error.
CMD
4F

STS

TNS

TNS

EXT
STS

Word Range Read

The word range read command reads a block of words from the controller
starting at the PLC-5 system address plus the word offset.

Request Format
CMD
0F

STS

TNS

TNS

FNC
01

packet

offset

total

transaction

PLC-5
system
address

size

Where:
packet offset is in numbers of 16 bit words.
total transaction is in numbers of 16 bit words.
size is in number of bytes and must be even in number.

Reply Format
CMD
0F

STS

TNS

TNS

data

Where data is up to 244 bytes.

Publication 1756-PM020A-EN-P - October 2009

59

Chapter 4

PCCC Commands

Word Range Write

The word range write command will write a block of words from the
controller starting at the PLC-5 system address plus the word offset.

Request Format
CMD
0F

STS

TNS

TNS

FNC
00

packet

offset

total

trans-acti
on

PLC-5
system
address

data

Where:
packet offset is in numbers of 16 bit words.
total transaction is in numbers of 16 bit words.

Reply Format
CMD
4F

STS

TNS

TNS

EXT
STS

Bit Write
This command will set and reset bits in a single word specified by the PLC-5
logical address. It can change only a single word in any given command.

Request Format
CMD
0F

STS

TNS

TNS

FNC
02

PLC-5
system
address

set

mask

reset

mask

Reply Format
CMD
4F

60

STS

TNS

TNS

EXT
STS

Publication 1756-PM020A-EN-P - October 2009

PCCC Commands

SLC Communication
Commands

Chapter 4

The SLC commands use strictly a logical form of addressing

(for example, file/element/sub-element). Refer to Map an Address on
page 51.
SLC logical addressing has a limited number of logical address levels so there
are some special concerns.
In a

The element number is used as the

One-dimension array

Dimension index for addressing (data[elem])

Two-dimensional array

Index of the second dimension and the first dimension index

is always 0 (data[0][elem]

Three-dimensional array

Index of the third dimension and the first and second

dimension indices are both 0 (data[0][0][elem])

The following restrictions apply:

You can use only the SLC file types. For SLC type information, refer to
the DF1 Protocol and Command Set Reference Manual, publication
1770-6.5.16.
For the typed read and typed write commands, you can access only the
following data types:
SINT
INT
DINT
REAL
Logix5000 controllers support the following SLC commands:

Publication 1756-PM020A-EN-P - October 2009

SLC Protected Typed Logical Read with 3 Address Fields

SLC Protected Typed Logical Write with 3 Address Fields
SLC Protected Typed Logical Read with 2 Address Fields
SLC Protected Typed Logical Write with 2 Address Fields

61

Chapter 4

PCCC Commands

SLC Protected Typed Logical Read with 3 Address Fields

The service is supported for compatibility with SLC modules.

Request Format
CMD
0F

STS

TNS

TNS

FNC
A2

byte
size

file
number

file
type

element
number

sub- element
number

Reply Format
CMD
4F

STS

TNS

TNS

EXT
STS

data

SLC Protected Typed Logical Write with 3 Address Fields

This service is supported for compatibility with older modules.

Request Format
CMD
0F

STS

TNS

TNS

FNC
AA

byte
size

file
num

file
type

elem
num

sub-elem
num

data

Reply Format
CMD
4F

STS

TNS

TNS

EXT
STS

SLC Protected Typed Logical Read with 2 Address Fields

This read command provides a simpler version for reading data.

Request Format
CMD
0F

STS

TNS

TNS

FNC
A1

byte size

file number

file type

element
number

Reply Format
CMD
4F

62

STS

TNS

TNS

EXT
STS

data

Publication 1756-PM020A-EN-P - October 2009

PCCC Commands

Chapter 4

SLC Protected Typed Logical Write with 2 Address Fields

This write command provides a simpler version for writing data.

Request Format
CMD
0F

STS

TNS

TNS

FNC
A9

byte size

file num

file type

elem num

data

Reply Format
CMD
4F

STS

TNS

TNS

EXT
STS

Addressing Examples for PCCC Messages

Publication 1756-PM020A-EN-P - October 2009

To access

This entry is specified

Single integer tag named 'parts'

PCCC symbolic

'parts'

The sixth element of an array of REALs

named 'setpoints'

PCCC ASCII

$F8:6

PCCC symbolic

'setpoints[6]'

Single integer [2,5,257] of a three

dimensional array named 'profile'

PCCC ASCII

$N7:2:5:257

PCCC symbolic

'profile[2,5,257]'

Accumulated value of a timer named

'dwell3'

PCCC ASCII

$T4:0:2

One preset value [5,0] of a two dimensional

array of counters named 'counts'

PCCC ASCII

$C5:5:0:1

63

Chapter 4

PCCC Commands

Notes:

64

Publication 1756-PM020A-EN-P - October 2009

Rockwell Automation Support

Rockwell Automation provides technical information on the Web to assist you in using its products. At
http://www.rockwellautomation.com/support/, you can find technical manuals, a knowledge base of FAQs, technical and
application notes, sample code and links to software service packs, and a MySupport feature that you can customize to make the
best use of these tools.
For an additional level of technical phone support for installation, configuration, and troubleshooting, we offer TechConnect
support programs. For more information, contact your local distributor or Rockwell Automation representative, or visit
http://www.rockwellautomation.com/support/.

Installation Assistance
If you experience an anomoly within the first 24 hours of installation, review the information that is contained in this manual.
You can contact Customer Support for initial help in getting your product up and running.
United States or Canada

1.440.646.3434

Outside United States or

Canada

Use the Worldwide Locator at http://www.rockwellautomation.com/support/americas/phone_en.html,

or contact your local Rockwell Automation representative.

New Product Satisfaction Return

Rockwell Automation tests all of its products to ensure that they are fully operational when shipped from the manufacturing facility.
However, if your product is not functioning and needs to be returned, follow these procedures.
United States

Contact your distributor. You must provide a Customer Support case number (call the phone number
above to obtain one) to your distributor to complete the return process.

Outside United States

Please contact your local Rockwell Automation representative for the return procedure.

Documentation Feedback
Your comments will help us serve your documentation needs better. If you have any suggestions on how to improve this
document, complete this form, publication RA-DU002, available at http://www.rockwellautomation.com/literature/.

Publication 1756-PM020A-EN-P - October 2009 66

Supersedes Publication 1756-RM005B-EN-E - March 2006

Copyright 2009 Rockwell Automation, Inc. All rights reserved. Printed in the U.S.A.