11 Unity EN PDF

Unity Pro 2.
2
Communication
Block Library
09/2005
33002527.03
2
Table of Contents
About the Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Part I General Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 1 Block types and their applications . . . . . . . . . . . . . . . . . . . . . . 13

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Block types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
FFB Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
EN and ENO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Chapter 2 Availability of the modules on the various

hardware platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Availability of the block on the various hardware platforms. . . . . . . . . . . . . . . . . 21
Chapter 3 Operation of the communication EFs . . . . . . . . . . . . . . . . . . . . 23

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.1 General information on Premium and Atrium communication functions . . . . . . . 25
At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Rules for using the communication functions of Premium and
Atrium PLCs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Communication functions on Premium and Atrium PLCs . . . . . . . . . . . . . . . . . . 27
Structure of Premium and Atrium communication functions . . . . . . . . . . . . . . . . 30
Destination address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Structure of the management parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Management Parameters: Communication and Operation Reports . . . . . . . . . . 34
Management parameters: length and Timeout . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Server function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3
Part II Extended. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Chapter 4 ADDR: Address conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Chapter 5 CANCEL: Stopping an exchange in progress . . . . . . . . . . . . . 45

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Example of how to cancel an exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Chapter 6 CREAD_REG: Continuous register reading . . . . . . . . . . . . . . 49

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Derived Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Function mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Parameter description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Chapter 7 CWRITE_REG: Continuous register writing . . . . . . . . . . . . . . 57

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Derived Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Function mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Chapter 8 DATA_EXCH: Exchanging data between applications. . . . . . 65

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Assisted entry screen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Example of how to use a Fipway network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Chapter 9 INPUT_BYTE: Receiving character strings . . . . . . . . . . . . . . . 75

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Chapter 10 INPUT_CHAR: Receiving character strings . . . . . . . . . . . . . . 79

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Assisted entry screen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Example of how to read character strings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
4
Chapter 11 MBP_MSTR: Modbus Plus Master . . . . . . . . . . . . . . . . . . . . . . 87
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Function mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Write data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Read data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Read local statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Clear local statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Write Global Data (Peer Cop) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Read Global Data (Peer Cop) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Get remote statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Clear remote statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Peer cop health . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Optional module reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Read CTE (Config extension table). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Write CTE (Config extension table). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Peer Cop Communications Health Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Modbus Plus network statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
TCP/IP Ethernet Network Statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Modbus Plus and SY/MAX Ethernet Error Codes . . . . . . . . . . . . . . . . . . . . . . . 122
SY/MAX-specific error codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
TCP/IP Ethernet error codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
CTE error codes for SY/MAX and TCP/IP Ethernet . . . . . . . . . . . . . . . . . . . . . 129
Chapter 12 ModbusP_ADDR: Modbus Plus Address . . . . . . . . . . . . . . . . 131

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Detailed Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Chapter 13 OUT_IN_CHAR: Sending/receiving character strings. . . . . . 137

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Assisted entry screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Example of How to Send/Receive a Character String. . . . . . . . . . . . . . . . . . . . 143
Chapter 14 PRINT_CHAR: Sending character strings . . . . . . . . . . . . . . . 145

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Example of How to Send Character Strings . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
5
Chapter 15 RCV_TLG: Receiving telegrams . . . . . . . . . . . . . . . . . . . . . . . 153
At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Example of how to receive a telegram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Chapter 16 READ_ASYN: Reading data asynchronously . . . . . . . . . . . . 157

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Chapter 17 READ_GDATA: Reading Modbus Plus Global Data . . . . . . . 161

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Chapter 18 READ_REG: Read register . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Derived Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Function mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
Parameter description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Chapter 19 READ_VAR: Reading variables . . . . . . . . . . . . . . . . . . . . . . . 171

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Assisted entry screen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Example of use on a Uni-Telway bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Example of how to read bits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Example of use in a network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
Example including execution check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Chapter 20 SEND_REQ: Sending requests . . . . . . . . . . . . . . . . . . . . . . . . 185

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
List of UNI-TE requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Assisted entry screen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Example of how to send a UNI-TE request . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Changing IP Parameters with SEND_REQ (Example) . . . . . . . . . . . . . . . . . . . 199
Using the SEND_REQ function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Chapter 21 SEND_TLG: Sending telegrams . . . . . . . . . . . . . . . . . . . . . . . 201

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Example of how to send a telegram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Chapter 22 SYMAX_IP_ADDR: SY/MAX IP Address. . . . . . . . . . . . . . . . . 207

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Detailed Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
6
Chapter 23 TCP_IP_ADDR: TCP/IP Address . . . . . . . . . . . . . . . . . . . . . . . 211
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
Detailed Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Chapter 24 UNITE_SERVER: Immediate server . . . . . . . . . . . . . . . . . . . . 217

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Example of immediate server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
Chapter 25 WRITE_ASYN: Writing data asynchronously. . . . . . . . . . . . . 223

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Chapter 26 WRITE_GDATA: Writing the Global Data Modbus Plus . . . . 227

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Chapter 27 WRITE_REG: Write register . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Derived Data Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Function mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Parameter description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Chapter 28 WRITE_VAR: Writing variables . . . . . . . . . . . . . . . . . . . . . . . . 241

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Example of how to write words on a network . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Example including execution check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
7
Appendices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Appendix A EFB Error Codes and Values . . . . . . . . . . . . . . . . . . . . . . . . . 253

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Tables of Error Codes for the Communication Library. . . . . . . . . . . . . . . . . . . . 254
Common Floating Point Errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Appendix B System objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

At a Glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
System bit introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Description of system bits %S15 to %S21. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Description of System Words %SW12 to %SW19. . . . . . . . . . . . . . . . . . . . . . . 265
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
8
About the Book
At a Glance
Document Scope This document describes the functions and function blocks of the Communication
library.
This document is valid for Unity Pro Version 2.2.
Validity Note The data and illustrations found in this document are not binding. We reserve the
right to modify our products in line with our policy of continuous product
development. The information in this document is subject to change without notice
and should not be construed as a commitment by Schneider Electric.
33002527 9
About the Book
Product Related Schneider Electric assumes no responsibility for any errors that may appear in this
Warnings document. If you have any suggestions for improvements or amendments or have
found errors in this publication, please notify us.
No part of this document may be reproduced in any form or by any means, electronic
or mechanical, including photocopying, without express written permission of
Schneider Electric.
All pertinent state, regional, and local safety regulations must be observed when
installing and using this product. For reasons of safety and to ensure compliance
with documented system data, only the manufacturer should perform repairs to
components.
When controllers are used for applications with technical safety requirements,
please follow the relevant instructions.
Failure to use Schneider Electric software or approved software with our hardware
products may result in injury, harm, or improper operating results.
Failure to observe this product related warning can result in injury or equipment
damage.
User Comments We welcome your comments about this document. You can reach us by e-mail at
techpub@schneider-electric.com
10 33002527
General Information
I
Introduction
Overview This section contains general information about the communication library.
What's in this This part contains the following chapters:

Part?
Chapter Chapter Name Page
1 Block types and their applications 13
2 Availability of the modules on the various hardware platforms 21
3 Operation of the communication EFs 23
33002527 11
General Information
12 33002527
Block types and their applications
1
Introduction
Overview This chapter describes the different block types and their applications.
What's in this This chapter contains the following topics:

Chapter?
Topic Page
Block types 14
FFB Structure 15
EN and ENO 18
33002527 13
Block types
Block types Different block types are used in Unity Pro. The general term for all block types is
FFB.
There are the following types of block:
l Elementary Function (EF)
l Elementary Function Block (EFB)
l Derived Function Block (DFB)
l Procedure
Elementary Elementary functions (EF) have no internal status.. If the input values are the same,
Function the value at the output is the same for all executions of the function, e.g. the addition
of two values gives the same result at every execution.
An elementary function is represented in the graphical languages (FDB and LD) as
a block frame with inputs and an output. The inputs are always represented on the
left and the outputs always on the right of the frame The name of the function, i.e.
the function type, is shown in the center of the frame.
The number of inputs can be increased with some elementary functions.
Elementary Elementary function blocks (EFB) have an internal status. If the inputs have the
function block same values, the value on the output can have another value during the individual
executions. For example, with a counter, the value on the output is incremented.
An elementary function block is represented in the graphical languages (FDB and
LD) as a block frame with inputs and outputs. The inputs are always represented on
the left and the outputs always on the right of the frame The name of the function
block, i.e. the function block type, is shown in the center of the frame. The instance
name is displayed above the frame.
Derived function Derived function blocks (DFBs) have the same properties as elementary function
block blocks. They are created by the user in the programming languages FBD, LD, IL
and/or ST.
Procedure Procedures are technical functions.

The only difference from elementary functions is that procedures can have more
than one output and they support variables of the VAR_IN_OUT data type.
Procedures do not return a value.
Procedures are a supplement to IEC 61131-3 and must be enabled explicitly.
There is no visual difference between procedures and elementary functions.
14 33002527
FFB Structure
Structure Each FFB is made up of an operation (name of the FFB), the operands required for
the operation (formal and actual parameters) and an instance name for elementary/
derived function blocks.
Call of a function block in the FBD programming language:
Instance Name Operation Operand
(FFB name)
Formal Actual
parameter parameter
MY_TON
TON
ENABLE EN ENO ERROR
EXAMP IN Q OUT
TIME1 PT ET TIME2
Formal call of a function block in the ST programming language:

Operands
Instance Name
Formal parameters (inputs) Formal parameters (outputs)
MY_TON (EN:=ENABLE, IN:=EXAMP, PT:=TIME1, ENO=>ERROR, Q=>OUT, ET=>TIME2);
Actual parameters (inputs) Actual parameters (outputs)
Operands
Operation The operation determines which function is to be executed with the FFB, e.g. shift
register, conversion operations.
33002527 15
Operand The operand specifies what the operation is to be executed with. With FFBs, this
consists of formal and actual parameters.
Formal/actual Inputs and outputs are required to transfer values to or from an FFB. These are
parameters called formal parameters.
Objects are linked to formal parameters; these objects contain the current process
states. They are called actual parameters.
At program runtime, the values from the process are transferred to the FFB via the
actual parameters and then output again after processing.
The data type of the actual parameters must match the data type of the input/output
(formal parameters). The only exceptions are generic inputs/outputs whose data
type is determined by the actual parameter. If all actual parameters consist of
literals, a suitable data type is selected for the function block.
FFB Call in IL/ST In text languages IL and ST, FFBs can be called in formal and in informal form.
Details can be found in the Reference manual.
Example of a formal function call:
out:=LIMIT (MN:=0, IN:=var1, MX:=5) ;
Example of an informal function call:
out:=LIMIT (0, var1, 5) ;
Note: Take note that the use of EN and ENO is only possible for formal calls.
16 33002527
VAR_IN_OUT FFBs are often used to read a variable at an input (input variables), to process it and
variable to output the altered values of the same variable (output variables).
This special type of input/output variable is also called a VAR_IN_OUT variable.
The input and output variable are linked in the graphic languages (FBD and LD)
using a line showing that they belong together.
Function block with VAR_IN_OUT variable in FBD:
MY_EXAMP1
EXAMP1
Input1 IN1 OUT1 Output1
Input2 IN2 OUT2 Output2
Comb_IN_OUT IO1 IO1 Comb_IN_OUT
Function block with VAR_IN_OUT variable in ST:

MY_EXAMP1 (IN1:=Input1, IN2:=Input2, IO1:=Comb_IN_OUT,
OUT1=>Output1, OUT2=>Output2) ;
The following points must be considered when using FFBs with VAR_IN_OUT
variables:
l All VAR_IN_OUT inputs must be assigned a variable.
l Literals or constants cannot be assigned to VAR_IN_OUT inputs/outputs.
The following additional limitations apply to the graphic languages (FBD and LD):
l When using graphic connections, VAR_IN_OUToutputs can only be connected
with VAR_IN_OUTinputs.
l Only one graphical link can be connected to a VAR_IN_OUT input/output.
l Different variables/variable components can be connected to the VAR_IN_OUT
input and the VAR_IN_OUT output. In this case the value of the variables/variable
component on the input is copied to the at the output variables/variable
component.
l No negations can be used on VAR_IN_OUT inputs/outputs.
l A combination of variable/address and graphic connections is not possible for
VAR_IN_OUT outputs.
33002527 17
EN and ENO
Description An EN input and an ENO output can be configured for all FFBs.
If the value of EN is "0" when the FFB is called up, the algorithms defined by the FFB
are not executed and ENO is set to "0".
If the value of EN is "1" when the FFB is called up, the algorithms defined by the FFB
are executed. After the algorithms have been executed successfully, the value of
ENO is set to "1". If an error occurs when executing these algorithms, ENO is set to
"0".
If ENO is set to "0" (caused by EN=0 or an error during execution):
l Function blocks
l EN/ENO handling with function blocks that (only) have one link as an output
parameter:
Function_block_1 Function_block_2
EN ENO EN ENO
IN1 OUT IN1 OUT
IN2 IN2
If EN from FunctionBlock_1 is set to "0", the output connection OUT from

FunctionBlock_1 retains the status it had in the last correctly executed
cycle.
l EN/ENO handling with function blocks that have one variable and one link as
output parameters:
Function_block_1 Function_block_2
EN ENO EN ENO
IN1 OUT OUT1 IN1 OUT
IN2 IN2
If EN from FunctionBlock_1 is set to "0", the output connection OUT from

FunctionBlock_1 retains the status it had in the last correctly executed
cycle. The variable OUT1 on the same pin, either retains its previous status or
can be changed externally without influencing the connection. The variable
and the link are saved independently of each other.
18 33002527
l Functions/Procedures
As defined in IEC61131-3, the outputs from deactivated functions (EN-input set
to "0") is undefined. (The same applies to procedures.)
Here nevertheless an explanation of the output statuses in this case:
l EN/ENO handling with function/procedure blocks that (only) have one link as
an output parameter:
Function/Procedure_1 Function/Procedure_2
EN ENO EN ENO
IN1 OUT IN1 OUT
IN2 IN2
If EN from Function/Procedure_1 is set to "0", the output connection OUT

from Function/Procedure_1 is also set to "0".
l EN/ENO handling with function/procedure blocks that have one variable and
one link as output parameters:
Function/Procedure_1 Function/Procedure_2
EN ENO EN ENO
IN1 OUT OUT1 IN1 OUT
IN2 IN2
If EN from Function/Procedure_1 is set to "0", the output connection OUT

from Function/Procedure_1 is also set to "0", however the variable OUT1
on the same pin retains its previous value. In this way it is possible for the
variable and the link to have different values.
The output behavior of the FFBs does not depend on whether the FFBs are called
up without EN/ENO or with EN=1.
Conditional/ "Unconditional" or "conditional" calls are possible with each FFB. The condition is
Unconditional realized by pre-linking the input EN.
FFB Call l EN connected
conditional calls (the FFB is only processed if EN = 1)
l EN shown, hidden, and marked TRUE, or shown and not occupied
unconditional calls (FFB is always processed)
Note for IL and The use of EN and ENO is only possible in the text languages for a formal FFB call,
ST e.g.
MY_BLOCK (EN:=enable, IN1:=var1, IN2:=var2,
ENO=>error, OUT1=>result1, OUT2=>result2);
Assigning the variables to ENO must be done with the operator =>.
With an informal call, EN and ENO cannot be used.
33002527 19
20 33002527
Availability of the modules on the
various hardware platforms
2
Availability of the block on the various hardware platforms
Introduction Not all blocks are available on all hardware platforms. The modules that are
available on hardware platform can be found in the following tables.
Note: The functions, procedures and function blocks in this library are not defined
in IEC 61131-3.
33002527 21
Availability of the modules
Expanded Availability of the modules:

Module name Module type Premium Quantum
ADDR EF + -
CANCEL Procedure + -
CREAD_REG EFB - +
CWRITE_REG EFB - +
DATA_EXCH Procedure + -
INPUT_BYTE Procedure + -
INPUT_CHAR Procedure + -
MBP_MSTR EFB - +
MODBUSP_ADDR EFB - +
OUT_IN_CHAR Procedure + -
PRINT_CHAR Procedure + -
RCV_TLG Procedure + -
READ_ASYN Procedure + -
READ_GDATA Procedure + -
READ_REG EFB - +
READ_VAR Procedure + -
SEND_REQ Procedure + -
SEND_TLG Procedure + -
SYMAX_IP_ADDR EFB - +
TCP_IP_ADDR EFB - +
UNITE_SERVER Procedure + -
WRITE_ASYN Procedure + -
WRITE_GDATA Procedure + -
WRITE_REG EFB - +
WRITE_VAR Procedure + -
Legend:
+ Yes
- No
22 33002527
Operation of the communication
EFs
3
At a Glance
Subject of this This chapter describes the operation and management of the communication
Chapter functions.
What's in this This chapter contains the following sections:

Chapter?
Section Topic Page
3.1 General information on Premium and Atrium communication 25
functions
33002527 23
Operation of the communication EFs
24 33002527
3.1 General information on Premium and Atrium

communication functions
At a Glance
Subject of this This section describes the operation and management of the communication
Section functions for Premium and Atrium PLCs.
What's in this This section contains the following topics:

Section?
Topic Page
Rules for using the communication functions of Premium and Atrium PLCs 26
Communication functions on Premium and Atrium PLCs 27
Structure of Premium and Atrium communication functions 30
Destination address 31
Structure of the management parameters 32
Management Parameters: Communication and Operation Reports 34
Management parameters: length and Timeout 38
Server function 39
33002527 25
Rules for using the communication functions of Premium and Atrium PLCs
At a Glance The communication functions used with Premium and Atrium PLCs have certain
unique characteristics which set them apart from the other functions of the library.
This documentation complies with the documentation charter concerning the
function library, but also contains additional information relating to the particularities
of the communication specific-application.
Located All communication functions that do not require programming in the server PLC
variables (READ_VAR, WRITE_VAR, etc.) provide access to the located variables of remote
PLCs. Unlocated variables are not accessible.
Note: To perform inter-PLC transfers of unlocated variables, it is necessary to use

the DATA_EXCH function. Another solution is to make local copies in the located
variable zones.
Apart from the first example of the WRITE_VAR (See Example of how to
write words on a network, p. 247) function, all of the other examples are
made using direct addressing variables (use of addresses, located variables).
Programming The most concise programming language for creating communication applications
language is Structured Text language (ST). All of the examples, except that of the READ_VAR
(See READ_VAR: Reading variables, p. 171) function, are therefore
written in ST.
26 33002527
Communication functions on Premium and Atrium PLCs
At a Glance These functions allow one device to communicate with another. Certain of these are
common to several types of communication channels, others may be specific to a
single communication channel.
Note: Communication functions are processed asynchronously with regard to the

application task that was used to activate them. The only exceptions are the
telegram send/receive and operation stop functions, which are executed in total
synchronization with the execution of the activation task.
33002527 27
Asynchronous A communication function is asynchronous when it is executed during one or several

communication cycles after the one that activated it.
functions The following table provides an overview of the communication functions with
asynchronous execution:
Function Its role is...
READ_VAR to read standard language objects: internal words and bits, system words
and bits, timers, monostables, drums, registers, counters.
WRITE_VAR to write standard language objects: internal words and bits, system words
and bits.
SEND_REQ to send UNI-TE requests.
DATA_EXCH to send/request receipt of data.
PRINT_CHAR to write a character string.
INPUT_CHAR to read a character string.
OUT_IN_CHAR to send a character string and wait for a response.
READ_GDATA to read common Modbus Plus data.
WRITE_GDATA to write common Modbus Plus data.
SERVER to immediately process READ_VAR and WRITE_VAR requests on Modbus
(Immediate server).
READ_Asyn to read 1 Kbytes of messaging.
WRITE_Asyn to write 1 Kbytes of messaging.
Note: It is recommended that asynchronous functions be triggered on edge and

not on state so as to avoid saturating the communication buffers by sending
multiple requests. You are also advised, for the same reason, to manage the
activity bit (See Activity bit, p. 32) and report words (See Management Parameters:
Communication and Operation Reports, p. 34) during the execution of each
communication function.
28 33002527
Synchronous A communication function is said to be synchronous when it is wholly executed

communication during the PLC task which activated it.
functions The following table provides an overview of the communication functions with
synchronous execution:
Function Its role is...
SEND_TLG to send a telegram.
RCV_TLG to receive a telegram.
CANCEL to stop an exchange in progress.
ADR to convert a character string into an address (table of 6 integers) that can be
directly exploited by the communication function.
33002527 29
Structure of Premium and Atrium communication functions
At a Glance A communication function on Premium and Atrium PLCs uses:

l an address parameter,
l parameters specific to a communication operation,
l management parameters.
Syntax The syntax of a communication function is as follows:

Function (Destination address, Specific parameters, Management
parameters)
The following table describes the different entities that make up a function:
Entity Description
Function Corresponds to the type of communication function.
Destination address Indicates the address of the exchange destination.
Specific parameters Depend on the type of communication function. A description of
these is provided for each communication function.
Management Management parameters are common to all asynchronous
parameters communication functions. These are made up of:
l a parameter providing data on the activity of the function,
l a parameter specifying the exchange number that identifies the
transaction in progress,
l a parameter containing the exchange report (communication
report and operation report),
l a timeout parameter that can be used to check if there is no
response,
l a length parameter that can be used to store the number of
bytes to be sent or the number of bytes received.
30 33002527
Destination address
At a Glance This parameter indicates the exchange's destination device address.

It can be located:
l either using internal words (%MW) or internal constants (%KW),
l or by being written directly as an immediate value.
In order to facilitate the preparation phase of the exchange, there is the ADDR()
(See Function Description, p. 43) function, which converts an address-
type immediate value (character string) into a table which is always comprised of six
internal words (%MW).
Example
%MWi:6:=ADDR(’{2.4}SYS’);
33002527 31
Structure of the management parameters
At a Glance Management parameters are grouped together in the form of an array of four
integers. The values contained in this array can be used to manage communication
functions.
Note: in technical documentation, these management parameters are also

called a management table or report.
Note: The first two words are managed by the system. You are responsible for
managing the last two words.
Structure The following table describes the structure of the data in the communication
management table:
Order of the word Most significant byte Least significant byte
Data managed by 1 Exchange number Activity bit
the system 2 operation report (See communication report
Operation Report, p. 36) (See Communication
Report, p. 35)
Data managed by 3 Timeout (See Timeout, p. 38)
the user 4 Length (See Length, p. 38)
Activity bit This bit indicates the execution status of the communication function.
It is set to 1 when launched and returns to 0 when its execution is complete.
This is the first bit of the first element of the table.
Example: if the management table has been declared as follows:
Tab_Gest ARRAY [1..4] OF INT, the activity bit is the bit with the notation
Tab_Gest[1].0.
Note: the notation previously used requires configuration of the project properties
in such a way as to authorize the extraction of bits on integer types. If this is not the
case Tab_Gest[1].0 cannot be accessed in this manner.
32 33002527
Exchange When a communication function is sent, the system automatically allocates it a

number number, enabling the exchange to be identified.
This number can be used where necessary to stop the exchange in progress (using
the CANCEL (See Function Description, p. 46) function).
33002527 33
Management Parameters: Communication and Operation Reports
At a Glance Communication and operation reports are part of the management parameters.
Note: It is recommended that communication function reports always be tested at

the end of their execution and before the next activation. On cold start-up, it is
imperative that all communication function management parameters be checked
and reset to 0.
34 33002527
Communication This report is common to all functions. It is significant when the value of the activity
Report bit switches from 1 to 0.
The reports with a value between 16#01 and 16#FE concern errors detected by the
processor that executed the function.
The different values of this report are indicated in the following table:
Value Communication report (least significant byte)
16#00 Correct exchange
16#01 Exchange stop on timeout
16#02 Exchange stop on user request (CANCEL)
16#03 Incorrect address format
16#04 Incorrect destination address
16#05 Incorrect management parameter format
16#06 Incorrect specific parameters
16#07 Problem in sending to the destination
16#08 Reserved
16#09 Insufficient receive buffer size
16#0A Insufficient send buffer size
16#0B No processor system resources
16#0C Incorrect exchange number
16#0D No telegram received
16#0E Incorrect length
16#0F Telegram service not configured
16#10 Network module missing
16#11 Request missing
16#12 Application server already active
16#13 UNI-TE V2 transaction number incorrect
16#FF Message refused
Note: The function can detect a parameter error before activating the exchange. In
this case the activity bit remains at 0, and the report is initialized with values
corresponding to the error.
33002527 35
Operation Report This report byte is specific to each function, and specifies the result of the operation
on the remote application.
It is significant only if the communication report has the following values:
l 16#00 (correct exchange),
l 16#FF (message refused).
If the value of the communication report is 16#00, the operation report will have the
following values:
Value Operation report (most significant byte)
16#00 Positive result
16#01 Request not processed
16#02 Incorrect response
16#03 Reserved
36 33002527
If the value of the communication report is 16#FF, the operation report will have the
following values:
Value Operation report (most significant byte)
16#01 No resources towards the processor
16#02 No line resources
16#03 No device or device without resources (*)
16#04 Line error
16#05 Length error
16#06 Faulty communication channel
16#07 Addressing error
16#08 Application error
16#0B No system resources
16#0C Communication function not active
16#0D Destination missing
16#0F Intra-station routing problem or channel not configured
16#11 Address format not managed
16#12 No destination resources
16#14 Non-operational connection (example: Ethernet TCP/IP)
16#15 No resource on the local channel
16#16 Access not authorized (example: Ethernet TCP/IP)
16#17 Inconsistent network configuration (example: Ethernet TCP/IP)
16#18 Connection temporarily unavailable
16#21 Application server stopped
16#30 Transmission error
Legend:
(*) Code only managed by PCMCIA cards: TSX FPP20 and TSX FPP10
33002527 37
Management parameters: length and Timeout
At a Glance You are responsible for these two parameters.
Length The length parameter is used both to specify the number of characters (in bytes) to
be sent during transmission, but also to store the number of characters (in bytes)
received after reception of a message.
Before certain communication functions are launched (SEND_REQ, DATA_EXCH,
PRINT_CHAR, SEND_TLG), it is compulsory for some of these functions, and
advisable for others, to update the length parameter.
Note: With the PRINT_CHAR function, for example, if another function in the
application is using the same report table where the number of bytes to send is
different to the previous function, it is imperative to initialize the length parameter
with the new number of bytes to transmit. Otherwise it keeps the same number of
bytes sent by the previous function.
Timeout Timeout determines the maximum waiting time for the response. The time base for
this parameter is 100 ms (the value 0 corresponds to an infinite waiting value).
When the timeout elapses, the exchange is ended with an error report. Also, the
system does not accept any responses after the end of the timeout.
Example
Launch of the function Activity bit = 1

Activation of timeout
Reset of the report
Assignment of the exchange number
End of timeout Reception of the response
Activity bit = 0
Stop of timeout
Activity bit = 0 Update of the report
report = 1
Note: The value of a communication function's timeout must be sufficient to ensure

that the response to the question asked is received (use of an external modem on
a protocol-based link, for example).
38 33002527
Server function
At a Glance The server function can be used to respond to requests from client devices.
The TSX 57 35• and PCX 57 35• processors provide two request servers:
l a main server (recommended for requests of less than 256 bytes),
l an auxiliary server (recommended for requests of up to 1024 bytes),
Both of these servers can be activated simultaneously.
Illustration The following diagram shows the requests sent to the servers in the PLC cycle:
Inputs
Main server
(UNI-TE server)
MAST task Processing
Auxiliary server
(asynchronous server)
Outputs
33002527 39
Main server This server corresponds to port 0 (UNI-TE server). It is activated at the start of the
PLC's MAST cycle.
The response time of the client PLC depends on the cycle time of the server PLC.
This can be used to process up to 4 simultaneous requests per PLC cycle.
All UNI-TE requests are supported. The size of the request must be less than 256
bytes.
This entity can be addressed at the topological address SYS or
{network.station}SYS.
Auxiliary server This server corresponds to port 7 (asynchronous server). It is activated only for
periodical tasks at the end of the PLC cycle, after the MAST task has been
processed whilst awaiting the start of the next cycle.
The start of the next, higher priority cycle could interrupt a request in progress.
Access to this server is therefore reserved for applications requiring no consistency
in their read/write data.
The application response time will essentially depend on the PLC cycle time. The
size of the request may be up to 1024 bytes. It cannot be accessed from a
communication function; the server processes object (bit or word) READ/WRITE
requests, etc.
40 33002527
Extended
II
Introduction
Overview This section describes the elementary functions and elementary function blocks of
the Extended family.
33002527 41
Extended
What's in this This part contains the following chapters:

Part?
4 ADDR: Address conversion 43
5 CANCEL: Stopping an exchange in progress 45
6 CREAD_REG: Continuous register reading 49
7 CWRITE_REG: Continuous register writing 57
8 DATA_EXCH: Exchanging data between applications 65
9 INPUT_BYTE: Receiving character strings 75
10 INPUT_CHAR: Receiving character strings 79
11 MBP_MSTR: Modbus Plus Master 87
12 ModbusP_ADDR: Modbus Plus Address 131
13 OUT_IN_CHAR: Sending/receiving character strings 137
14 PRINT_CHAR: Sending character strings 145
15 RCV_TLG: Receiving telegrams 153
16 READ_ASYN: Reading data asynchronously 157
17 READ_GDATA: Reading Modbus Plus Global Data 161
18 READ_REG: Read register 163
19 READ_VAR: Reading variables 171
20 SEND_REQ: Sending requests 185
21 SEND_TLG: Sending telegrams 201
22 SYMAX_IP_ADDR: SY/MAX IP Address 207
23 TCP_IP_ADDR: TCP/IP Address 211
24 UNITE_SERVER: Immediate server 217
25 WRITE_ASYN: Writing data asynchronously 223
26 WRITE_GDATA: Writing the Global Data Modbus Plus 227
27 WRITE_REG: Write register 231
28 WRITE_VAR: Writing variables 241
42 33002527
ADDR: Address conversion
4
Description
Function The ADDR function is used to convert a character string into an address that can be
Description used directly by communication functions.
The additional parameters EN and ENO can be configured.
FBD Representation:
representation
ADDR
Addr_String IN OUT Addr_Array
LD Representation:
representation
ADDR
EN ENO
Addr_String IN OUT Addr_Array
IL representation Representation:
LD Addr_String
ADDR
ST Addr_Array
33002527 43
ADDR
ST Representation:
representation Addr_Array := ADDR(Addr_String);
Parameter The following table describes the input parameters:

Description
Parameter Type Comment
Addr_String STRING Character string-type variable representing the device
address on a bus or network.
Examples: ‘{5.6}SYS’, ‘{1.2}0.4.5.2’
The following table describes the output parameters:

Addr_Array ARRAY [0..5] OF Array of 6 integers representing the Addr_String
INT address.
Addr_Array may be used directly as the first input
parameter of the communication EFs.
44 33002527
CANCEL: Stopping an exchange
in progress
5
At a Glance
Subject of this This chapter describes the CANCEL function.

Chapter

Chapter?
Topic Page
Description 46
Example of how to cancel an exchange 48
33002527 45
CANCEL
Description
Function The CANCEL function is used to interrupt an asynchronous communication function

Description in progress. The exchange number assigned to each communication can be used
to identify the function to be stopped.
Note: the execution of this function is synchronous with the execution of the PLC
program (the communication function is stopped in the PLC cycle during which the
CANCEL function was executed).
FBD Representation:
representation
CANCEL
Exchange_num NUM CR Report
Ladder Representation:
representation
CANCEL
EN ENO
Exchange_num NUM CR Report
LD Exchange_Num
CANCEL
ST Report
ST Representation:
representation CANCEL(Exchange_Num, Report);
46 33002527
CANCEL

Description
Exchange_Num INT This parameter specifies the number of the exchange
whose execution is to be stopped.

Report INT This operation report is assigned one of the following
two values:
l 16#00 : correct operation. Communication is
interrupted, the activity bit of the interrupted function
is set to 0 and its report is assigned the value 2.
l 16#0C: incorrect exchange number.
33002527 47
CANCEL
Example of how to cancel an exchange
At a Glance This example covers canceling an exchange carried out with the OUT_IN_CHAR
function.
When the exchange is launched, a unique number is assigned to it. This number
remains valid until the end of the exchange.
The CANCEL function uses this number to interrupt the exchange to which it is
assigned.
Programming Programming in ST:

the IF RE(%I0.3.8) AND NOT %MW170.0 THEN
OUT_IN_CHAR (* initialization of the data to send *)
function %MW173 := 10;
(* communication function *)
OUT_IN_CHAR(ADDR(‘{20.5}0.0.0.SYS’),1,Str_Out,Str_In,%MW170:
4);
END_IF;

the CANCEL %MW180 := SHRZ_INT(%MW170,8);
function IF RE(%I0.3.9) THEN
CANCEL(%MW180,%MW185);
END_IF;
The CANCEL function comprises two parameters:
l on input: the exchange number to be cancelled,
l on output: the report.
It is necessary to initialize the first parameter with the number of the exchange to be
cancelled. This number is located in the most significant byte of the first word of the
management table. For us, this is the most significant byte of %MW170. Before
sending the CANCEL function, it is necessary to create an 8 bit shift in order to
recover the eight most significant bits of %MW170.
Request parameters:
Parameters Description
%MW180 The least significant bit contains the number of the exchange to be
cancelled. CAUTION, the most significant byte must be zero.
%MW185 Function report.
48 33002527
CREAD_REG: Continuous
register reading
6
Overview
Introduction This chapter describes the CREAD_REG block.

Chapter?
Topic Page
Description 50
Derived Data Types 52
Function mode 54
Parameter description 55
33002527 49
CREAD_REG
Description
Function This function block reads a register area continuously. It reads data from an
description addressed node via Modbus Plus, TCP/IP Ethernet or SY/MAX Ethernet.
EN and ENO can be configured as additional parameters.
Note: When programming a CREAD_REG function, you must be familiar with the
routing procedures used by your network. Modbus Plus routing path structures are
described in detail in the Modbus Plus Network Planning and Installation Guide. If
TCP/IP or SY/MAX Ethernet routing is implemented, standard Ethernet IP router
products must be used. A full description of the TCP/IP routing is provided in the
Quantum with Unity ProTCP/IP Configuration User Guide.
Note: Several copies of this function block can be used in the program. However,
multiple instancing of these copies is not possible.
Representation Representation:
in FBD CREAD_REG_Instance
CREAD_REG
OffsetAddress SLAVEREG
NumberOfRegisters NO_REG REG_READ RegisterToRead
DataStructure ADDRFLD STATUS ErrorCode
in LD CREAD_REG_Instance
CREAD_REG
EN ENO
50 33002527
CREAD_REG
in IL CAL CREAD_REG_Instance (SLAVEREG:=OffsetAddress,
NO_REG:=NumberOfRegisters, ADDRFLD:=DataStructure,
REG_READ=>RegisterToRead, STATUS=>ErrorCode)
in ST CREAD_REG_Instance (SLAVEREG:=OffsetAddress,
NO_REG:=NumberOfRegisters, ADDRFLD:=DataStructure,
REG_READ=>RegisterToRead, STATUS=>ErrorCode) ;
Parameter Description of input parameters:

description
Parameter Data type Description
SLAVEREG DINT Offset address of the first %MW register in the slave
to be read from.
NO_REG INT Number of addresses to be read from slave.
ADDRFLD WordArr5 Data structure describing the Modbus Plus address,
TCI/IP address or SY/MAX IP address.
Description of output parameters:

REG_READ ANY Data to be read
For the file to be read a data structure must be
declared as a located variable.
STATUS WORD If an error occurs while the function is being
executed, an error code remains at this output for
one cycle.
Error code, see
l Modbus Plus and SY/MAX Ethernet Error
Codes, p. 122
l SY/MAX-specific error codes, p. 124
l TCP/IP Ethernet error codes, p. 126
Runtime error For a list of all block error codes and values, see Extended, p. 254.
33002527 51
CREAD_REG
Derived Data Types
Derived data Element descriptions:

typeWordArr5 in
Element Data type Description
Modbus Plus
WordArr5[1] WORD Least significant byte:
Routing register 1 is used for address specification
(routing path addresses one of five) of the
destination node during network transfer.
The last byte in the routing path that is not zero is
the destination node.
Most significant byte:
Slot of the network adapter module (NOM), if any
(only Quantum).
WordArr5[2] WORD Routing register 2
Element Element description for WordArr5 with TCP/IP Ethernet

description for
WordArr5 with
TCP/IP Ethernet WordArr5[1] WORD Least significant byte:
MBP on Ethernet Transporter (MET) mapping index
Slot of the NOE module
WordArr5[2] WORD Byte 4 (MSB) of the 32-bit destination IP address
WordArr5[3] WORD Byte 3 of the 32-bit destination IP address
WordArr5[5] WORD Byte 1 (LSB) of the 32-bit destination IP address
52 33002527
CREAD_REG
Element Element description for WordArr5 with SY/MAX Ethernet

description for
WordArr5 with
SY/MAX Ethernet WordArr5[1] WORD Least significant byte:
WordArr5[2] WORD Destination drop number (or set to FF hex)
WordArr5[3] WORD Terminator (set to FF hex)
WordArr5[4] WORD No significance
33002527 53
CREAD_REG
Function mode
Function mode Although a large number of CREAD_REG function blocks can be programmed; only
of the four read operations may be active at the same time. In this case it is irrelevant
CREAD_REG whether they are the result of this function block or others (e.g. MBP_MSTR, MSTR,
block READ_REG). All function blocks use one data transaction path and require multiple
cycles to complete a job.
Note: A TCP/IP communication between a Quantum PLC (NOE 211 00) and a
Momentum PLC (all TCP/IP CPUs and all TCP/IP I/O modules) is only possible,
when only one read or write job is carried out in every cycle. If several jobs are sent
per PLC cycle, the communication stops without generating an error message in
the status register of the function block.
All routing information is contained in the WordArr5 data structure of the ADDRFLD
input. The type function block assigned to this input is defined by the network used.
Please use:
l Modbus Plus for function block ModbusP_ADDR
l TCP/IP Ethernet for function block TCP_IP_ADDR
l SY/MAX Ethernet for function block SYMAX_IP_ADDR
Note: The WordArr5 data structure can also be used with constants.
Note: This function block puts a heavy load on the network; therefore the network
load must be carefully monitored. If the network load is too high, the program logic
should be reorganized in order to work with the READ_REG function block, a
variation of this function block that does not operate in a continuous mode, but
under command control.
54 33002527
CREAD_REG
Parameter description
SLAVEREG Start of the area in the addressed slave from which the source data is read. The
source area always resides within the %MW register area.
Note: For slaves for a non-Unity Pro PLC:

The source area always resides within the 4x register area. SLAVEREG expects the
source reference as offset within the 4x area. The leading "4" must be omitted (e.g.
59 (contents of the variables or value of the literal) = 40059).
The parameter can be entered as an address, located variable, unlocated variable

or literal.
NO_REG Number of addresses to be read from the addressed slave (1 ... 100).
The parameter can be entered as an address, located variable or unlocated
variable.
REG_READ An ARRAY that is the same size as the requested transmission must be agreed upon
(≥ NO_REG) for this parameter. The name of this array is defined as a parameter. If
the array is defined too small, then only the amount of data is transmitted that is
present in the array.
The parameter must be defined as a located variable.
STATUS If an error occurs while the function is being executed, an error code remains at this
output for one cycle.
Error code, see
l Modbus Plus and SY/MAX Ethernet Error Codes, p. 122
variable.
33002527 55
CREAD_REG
56 33002527
CWRITE_REG: Continuous
register writing
7
Overview
Introduction This chapter describes the CWRITE_REG block.

Chapter?
Topic Page
Description 58
Function mode 63
33002527 57
CWRITE_REG
Description
Function This function block writes continuously to the register area. It transfers data from the
description PLC via Modbus Plus, TCP/IP Ethernet or SY/MAX Ethernet to an addressed slave.
Note: You must be familiar with the routing procedures of the network when
programming a CWRITE_REG function. Modbus Plus routing path structures are
in FBD CWRITE_REG_Instance
CWRITE_REG
NumberOfRegisters NO_REG
SourceDataArea REG_WRIT
58 33002527
CWRITE_REG
in LD CWRITE_REG_Instance
CWRITE_REG
EN ENO
in IL CAL CWRITE_REG_Instance (SLAVEREG:=OffsetAddress,
NO_REG:=NumberOfRegisters, REG_WRIT:=SourceDataArea,
ADDRFLD:=DataStructure, STATUS=>ErrorCode)
in ST CWRITE_REG_Instance ( SLAVEREG:=OffsetAddress,
NO_REG:=NumberOfRegisters, REG_WRIT:=SourceDataArea,
ADDRFLD:=DataStructure, STATUS=>ErrorCode) ;
33002527 59
CWRITE_REG

description
to be written to.
NO_REG INT Number of addresses to be written from slave
REG_WRIT ANY Source data
(A data structure must be declared as a located
variable for the source file .)
ADDRFLD WordArr5 Data structure transferring the Modbus Plus-
address, TCI/IP address or SY/MAX-IP address.

one cycle.
Error code, see
Codes, p. 122
60 33002527
CWRITE_REG
Derived Data Types
Element Element description for WordArr5 in Modbus Plus:

description for
WordArr5 in
Modbus Plus WordArr5[1] WORD Least significant byte:
Slot of the network adapter module (NOM), if any.

description for
WordArr5 with
Slots of the NOE module
33002527 61
CWRITE_REG
Element Element description for WordArr5 with SY/MAX Ethernet

description for
WordArr5 with
62 33002527
CWRITE_REG
Function mode
Function mode Although a large number of CWRITE_REG function blocks can be programmed, only
of the four write operations may be active at the same time. In this case it is irrelevant
CWRITE_REG whether they are the result of this function block or others (e.g. MBP_MSTR, MSTR,
block WRITE_REG). All function blocks use one data transaction path and require multiple
If several CWRITE_REG function blocks are used within an application, they must at
least differ in the values of their NO_REG or REG_WRIT parameters.
Please use:
Note: This function block puts a heavy load on the network; therefore the network
load must be carefully monitored. If the network load is too high, the program logic
should be reorganized, in order to work with the WRITE_REG function block, a
variation of this function block that does not operate in a continuous mode, but
under command control.
33002527 63
CWRITE_REG
SLAVEREG Start of the area in the addressed slave to which the source data is written. The
source area always resides within the %MW address area.

The destination area always resides within the 4x register area. SLAVEREG expects
the target address as an offset within the 4x area. The leading "4" must be omitted
(e.g. 59 (contents of the variables or value of the literal) = 40059).
or literal.
NO_REG Number of registers to be written to slave processor (1 ... 100). The parameter can
be entered as an address, located variable, unlocated variable or literal.
Error code, see
variable.
REG_WRIT An ARRAY that is the same size as the requested transmission must be agreed upon
64 33002527
DATA_EXCH: Exchanging data
between applications
8
At a Glance
Subject of this This chapter describes the DATA_EXCH function.

Chapter

Chapter?
Topic Page
Description 66
Assisted entry screen 69
Example of how to use a Fipway network 71
33002527 65
DATA_EXCH
Description
Function The DATA_EXCH function is used to perform data transfers from one application to
Description another:
l data transmission,
l data reception,
l data transmission then reception.
Note: this function can be used to send UNI-TE or Modbus requests to another
device. For this, it is necessary to make sure the data sent constitutes the entire
frame required by the protocol being used.
FBD Representation:
representation
DATA_EXCH
Address ADR RECP Received_Data
Action TYPE
Data_to_Send EMIS
Management_Param GEST GEST Management_Param
LD Representation:
representation
DATA_EXCH
EN ENO
Action TYPE
Data_to_Send EMIS
66 33002527
DATA_EXCH
LD Address
DATA_EXCH Action, Data_to_Send, Management_Param,
Received_Data
ST Representation:
representation DATA_EXCH(Address, Action, Data_to_Send, Management_Param,
Received_Data);

Description
Address ARRAY [0... 5] OF Address of the destination entity of the
INT exchange. If the Action parameter is send/
receive type, broadcast addresses are
prohibited.
Action INT Type of action to perform. The possible values
are:
l 1: transmission followed by await reception
(this action is not possible in slave Uni-
Telway).
l 2: transmission only.
l 3: receive mode.
Data_to_Send ARRAY [n... m] Integer table to be sent to the destination device
OF INT of the request.
Caution: there must be a minimum length of 1

element, even if there is no data to send (code
3 for action, for example).
Note: It is imperative that the length of the data

to be sent (in bytes) be assigned to the fourth
word of the management table before launching
the function, in order for this to be correctly
executed.
The following table describes the input/output parameters:

Management_Param ARRAY [0... 3] OF Exchange management table (See Structure of
INT the management parameters, p. 32).
33002527 67
DATA_EXCH

Received_Data ARRAY [n... m] Integer table containing the data received
OF INT during receive mode or a send/receive action.
Caution: even if the action is a transmission

only, there must be a Received_Data table,
with a minimum size of 1.
Note: the size of the data received (in bytes) is

written automatically by the system in the fourth
word of the management table (See
Management parameters: length and Timeout,
p. 38).
68 33002527
DATA_EXCH
Assisted entry screen
At a Glance For this communication function, you can call up the assisted entry screen.
Note: The symbols are accepted.
Illustration The following screen shows an assisted entry screen of the function:
DATA_EXCH
Parameters
Address: ... ?
Mode: ... Exchange
Data to Send: ...
Data to Receive: ...
Report: ...
Possible types: Array of Constant Int, Array of Int (n>=6)
Address ADDR(‘..’)
OK Cancel
Address The possible type of object is:

l ADDR(STRING).
l ARRAY [0..5] OF INT.
Note: if you enter a value directly in the field, the assisted address entry button
turns gray.
Mode Possible choices:

l 1 :Exchange,
l 2 : Transmission,
l 3 : Reception.
Note: if you use the entry field instead of the menu, you can enter a variable of the
INT type, either located or not.
33002527 69
DATA_EXCH
Data to send The variable for transmission is an integer array. This array can be located or not.
Data to be The reception zone is an array of integers, that can be located or not. The size of
received this array depends on the number of objects to be received.
Report The report is an array of 4 integers, that can be located or not.
Note: be careful not to use several identical memory areas for report tables,
otherwise the variable read function may not work.
70 33002527
DATA_EXCH
Example of how to use a Fipway network
At a Glance Let us suppose we want two PLC stations to communicate on a Fipway network.
Station 1 must send the data (20 bytes located in %MW70:10) to station 2, which
receives it in a table located in %MW80:10. Each PLC has a management table
starting with the address %MW90.
For station 1, the word %MW93 must contain the length of the data to be sent, or 20
(10 words to be sent).
For station 2, the word %MW93 is set to 0 before the exchange, in order to see the
number of characters received at the end of the exchange.
The DATA_EXCH function requires both PLCs to be programmed, one to send, the
other to receive.
Illustration The two stations are connected via a Fipway network:
Premium {20.1} Premium {20.2}
Fipway
33002527 71
DATA_EXCH
Transmission Programming in ST:

programmed in
station 1 IF RE(%I0.3.2) AND NOT %MW90.0 THEN
(* initialization of the data to send *)
%MW93:= 20;
DATA_EXCH(ADDR(’{20.2}APP’),2,%MW70:10,%MW90:4,%MW80:1);
END_IF;
Request parameters:
ADDR(‘{20.2}APP’) l 20 : network
l 2 : station
l APP: application of station 2
2 Type of communication: transmission
%MW70:10 Data to send
%MW90:4 Management table
%MW80:1 Reception zone for responses. Here, there is no data to receive,
but a word must nevertheless be reserved (compulsory).
72 33002527
DATA_EXCH
Reception IF RE(%I0.3.4) AND NOT %MW90.0 THEN

programmed in (* initialization of the data to receive *)
station 2 %MW93:= 0;
DATA_EXCH(ADDR(’{20.1}APP’),3,%MW70:1,%MW90:4,%MW80:10);
END_IF;
Request parameters:
ADDR(‘{20.1}APP’) l 20 : network
l 1 : station
l APP: application of station 1
3 Type of communication: reception
%MW70:1 Data to send. Here there is none, but at least one word must be
reserved.
%MW80:10 Reception zone: 10 words are provided from station 1.
33002527 73
DATA_EXCH
74 33002527
INPUT_BYTE: Receiving
character strings
9
Description
Function INPUT_BYTE is used to send an array of bytes read request to a character mode
Description communication module. The message received is stored in an array of bytes.
This function is used to receive up to 4 Kbytes (120 bytes for the terminal port).
Two exclusive possibilities are available:
l read a number of bytess: no condition should be configured,
l read a message: a stop condition should be configured in the configuration
screen.
FBD Representation:
representation
INPUT_BYTE
Raz RAZ
Buffer_Length NB
33002527 75
INPUT_BYTE
LD Representation:
representation
INPUT_BYTE
EN ENO
Raz RAZ
Buffer_Length NB
LD Address
INPUT_BYTE Reset, Buffer_Length, Management_Param,
Received_Data
ST Representation:
representation INPUT_BYTE(Address, Reset, Buffer_Length, Management_Param,
Received_Data);
76 33002527
INPUT_BYTE

Description
ADR ARRAY [0.. 5] Address of the message's receiving character
OF INT mode channel. Only those addresses ending
in SYS are possible (example: 0.0.0.SYS
processor terminal port).
RAZ INT Reset. This parameter is used to reset the
coupler's receive memory.
l value = 0: no memory reset,
l value = 1: memory reset.
Note: For terminal port communications, the
value must be 1.
NB INT Length of the buffer or number of bytes to be
received.
l value = 0: message read as soon as it is
available on the channel. Here, a stop
condition must be specified in the
configuration screen,
l value greater than 0: specifies the number of
bytes to be read.
Note: For terminal port communications, 0 is
the only value authorized. Here, the default end
of message character is a carriage return (CR).

GEST ARRAY [0.. 3] Exchange management table (See Structure of
OF INT the management parameters, p. 32).

RECP ARRAY OF BYTE Bytes received. This is then stored in a BYTE
array.
33002527 77
INPUT_BYTE
Programming When several INPUT_BYTE are launched simultaneously, the Reset parameter
rules must be set to 0 (module's receive memory not reset).
A request may be made to reset the module's memory for the next message in order
to avoid receiving old data.
When the Reset parameter is set to 1, the INPUT_BYTE function must be launched
before sending the data.
It takes several PLC cycles to receive an arry of bytes of more than 240 bytes. It is
therefore important to make sure that the management data is not modified during
the processing of the function. The system receives the string consistently over
several fragments.
78 33002527
INPUT_CHAR: Receiving
character strings
10
At a Glance
Subject of this This chapter describes the INPUT_CHAR function.

Chapter

Chapter?
Topic Page
Description 80
Example of how to read character strings 85
33002527 79
INPUT_CHAR
Description
Function The INPUT_CHAR function is used to send a character string read request to a
Description character mode communication module (await reception of character strings). The
message received is stored in a character string.
This function is used to receive up to 4 Kbytes (120 bytes for the terminal port).
Two exclusive possibilities are available:
l read a number of characters: no condition should be configured,
l read a message: a stop condition should be configured in the configuration
screen.
FBD Representation:
representation
INPUT_CHAR
Raz RAZ
String_Length NB
LD Representation:
representation
INPUT_CHAR
EN ENO
Raz RAZ
String_Length NB
80 33002527
INPUT_CHAR
LD Address
INPUT_CHAR Reset, String_Length, Management_Param,
Received_Data
ST Representation:
representation INPUT_CHAR(Address, Reset, String_Length, Management_Param,
Received_Data);

Description
Address ARRAY [0.. 5] OF Address of the message's receiving character
INT mode channel. Only those addresses ending
in SYS are possible (example: 0.0.0.SYS
processor terminal port).
Reset INT Reset. This parameter is used to reset the
coupler's receive memory.
l value = 0: no memory reset,
l value = 1: memory reset.
Note: For terminal port communications, the
value must be 1.
String_Length INT Length of the character string or number of
characters to be received.
l value = 0: message read as soon as it is
available on the channel. Here, a stop
condition must be specified in the
configuration screen,
l value greater than 0: specifies the number of
characters to be read.
Note: For terminal port communications, 0 is
the only value authorized. Here, the default end
of message character is a carriage return (CR).

Management_Param ARRAY [0.. 3] OF Exchange management table (See Structure of
33002527 81
INPUT_CHAR

Received_Data STRING String received. This is then stored in a
character string.
Programming When several INPUT_CHAR are launched simultaneously, the Reset parameter
rules must be set to 0 (module's receive memory not reset).
A request may be made to reset the module's memory for the next message in order
to avoid receiving old data.
When the Reset parameter is set to 1, the INPUT_CHAR function must be launched
before sending the data.
It takes several PLC cycles to receive a character string of more than 240 bytes (the
string is fragmented). It is therefore important to make sure that the management
data is not modified during the processing of the function. The system receives the
string consistently over several fragments.
82 33002527
INPUT_CHAR
Illustration The following screen shows an example of the assisted entry screen of the function:
INPUT_CHAR
Parameters
Address: ...
?
Reset module memory: ... Yes No
Type of read
Read message with Stop condition
Define number of characters to read
Number of Characters: ...

String to Receive: ...
Report: ...
OK Cancel

l ADDR(STRING).
turns gray.
33002527 83
INPUT_CHAR
Reset module Possible INT type choice :

memory l Yes,
l No.
Note: selecting the Yes/No buttons immediately displays the value 1 or 0.
Type of read The two radio buttons select the mode of operation and this choice must be made
according to the configuration of the channel used.
Number of You can enter an integer, in the form of a variable or an immediate value.
characters
String to be The reception zone is a variable of theSTRING type. The size of this variable is a
received function of the number of characters to be received. This variable must be declared
before being used in this screen.
Report The report is an array of 4 integers.
84 33002527
INPUT_CHAR
Example of how to read character strings
At a Glance From a station with an address of 1 on Fipway network 20, we would like to read a
character string sent by a video terminal (screen and keyboard) connected to the
TER port of the PLC with a network address of 20, station 5.
This character string is stored in the Str_1 variable, the management table of the
communication function being %MW110:4.
Illustration The two stations are connected via a Fipway network.
Premium Micro
{20.5}
Fipway
{20.1}
33002527 85
INPUT_CHAR
IF RE(%I0.3.6) AND NOT %MW110.0 THEN

INPUT_CHAR(ADDR(’{20.5}0.0.SYS’), 1, 0, %MW110:4, Str_1);
END_IF;
Request parameters:
ADDR(‘{20.5}0.0.0.SYS’) l {20.5} : network 20, station 5
l 0 : rack
l 0 : module
l 0 : channel 0
l SYS: system address (terminal port)
1 Reset
0 Read the entire character string
Str_1 Variable of type STRING that is to receive the message
86 33002527
MBP_MSTR: Modbus Plus Master
11
Overview
Introduction This chapter describes the MBP_MSTR block.
33002527 87
MBP_MSTR

Chapter?
Topic Page
Description 89
Function mode 92
Write data 97
Read data 99
Read local statistics 101
Clear local statistics 102
Write Global Data (Peer Cop) 103
Read Global Data (Peer Cop) 104
Get remote statistics 105
Clear remote statistics 107
Peer cop health 108
Optional module reset 109
Read CTE (Config extension table) 110
Write CTE (Config extension table) 112
Peer Cop Communications Health Status 114
Modbus Plus network statistics 116
TCP/IP Ethernet Network Statistics 121
Modbus Plus and SY/MAX Ethernet Error Codes 122
SY/MAX-specific error codes 124
TCP/IP Ethernet error codes 126
CTE error codes for SY/MAX and TCP/IP Ethernet 129
88 33002527
MBP_MSTR
Description
Function It is possible to select one of 12 available network communication operations using

description this function block.
Although a large number of MBP_MSTR function blocks can be programmed, only
four of them can be active at the same time. All function blocks use one data
transaction path and require multiple cycles to complete a job.
Note: A TCP/IP communication between a Quantum PLC and a Momentum PLC

is only possible when only oneread or write job is carried out in every cycle. If
several jobs are sent per PLC cycle, the communication stops without generating
an error message in the status register of the function block.
Note: The function block can only be used on the program level, i.e. not in Derived
Function Blocks (DFBs).
Note: You must be familiar with the routing procedures of your network when
programming an MSTR function. Modbus Plus routing path structures are described
in detail in the Modbus Plus Network Planning and Installation Guide. If TCP/IP or
SY/MAX Ethernet routing is implemented, standard Ethernet IP router products
must be used. A full description of the TCP/IP routing is provided in the Quantum
with Unity Pro TCP/IP Configuration User Guide.
33002527 89
MBP_MSTR
in FBD
MBP_MSTR_Instance
MBP_MSTR
EnableMSTRFunction ENABLE ACTIVE OperationActiv
CancelActivMSTROperation ABORT ERROR FaultyOperation
SUCCESS OperationSuccessful
CONTROL ControlBlock
DATABUF DataField
in LD
MBP_MSTR_Instance
MBP_MSTR
EN ENO
EnableMSTRFunction OperationActiv
ENABLE ACTIVE
CancelActivMSTROperation FaultyOperation
ABORT ERROR
OperationSuccessful
SUCCESS
CONTROL ControlBlock
DATABUF DataField
in IL CAL MBP_MSTR_Instance (ENABLE:=EnableMSTRFunction,
ABORT:=CancelActivMSTROperation, ACTIVE=>OperationActiv,
ERROR=>FaultyOperation, SUCCESS=>OperationSuccessful,
CONTROL=>ControlBlock, DATABUF=>DataField)
90 33002527
MBP_MSTR
in ST MBP_MSTR_Instance (ENABLE:=EnableMSTRFunction,
ABORT:=CancelActivMSTROperation, ACTIVE=>OperationActiv,
ERROR=>FaultyOperation, SUCCESS=>OperationSuccessful,
CONTROL=>ControlBlock, DATABUF=>DataField) ;

description
ENABLE BOOL Enable MSTR function
ABORT BOOL Cancel active MSTR operation

ACTIVE BOOL Operation is active
ERROR BOOL Faulty operation
SUCCESS BOOL Operation completed successfully
CONTROL ANY Field for MSTR control block
(For the control block a data structure must be
declared as a located variable.)
DATABUF ANY Data area
(For the data area a data structure must be declared
as a located variable.)
Runtime error In the event of an error occurring during an MSTR operation, a hexadecimal error
code is displayed in the CONTROL[2] register of the control block for one cycle.
Function error codes are network-specific:
l Modbus Plus and SY/MAX Ethernet error codes (See Modbus Plus and SY/MAX
Ethernet Error Codes, p. 122)
l SY/MAX specific error codes (See SY/MAX-specific error codes, p. 124)
l TCP/IP Ethernet error codes (See TCP/IP Ethernet error codes, p. 126)
l CTE Error Codes for SY/MAX and TCP/IP Ethernet (See CTE error codes for SY/
MAX and TCP/IP Ethernet, p. 129)
Note: For a list of all block error codes and values, see Extended, p. 254.
33002527 91
MBP_MSTR
Function mode
Function mode Using the MBP_MSTR block, one of 12 available network communication operations
of MBP_MSTR can be triggered via the network. Each operation receives a code. Whether the
blocks operations are available depends on the type of network used.
Valid function Valid function codes:

codes
Code Function Modbus TCP/IP SY/MAX
Plus Ethernet Ethernet
1 Write data X X X
2 Read data X X X
3 Get local statistics X X -
4 Clear local statistics X X -
5 Write global data, Peer Cop X - -
6 Read global data, Peer Cop X - -
7 Get remote statistics X X -
8 Clear remote statistics (See Clear remote X X -
statistics, p. 107)
9 Peer Cop Status (Peer Cop Health) X - -
10 Reset optional module - X X
11 Read CTE (Config extension) - X X
12 Write CTE (Config extension) - X X
Legend:
X Yes
- No
92 33002527
MBP_MSTR
ENABLE When ON, the operation specified in the first element of the CONTROL register is
enabled.
ABORT When ON, the currently active operation is aborted.
ACTIVE ON, if the operation is active.
ERROR ON, if the operation was aborted without success.
SUCCESS ON, if the operation concluded successfully.
DATABUF For operations providing data, e.g. the write operation, the data field is the data
source. For operations receiving data, e.g. the read operation, the data field is the
data destination.
With Ethernet CTE Read and Write operations, the data field holds the contents of
the Ethernet configuration extension table. DATABUF must be defined as an ARRAY
having at least 10 elements in this case.
The data field must be declared as a located variable.
CONTROL This field contains the control block. The first element CONTROL[1] contains a
number from 1 to 12, which provides the operation code of the Modbus operation to
be performed. The content of the sequence register is determined by the operation.
The data field must be declared as a located variable.
The structure of the control block differs according to the network used:
l Modbus Plus
l TCP/IP Ethernet
l SY/MAX Ethernet
33002527 93
MBP_MSTR
Control block for Control block for Modbus Plus:

Modbus Plus
Register Contents
CONTROL[1] indicates one of the Operations which are valid for Modbus Plus
CONTROL[2] indicates the Error status.
CONTROL[3] indicates the length (number of data transferred)
CONTROL[4] indicates MSTR operation-dependent information
CONTROL[5] Routing Register 1
Used for specification (routing path addresses one of five) of a destination
node during network transfer.
Most significant byte: Source node address
This is the slot for the Modbus Plus Network Options Module (NOM).
When using the Modbus Plus Port on the CPU, this byte must be set to "0"
(independently of the CPU slot).
Least significant byte: Destination node address
This value represents a direct or a bridge address. If there is no bridge, this
value contains the destination node address. If there is a bridge, this value
contains the address of the bridge.
If the NOM is inserted in slot 7 on the module rack, the most significant byte
of routing register 1 looks as follows (value 0x0706):
most significant least significant
byte byte
0 0 0 0 0 1 1 1 0 0 0 0 0 1 1 0
Most significant byte Slots 1 ... 16

Least significant byte Destination address (binary value between 1 and
64 (normal) or 65 to 255 (extended))
This value contains the destination node address (further Bridge or
Modbus Plus Modules). If addressing in the previous Routing Register has
finished, the value is set to "0".
see Routing Register 2
94 33002527
MBP_MSTR
Control block for Control block for TCP/IP Ethernet:

TCP/IP Ethernet
Register Contents
CONTROL[1] indicates one of the Operations which are valid for TCP/IP.
CONTROL[2] indicates the Error status (See STATUS, p. 55).
CONTROL[3] indicates the length (number of data transferred)
CONTROL[5] Routing Register
Used for specification of a destination node during network transfer.
This is the NOE slot for the NOE module.
When using an integrated Ethernet on the CPU, this byte must be set to
"254" (0xFE) (independently of the CPU slot).
The value in the least significant byte represents a direct or bridge address.
If there is no bridge the value in the least significant byte is set to "0". If
there is a bridge, this value contains the MBP for the Ethernet mapping
index (MET).
If the NOM is inserted in slot 7 on the module rack and the Ethernet
mapping index (MET) is 6, the routing register looks as follows (value
0x0706)::
byte byte
0 0 0 0 0 1 1 1 0 0 0 0 0 1 1 0

Least significant byte MBP on Ethernet Transporter (MET) mapping
index
CONTROL[6] Byte 4 (MSB) of the 32bit destination IP address
CONTROL[7] Byte 3 of the 32bit destination IP address
CONTROL[8] Byte 2 of the 32bit destination IP address
CONTROL[9] Byte 1 (LSB) of the 32bit destination IP address
33002527 95
MBP_MSTR
Control block for Control block for SY/MAX Ethernet:

SY/MAX Ethernet
Register Contents
CONTROL[1] indicates one of the Operations which are valid for SY/MAX.
CONTROL[3] indicates the length (number of registers transferred)
Used for specification of a destination node during network transfer.
slot for the NOE module.
The value in the least significant byte represents a direct or bridge address.
If there is no bridge the value in the least significant byte is set to "0". If
there is a bridge, this value contains the MBP for the Ethernet mapping
index (MET).
If NOM is inserted in slot 7 on the module rack and the Ethernet mapping
index (MET) is 6, the routing register looks as follows (value 0x0706)::
byte byte
0 0 0 0 0 1 1 1 0 0 0 0 0 1 1 0

Least significant byte MBP on Ethernet Transporter (MET) mapping
index
CONTROL[6] Destination drop number (or set to FF hex)
CONTROL[7] Terminator (set to FF hex)
96 33002527
MBP_MSTR
Write data
Description The write operation transfers data to an addressed node. The transaction utilizes a
master transaction path and may require several cycles.
An attempt to program the MBP_MSTR in such a way that it writes to its own drop
address will generate an error in the CONTROL[2] register of the block. However, it
is possible to perform a write operation to a non-existing slave register. The slave
detects the status and logs it. This can last for several cycles.
Network The write operation can be performed on Modbus Plus, TCP/IP Ethernet and
implementation SY/MAX Ethernet networks.
Usage of control Control block for Modbus Plus (CONTROL):

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 1 = Write data
CONTROL[3] Number of addresses sent to slave
CONTROL[4] Determines the %MW starting register in the slave to which the data will be
written (e.g. 1 = %MW1, 49 = %MW49)
CONTROL[5] Routing register 1 is used to specify the address (routing path address one
... of five) of the node during a network transfer.
CONTROL[9] The last byte in the routing path that is not zero, is the destination mode.
33002527 97
MBP_MSTR
Use of control Control block for TCP/IP Ethernet (CONTROL):

blocks for TCP/IP
Register Meaning
Ethernet
CONTROL[4] Determines the CONTROL[ ]start address in the slave to which the data will
be written.
Most significant byte: Network adapter module slot
Least significant byte: MBP on Ethernet Transporter (MET) mapping index
CONTROL[6] Each address contains one byte of the 32bit IP address
...
CONTROL[7]
Use of control Control block for SY/MAX Ethernet (CONTROL):

blocks for
Register Meaning
SY/MAX Ethernet
written (e.g. 1 = %MW1, 49 = %MW49)
Most significant byte: ´Network adapter module slot
Least significant byte: Destination drop number
CONTROL[6] Terminator: FF hex
...
CONTROL[9]
98 33002527
MBP_MSTR
Read data
Description The read operation transfers data from a specified node on the network. The
transaction utilizes a master transaction path and may require several cycles.
An attempt to program the MBP_MSTR in such a way that it reads from its own station
address will generate an error in the CONTROL[2] register of the block. But it is
possible to perform a read operation on a non-existing register of the slave. The
slave detects the status and logs it. This can last for several cycles.
Network The read operation can be performed on Modbus Plus, TCP/IP Ethernet and
implementation SY/MAX Ethernet networks.

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 2 = Read data
CONTROL[3] Number of registers to be read from the slave
CONTROL[4] Determines the %MW starting register in the slave from which the data will
be read (e.g. 1 = %MW1, 49 = %MW49).
... of five) of the node during a network transfer.
CONTROL[6] The last byte in the routing path that is not zero, is the destination node.
33002527 99
MBP_MSTR

blocks for TCP/IP
Register Meaning
Ethernet
CONTROL[3] Number of addresses to be read from the slave
CONTROL[4] Determines the %MW starting register in the slave from which the data will
be read (e.g. 1 = %MW1, 49 = %MW49)
Least significant byte: MBP on Ethernet Transporter (MET) mapping index
...
CONTROL[9]

blocks for
Register Meaning
SY/MAX Ethernet
CONTROL[3] Number of addresses to be read from the slave
written (e.g. 1 = %MW1, 49 = %MW49).
Least significant byte: Destination drop number
...
CONTROL[9]
100 33002527
MBP_MSTR
Read local statistics
Description This operation reads the data from the local node. The operation is carried out in one
cycle and does not require a master transaction path.
Network The write operation can be performed on Modbus Plus, TCP/IP Ethernet and
implementation SY/MAX Ethernet networks:
l List of available Modbus Plus network statistics (See Modbus Plus network
statistics, p. 116)
l List of TCP/IP Ethernet network statistics (See TCP/IP Ethernet Network
Statistics, p. 121)

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 3 = Read local statistics
CONTROL[3] Number of addresses to be read from the local statistics (0...53)
CONTROL[4] First address from which the statistics table must be read (Reg1=0)
of five) of the node during a network transfer.
The last byte in the routing path that is not zero, is the destination mode.
Use of control Control block for TCP/IP Ethernet (CONTROL)

blocks for TCP/IP
Register Meaning
Ethernet
(CONTROL) CONTROL[1] 3 = Read local statistics
CONTROL[3] Number of addresses to be read from the local statistics (0...37)
CONTROL[4] First address from which the statistics table must be read (Reg1=0)
CONTROL[6] No significance
...
CONTROL[9]
33002527 101
MBP_MSTR
Clear local statistics
Description This operation deletes the statistics concerning the local node. The operation is
carried out in one cycle and does not require a master transaction path.
Note: If you edit the "Clear local statistics" operation, only words 13 to 22 in the
statistics table are cleared.
Network The operation can be performed on Modbus Plus and TCP/IP Ethernet networks.
implementation l List of available Modbus Plus network statistics (See Modbus Plus network
statistics, p. 116)
l List of TCP/IP Ethernet network statistics (See TCP/IP Ethernet Network
Statistics, p. 121)

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 4 = Clear local statistics
CONTROL[3] Reserved
CONTROL[4] Reserved
of five) of the node during a network transfer.
The last byte in the routing path that is not zero, is the destination mode.

blocks for TCP/IP
Register Meaning
Ethernet
(CONTROL) CONTROL[1] 4 = Clear local statistics
CONTROL[3] Reserved
CONTROL[4] Reserved
CONTROL[6] Reserved
...
CONTROL[9]
102 33002527
MBP_MSTR
Write Global Data (Peer Cop)
Description This operation transfers data to the communication processor of the current node,
so that it can be sent via the network as soon as the node receives the token. This
data can be received by all nodes connected to the local network. The operation is
carried out in one cycle and does not require a master transaction path.
Network The operation can only be performed on Modbus Plus networks.

implementation

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 5 = Write global data
CONTROL[3] Number of addresses to be sent from State RAM into global data memory
(comm processor) (1...32)
CONTROL[4] Reserved
CONTROL[5] If global data is sent via a NOM, you must enter the NOM module slot in
the most significant byte of the register.
33002527 103
MBP_MSTR
Read Global Data (Peer Cop)
Description This operation reads data from the communications processor of any node
connected to the network that sends out global data. The operation can take several
cycles if the global data is not currently available with the nodes called. If global data
is available, the operation is executed in one cycle. A master transaction path is not
required.

implementation

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 6 = Read global data
CONTROL[3] Number of addresses to be sent from global data memory (comm
processor) (1...32)
CONTROL[4] Display of addresses available in scanned node (Is automatically updated)
CONTROL[5] The lowest significant byte idicates the address of the node (value from 1
to 64) whose global data is to be read.
If global data is received via a NOM, you must enter the NOM module slot
in the most significant byte of the address.
104 33002527
MBP_MSTR
Get remote statistics
Description This operation reads the data referring to remote nodes on the network (see Modbus
Plus network statistics, p. 116 and TCP/IP Ethernet Network Statistics, p. 121). This
operation can last for several cycles and does not require a master data transaction
path.
With each query, the remote communications processor supplies a complete
statistics table even if the query does not refer to the entire table. MBP_MSTR will
then copy only those words into the identified $MW addresses that you queried.
Network The operation can be performed on Modbus Plus and TCP/IP Ethernet networks.
implementation

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 7 = Get remote statistics
CONTROL[3] Number of addresses to be read from the statistics data field (0...53) The
size of the data field may not be exceeded.
CONTROL[4] First address from which the node statistics must be read. The number of
available statistics registers may not be exceeded.
CONTROL[5] Routing address 1 5 of the node.
... The last byte in the routing path that is not zero is the destination node.
CONTROL[9]
33002527 105
MBP_MSTR

blocks for TCP/IP
Register Meaning
Ethernet
(CONTROL) CONTROL[1] 7 = Get remote statistics
CONTROL[3] Number of addresses to be read from the statistics data field (0...37) The
size of the data field may not be exceeded.
CONTROL[4] First address from which the node statistics must be read. The number of
available statistics registers may not be exceeded.
...
CONTROL[9]
106 33002527
MBP_MSTR
Clear remote statistics
Description This operation clears the statistics concerning remote nodes on the network from the
data field of the local node. This operation can last for several cycles and employs
one single master data transaction path.
Note: If the "Clear remote statistics" operation is edited, only the words 13 through
22 of the statistics table (see Modbus Plus network statistics, p. 116 and TCP/IP
Ethernet Network Statistics, p. 121) will be deleted.
Network The write operation can be performed on Modbus Plus and TCP/IP Ethernet
implementation networks.

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 8 = Clear remote statistics
CONTROL[3] Reserved
CONTROL[4] Reserved
... of five) of the destination node during a network transfer.
CONTROL[9] The last byte in the routing path that is not zero, is the destination mode.

blocks for TCP/IP
Register Meaning
Ethernet
(CONTROL) CONTROL[1] 8 = Clear remote statistics
CONTROL[3] Reserved
CONTROL[4] Reserved
...
CONTROL[9]
33002527 107
MBP_MSTR
Peer cop health
Description This operation reads the selected data from the peer cop communications health
table and downloads the respective data into the specified %MW addresses
registers of State RAM. The Peer cop communications health table is 12 words long,
MBP_MSTR indexes all words with 0 through 11.

implementation

blocks for
Register Meaning
Modbus Plus
(CONTROL) CONTROL[1] 9 = Peer cop health
CONTROL[3] Number of words wanted by the peer cop table (1...12)
CONTROL[4] First word to be read from the peer cop table (0...11; 0=first word in peer
cop table and 11=last word in peer cop table)
CONTROL[5] Routing address 1
If this is the second of two local nodes, set the High value byte to 1.
108 33002527
MBP_MSTR
Optional module reset
Description The "Reset optional module" operation leads a Quantum NOE option module to start
a reset cycle to reset its working environment.
Network The write operation can be performed on TCP/IP Ethernet and SY/MAX Ethernet

blocks for TCP/IP
Register Meaning
Ethernet
(CONTROL) CONTROL[1] 10 = Optional module reset
The number shown in the High value byte in area 1 through 16 indicates
the slot where the option module is located.
...
CONTROL[9]

blocks for
Register Meaning
SY/MAX Ethernet
(CONTROL) CONTROL[1] 10 = Optional module reset
...
CONTROL[9]
33002527 109
MBP_MSTR
Read CTE (Config extension table)
Description The "Read CTE" operation reads a given number of bytes from the Ethernet
configuration extension table in the specified buffer in the PLC memory. The bytes
to be read start with a byte offset at the start of the CTE. The contents of the Ethernet
CTE table is displayed on output DATABUF.

blocks for TCP/IP
Register Meaning
Ethernet
(CONTROL) CONTROL[1] 11 = Read CTE (Config extension table)
Least significant byte = mapping index
Either a value displayed in the byte of the register or is not used.
or
Most significant byte = network adapter module slot
CONTROL[6] The number shown in the least significant byte in the area 1 through 16
... indicates the slot where the optional module is located.
CONTROL[9]
110 33002527
MBP_MSTR

blocks for
Register Meaning
SY/MAX Ethernet
(CONTROL) CONTROL[1] 11 = Read CTE (Config extension table)
CONTROL[3] Number of words transferred
CONTROL[4] Byte offset in the PLC register structure, specifying from where the CTE
bytes are read.
Most significant byte: Slot of the NOE module
...
CONTROL[9]
CTE indicator The values in the Ethernet configuration extension table (CTE) are displayed in a
implementation field on output DATABUF when a CTE read operation is implemented. The registers
(DATABUF) display the following CTE data:
CTE indicator implementation (DATABUF):
Parameter Register Contents
Frame type DATABUF[0] 1 = 802.3
2 = Ethernet
IP address DATABUF[1] First byte of the IP address
DATABUF[2] Second byte of the IP address
DATABUF[3] Third byte of the IP address
DATABUF[4] Fourth byte of the IP address
Lower netmask DATABUF[5] Most significant word
DATABUF[6] Least significant word
Gateway DATABUF[7] First byte of the gateway
DATABUF[8] Second byte of the gateway
DATABUF[9] Third byte of the gateway
DATABUF[10] Fourth byte of the gateway
33002527 111
MBP_MSTR
Write CTE (Config extension table)
Description The "Write CTE" operation writes the CTE configuration table from the specified
data (DATABUF) to a specified Ethernet configuration extension table or to a specific
slot.

blocks for TCP/IP
Register Meaning
Ethernet
(CONTROL) CONTROL[1] 12 = Write CTE (Config extension table)
Least significant byte = mapping index
Either a value displayed in the byte of the address or is not used.
or
Most significant byte = network adapter module slot
CONTROL[6] The number shown in the least significant byte in the area 1 through 16
... indicates the slot where the optional module is located.
CONTROL[9]
112 33002527
MBP_MSTR

blocks for
Register Meaning
SY/MAX Ethernet
(CONTROL) CONTROL[1] 12 = Write CTE (Config extension table)
CONTROL[3] Number of words transferred
CONTROL[4] Byte offset in the PLC address structure specifying where the CTE bytes
are written.
Most significant byte = NOE module slot
Least significant byte = Destination drop number
...
CONTROL[9]
CTE indicator The values in the Ethernet configuration extension table (CTE) are displayed in a
implementation field on output DATABUF when a CTE write operation is implemented. The registers
(DATABUF) are used to transfer the following CTE data:
CTE indicator implementation (DATABUF):
Parameter Register Contents
Frame type DATABUF[0] 1 = 802.3
2 = Ethernet
IP address DATABUF[1] First byte of the IP address
DATABUF[2] Second byte of the IP address
DATABUF[3] Third byte of the IP address
DATABUF[4] Fourth byte of the IP address
Lower netmask DATABUF[5] Most significant word
DATABUF[6] Least significant word
Gateway DATABUF[7] First byte of the gateway
DATABUF[8] Second byte of the gateway
DATABUF[9] Third byte of the gateway
DATABUF[10] Fourth byte of the gateway
33002527 113
MBP_MSTR
Peer Cop Communications Health Status
Peer Cop The table containing the Peer Cop status information fills 12 consecutive registers,
Communications which can be indexed with the numbers 0 to 11 in an MBP_MSTR operation. Each
Health Status individual bit of the table words is used to present one aspect of communications
health that refers to a specific node on the Modbus Plus network.
Relation bit The bits of the words 0 to 3 represent the health at the global communications input
network node of nodes 1 to 64. The bits of words 4 ... 7 represent the health of the output of a
specific node.
The bits in words 8 to 11 represent the health of the input of a specific node.
Status type Word index Relation bit network node
Global receive 0
16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
1
32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17
2
48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33
3
64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49
Send direct 4
16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
5
32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17
6
48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33
7
64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49
Receive direct 8
16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
9
32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17
10
48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33
11
64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49
114 33002527
MBP_MSTR
Health bit status The status of the Peer Cop Health bit indicates the current communications status
of its assigned node. A health bit will be set when the associated node accepts input
for its Peer Cop data block or when it receives a signal that another node has
accepted specific output data from its Peer Cop output data block. A health bit will
be deleted if the associated data block did not accept any communication within the
configured Peer Cop health timeout period.
All health bits will be deleted when interface command "Put Peer Cop" is executed
during PLC startup. The table values become valid when the Token has been
completely bypassed, after the interface command "Put Peer Cop" has been carried
out. The health bit of a specific node is always zero when the assigned Peer Cop
entry is zero.
33002527 115
MBP_MSTR
Modbus Plus network statistics
Modbus Plus The following table shows the statistics available on Modbus Plus. You can obtain
network this data by running the corresponding MBP_MSTR operation (Modbus function code
statistics 8).
Note: If you edit the "Clear local statistics" or "Clear remote statistics" operation,
only words 13 to 22 in the statistics table are cleared.
Modbus Plus network statistics:

Word Bits Description
00 Node type ID
0 Unknown node type
1 PLC node
2 Modbus bridge node
3 Host computer node
4 Bridge Plus node
5 Peer I/O node
6 ... 15 Reserved
01 0 ... 11 Software version number as hexadecimal value (to read this, isolate
bits 12-15 from the word)
12 ... 14 Reserved
15 Defines error counters from word 15.
The most significant bit defines the use of error counters in word 15.
The lower valued half of the most significant byte together with the
least significant byte contain the software
version.
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Software Version Number

(in hexadecimal values)
Error Counter of Word 15 (see Word 15)
02 Network address of this station
116 33002527
MBP_MSTR

03 MAC status variable:
0 Startup status
1 Offline status indicator signals
2 Duplicated offline status
3 Idle status
4 Token utilization status
5 Work response status
6 Token transfer status
7 Response request status
8 Status check of transfer
9 Token request status
10 Response request status
04 Peer status (LED code); indicates status of this device relative to the
network:
0 Monitor connect operation
32 Normal connect operation
64 Never receives token
96 Single station
128 Duplicate station
05 Token transfer counter; increments each time this station receives the
token
06 Token cycle time in ms
07 LOW Bit representation data master fail during token ownership
HIGH Bit representation (bitmap) program master fail during token ownership
08 LOW Bitmap activity token ownership of the data master
HIGH Bitmap activity token ownership of the program master
09 LOW Bitmap activity token ownership of the data slave
HIGH Bitmap activity token ownership of the program slave
10 LOW
HIGH Bitmap transfer request command data slave/slave poll
11 LOW Bitmap response transfer request program master/master poll
HIGH Bitmap transfer request command program slave/slave poll
12 LOW Bitmap connect status of the program master
HIGH Bitmap automatic log-off of program slave
33002527 117
MBP_MSTR

13 LOW Pretransfer delay error counter
HIGH Receive buffer DMA overrun error counter
14 LOW Receive counter repeat command
HIGH Error counter data block size
15 If bit 15 of word 1 is not set, word 15 has the following significance:
LOW Error counter receiver collision abort
HIGH Error counter receiver alignment
If bit 15 of word 1 is set, word 15 has the following significance:
LOW Data block error on cable B
HIGH Data block error on cable B
16 LOW Error counter CRC receiver
HIGH Error counter wrong packet length
17 LOW Error counter wrong link address
HIGH Error counter DMA underflow transfer buffer storage
18 LOW Error counter wrong internal packet length
HIGH Error counter wrong MAC function code
19 LOW Communication retry counter
HIGH Error counter communication failed
20 LOW Counter package receipt successful
HIGH Error counter no response receipt
21 LOW Error counter unexpected response receipt
HIGH Error counter unexpected path
22 LOW Error counter unexpected response
HIGH Error counter skipped transaction
23 LOW Bitmap active station table, nodes 1 through 8
HIGH Bitmap active station table, nodes 9 through 16
27 LOW Bitmap token station table, nodes 1 through 8
HIGH Bitmap token station table, nodes 9 through 16
118 33002527
MBP_MSTR

31 LOW Bitmap table regarding existence of global data, nodes 1 through 8
HIGH Bitmap table regarding existence of global data, nodes 9 through 16
35 LOW Bitmap receive buffer used, buffers 1 through 8
HIGH Bitmap receive buffer used, buffers 9 through 16
HIGH Bitmap receive buffer used, buffers 25 through 32
HIGH Counter of activated processed commands for station administration
38 LOW Counter activation command output path 1 of the data master
HIGH Counter activation command output path 2 of the data master
42 LOW Counter command processing input path 41 of the data slave
HIGH Counter command processing input path 42 of the data slave
33002527 119
MBP_MSTR

46 LOW Counter command activation output path 81 of the program master
HIGH Counter command activation output path 82 of the program master
50 LOW Counter command processing input path C1 of the program slave
HIGH Counter command processing input path C2 of the program slave
120 33002527
MBP_MSTR
TCP/IP Ethernet Network Statistics
TCP/IP Ethernet A TCP/IP Ethernet module replies to the "Get local statistics" and "Set local
Network statistics" commands using the following information:
Statistics
Word Meaning
00 to 02 MAC address
e.g. MAC address 00 00 54 00 12 34 is displayed as follows:
Word Contents
00 00 00
01 00 54
02 34 12
03 Module state
l 0x0001 = Running
l 0x4000 = APPI LED (1=ON, 0 = OFF)
l 0x8000 = LED connection
04 and 05 Number of receiver interrupts
06 and 07 Number of transfer interrupts
08 and 09 Transfer timeout error count
10 and 11 Collision detection error count
12 and 13 Omitted packets
14 and 15 Memory error count
16 and 17 Number of restarts performed by the driver
18 and 19 Receive framing error count
20 and 21 Overflow error count receiver
22 and 23 Receive CRC error counter
24 and 25 Receive buffer error counter
26 and 27 Transfer buffer error counter
28 and 29 Transfer bin underflow counter
30 and 31 Late collision counter
32 and 33 Lost carrier counter
34 and 35 Number of retries
36 and 37 IP address
e.g. the IP address 198.202.137.113 (or c6 CA 89 71) is represented as
follows:
Word Contents
36 89 71
37 C6 CA
33002527 121
MBP_MSTR
Modbus Plus and SY/MAX Ethernet Error Codes
Form of the Function error codes for Modbus Plus and SY/MAX Ethernet transactions appear as
function error Mmss, where:
code l M is the high code
l m is the low code
l ss is a subcode
Hexadecimal Hexadecimal error code for Modbus Plus and SY/MAX Ethernet:
error code
Hex. Error Description
Code
1001 Abort by user
2001 An operation type that is not supported has been specified in the control
block
2002 One or more control block parameters were modified while the MSTR
element was active (this only applies to operations which require several
cycles for completion). Control block parameters my only be modified in
inactive MSTR components.
2003 Invalid value in the length field of the control block
2004 Invalid value in the offset field of the control block
2005 Invalid value in the length and offset fields of the control block
2006 Unauthorized data field on slave
2007 Unauthorized network field on slave
2008 Unauthorized network routing path on slave
2009 Routing path equivalent to their own address
200A Attempt to get more global data words than available
200E The control block is not assigned, or parts of the control block are located
outside of the %MW (4x) range.
30ss Exceptional response by Modbus slave (See ss hexadecimal value in 30ss
error code, p. 123)
4001 Inconsistent response by Modbus slave
5001 Inconsistent response by the network
6mss Routing path error (See ss hexadecimal value in 6mss error code, p. 123)
The subfield m shows where the error occurred (a 0 value means local node,
2 means 2nd device in route, etc).
122 33002527
MBP_MSTR
ss hexadecimal ss hexadecimal value in 30ss error code:

value in 30ss
ss hex. Value Description
error code
01 Slave does not support requested operation
02 Non-existing slave registers were requested
03 An unauthorized data value was requested
05 Slave has accepted a lengthy program command
06 Function cannot currently be carried out: lengthy command running
07 Slave has rejected lengthy program command
ss hexadecimal
value in 6mss
Note: Subfield m in error code 6mss is an Index in the routing information that
error code
shows where an error has been detected (a 0 value indicates the local node, 2
means the second device in the route, etc.).
The ss subfield in error code 6mss is as follows:

ss hex. value Description
01 No response reception
02 Access to program denied
03 Node out of service and unable to communicate
04 Unusual response received
05 Router-node data path busy
06 Slave out of order
07 Wrong destination address
08 Unauthorized node type in routing path
10 Slave has rejected the command
20 Slave has lost an activated transaction
40 Unexpected master output path received
80 Unexpected response received
F001 Wrong destination node was specified for the MSTR operation
33002527 123
MBP_MSTR
SY/MAX-specific error codes
SY/MAX-specific When utilizing SY/MAX Ethernet, three additional types of errors may appear in the
error codes CONTROL[1] register of the control block ().
The error codes have the following meaning:
l 71xx Error: Errors found by the SY/MAX remote device
l 72xx Error: Errors found by the server
l 73xx Error: Errors found by the Quantum translator
SY/MAX-specific SY/MAX-specific HEX error code:

HEX error code
Code
7101 Invalid opcode found by the SY/MAX remote device
7103 Invalid address found by the SY/MAX remote device
7109 Attempt to write to a write protected register found by the SY/MAX remote
device
F710 Receiver overflow found by the SY/MAX remote device
7110 Invalid length found by the SY/MAX remote device
7111 Remote device not active, no connection (occurs when retry attempts and
time-out have been used up), found by the SY/MAX remote device
7113 Invalid parameter in a read operation found by the SY/MAX remote device
711D Invalid route found by the SY/MAX remote device
7149 Invalid parameter in a write operation found by the SY/MAX remote device
714B Invalid drop number found by the SY/MAX remote device
7101 Invalid opcode found by the SY/MAX server
7203 Invalid address found by the SY/MAX server
7209 Attempt to write to a write protected register found by the SY/MAX server
F720 Receiver overflow found by the SY/MAX server
7210 Invalid length found by the SY/MAX server
7211 Remote device not active, no connection (occurs when retry attempts and
time-out have been used up), found by the SY/MAX server
7213 Invalid parameter in a read operation found by the SY/MAX server
721D Invalid route found by the SY/MAX server
7249 Invalid parameter in a write operation found by the SY/MAX server
724B Invalid drop number found by the SY/MAX server
7301 Invalid opcode in an MSTR block request from the Quantum translator
124 33002527
MBP_MSTR

Code
7303 Read/Write QSE module status (200 route address out of range)
7309 Attempt to write to a write protected register when a status write is carried
out (200 route)
731D Invalid route found by the Quantum translator.
Valid routes:
l dest_drop, 0xFF
l 200, dest_drop, 0xFF
l 100+drop, dest_drop, 0xFF
l All other routing values produce an error
734B One of the following errors occurred:
l No CTE (configuration extension table) has been configured
l No CTE table entry has been made for the QSE model slot number
l No valid drop has been specified
l The QSE module has not been reset after the creation of the CTE.
Note: After writing and configuring the CTE and downloading to the QSE
module, the QSE module must be reset for the modifications to become
effective.
l When using an MSTR instruction no valid slot or drop has been specified
33002527 125
MBP_MSTR
TCP/IP Ethernet error codes
TCP/IP Ethernet An error in an MSTR routine via TCP/IP Ethernet may produce one of the following
error codes errors in the MSTR control block:
The error code appears as Mmss, where:
l M is the high code
l m is the low code
l ss is a subcode
HEX error codes HEX error codes TCP/IP Ethernet:

TCP/IP Ethernet
Hex. Error Meaning
Code
1001 Abort by user
2001 An operation type that is not supported has been specified in the control
block
2002 One or more control block parameters were modified while the MSTR
element was active (this only applies to operations which require several
cycles for completion). Control block parameters my only be modified in
inactive MSTR components.
2003 Invalid value in the length field of the control block
2004 Invalid value in the offset field of the control block
2005 Invalid value in the length and offset fields of the control block
2006 Unauthorized data field on slave
200E The control block is not assigned, or parts of the control block are located
outside of the %MW (4x) range.
3000 Generic Modbus failure code
30ss Exceptional response by Modbus slave (See ss hexadecimal value in 30ss
error code, p. 127)
4001 Inconsistent response by Modbus slave
126 33002527
MBP_MSTR
ss hexadecimal ss hexadecimal value in 30ss error code:

value in 30ss
ss hex. Value Meaning
error code
01 Slave does not support requested operation
02 Non-existing slave registers were requested
03 An unauthorized data value was requested
05 Slave has accepted a lengthy program command
06 Function cannot currently be carried out: lengthy command running
07 Slave has rejected lengthy program command
HEX error codes An error on the TCP/IP Ethernet network itself may produce one of the following
TCP/IP Ethernet errors in the CONTROL[1] register of the control block.
network HEX error codes TCP/IP Ethernet network:
Hex. Error Meaning
Code
5004 Interrupted system invocation
5005 I/O error
5006 No such address
5009 The socket descriptor is not valid
500C Not enough storage space
500D Authorization denied
5011 Entry exists
5016 An argument is not valid
5017 An internal table has no more space
5020 There is interference on the connection
5023 This operation was blocked and the socket is non-blocking
5024 The socket is non-blocking and the connection cannot be closed down
5025 The socket is non-blocking and a previous connection attempt has not been
concluded
5026 Socket operation on a non-socket
5027 The destination address is not valid
5028 Message too long
5029 Wrong type of protocol for the socket
502A Protocol not available
502B Protocol not supported
502C Socket type not supported
33002527 127
MBP_MSTR
Hex. Error Meaning

Code
502D Operation not supported at socket
502E Protocol family not supported
F502 Address family not supported
5030 Address is already in use
5031 Address not available
5032 Network is out of order
5033 Network cannot be reached
5034 Network shut down the connection during reset
5035 The connection was terminated by the peer
5036 The connection was reset by the peer
5037 An internal buffer is required, but cannot be assigned
5038 The socket is already connected
5039 The socket is not connected
503A Cannot transmit after the socket has been shut off
503B Too many references; cannot splice
503C Connection timed out
503D The connection attempt was denied
5040 Host is out of order
5041 The destination host could not be reached from this node
5042 Directory not empty
5046 NI_INIT returned -1
5047 The MTU is not valid
5048 The hardware length is not valid
5049 The route specified cannot be found
504A Collision when invoking Select; these conditions have already been selected
by another job
504B The job ID is not valid
5050 No Network Resource
5051 Length Error
5052 Addressing Error
5053 Application Error
5054 Client cannot process request
5055 No Network Resource
5056 Non-Operational TCP connection
128 33002527
MBP_MSTR
Hex. Error Meaning

Code
5057 Incoherent configuration
6003 FIN or RST not expected
F001 In reset mode
F002 Component not fully initialized
CTE error codes for SY/MAX and TCP/IP Ethernet
CTE error codes The following error codes are displayed in the CONTROL[1] register of the control
for SY/MAX and block, if there is a problem with the Ethernet configuration extension table (CTE) in
TCP/IP Ethernet your program configuration.
CTE error codes for SY/MAX and TCP/IP Ethernet:
Code
7001 There is no Ethernet configuration extension
7002 The CTE is not available for access
7003 The offset is not valid
7004 Offset + length are not valid
7005 Bad data field in the CTE
33002527 129
MBP_MSTR
130 33002527
ModbusP_ADDR: Modbus Plus
Address
12
Overview
Introduction This chapter describes the ModbusP_ADDR block.

Chapter?
Topic Page
Description 132
Detailed Description 135
33002527 131
MODBUSP_ADDR
Description
Function This function block allows the entry of the Modbus Plus address for function blocks
description READ_REG, CREAD_REG, WRITE_REG and CWRITE_REG. The address is
transferred as a data structure.
Note: You must be familiar with your network when programming the
ModbusP_ADDR function block. Modbus Plus routing path structures are described
in detail in "Modbus Plus Network Planning and Installation Guide".
in FBD
ModbusP_ADDR_Instance
ModbusP_ADDR
NOMModuleSlot SLOT_ID
ADDRFLD DataStructureModbusPlusAddress
BYTE_variable1 ROUTING1
132 33002527
MODBUSP_ADDR
in LD
ModbusP_ADDR_Instance
ModbusP_ADDR
EN ENO
NOMModuleSlot SLOT_ID
ADDRFLD DataStructureModbusPlusAddress
in IL CAL ModbusP_ADDR_Instance (SLOT_ID:=NOMModuleSlot,
ROUTING1:=BYTE_variable1, ROUTING2:=BYTE_variable2,
ROUTING5:=BYTE_variable5,
ADDRFLD=>DataStructureModbusPlusAddress)
in ST ModbusP_ADDR_Instance (SLOT_ID:=NOMModuleSlot,
ROUTING5:=BYTE_variable5,
ADDRFLD=>DataStructureModbusPlusAddress) ;
33002527 133
MODBUSP_ADDR

description
Slot_ID BYTE Slot ID
NOM module slot
ROUTING1 BYTE Routing 1 is used for address specification
ROUTING2 BYTE Routing 2

ADDRFLD WordArr5 Data structure used to transfer the Modbus Plus
address
134 33002527
MODBUSP_ADDR
Detailed Description
Derived Data Element description for WordArr5:

Types
WordArr5[1] WORD Routing tab 1
Least significant byte:
used for address specification (routing path
addresses one of five) of a destination node during
network transfer.
Slot of the network adapter module (NOM), if
available.
Slot_ID If a Modbus Plus network option module (NOM) in the rack of a Quantum controller
is addressed as the destination node, the value at the Slot_ID input represents the
physical NOM slot, i.e. if the NOM is plugged in at Slot 7 of the rack, the value
appears as follows:
0 0 0 0 0 1 1 1
Routing x The Routing x input is used for address specification (routing path addresses one
of five) of the destination node during network transfer. The last byte in the routing
path that is not zero is the destination node.
0 x x x x x x x
Destination address (binary value between 1 and 64 (normal) or 65 to 249 (extended))
33002527 135
MODBUSP_ADDR
Routing tab 1 If a Modbus Plus Network Options Module (NOM) is addressed as the destination
node in a Quantum control module rack, the most significant byte represents the
physical slot of the NOM. If the destination node is a CPU, the most significant byte
(regardless of the CPU slot) is set to "0".
If NOM is inserted in slot 7 on the module rack, the most significant byte of routing
tab 1 looks as follows:
Most significant byte Least significant byte
0 0 0 0 0 1 1 1 0 x x x x x x x

Least significant byte Destination address (binary value between 1 and 64 (normal) or 65 to
255 (extended))
136 33002527
OUT_IN_CHAR: Sending/
receiving character strings
13
At a Glance
Subject of this This chapter describes the OUT_IN_CHAR communication function.

Chapter

Chapter?
Topic Page
Description 138
Example of How to Send/Receive a Character String 143
33002527 137
OUT_IN_CHAR
Description
Function The OUT_IN_CHAR function is used to send a string of a maximum of 210 bytes (120
Description for the terminal port), followed by a message receive request (send only or receive
only is also possible).
The character string may be contained in a static variable or stipulated in the form
of an immediate value (series of bytes between apostrophes, e.g.: 'Message to be
sent').
These character strings may contain special characters, and must start with the
character $ followed by the hexadecimal value of the character to be sent, for
example $0D.
Certain special characters may be used, such as:
$R = CR (carriage return), $L = LF (line feed), $N = CR+LF.
FBD Representation:
Representation
OUT_IN_CHAR
Mode TYPE
Data_to_Send EMIS
138 33002527
OUT_IN_CHAR
LD Representation:
Representation
OUT_IN_CHAR
EN ENO
Mode TYPE
Data_to_Send EMIS
IL Representation:
Representation LD Address
OUT_IN_CHAR Mode, Data_to_Send, Management_Param,
Received_Data
ST Representation:
Representation OUT_IN_CHAR(Address, Mode, Data_to_Send, Management_Param,
Received_Data);
33002527 139
OUT_IN_CHAR

Description
Address ARRAY [0...5] OF Address of the destination entity of the
INT exchange. Only those addresses ending in SYS
are possible (e.g.: {Network.Station}SYS).
Mode INT Operating mode:
l 1: transmission followed by receive mode,
l 2: send a message,
l 3: message in receive mode.
Data_to_Send STRING Character string to send. It is essential for this
character string to exist when the function is
called, even if there is no data to send (for
example in receive only mode).

Management_Param ARRAY [0...3] OF Exchange management table (See Structure of

Received_Data STRING Character string received. It is essential for this
character string to exist when the function is
called, even if there is no data to receive (for
example in send only mode).
Note: at the time of transmission or of a transmission followed by reception, the

user is advised to initialize the fourth word of the management table (length) before
executing the function. Also, the length of the character string received is stored in
this same word at the end of this exchange. However, prior to this, during
configuration, it is necessary to define a stop condition.
To send character strings containing end of string characters (ZERO). You must:
l use localized STRINGS,
l initialize the last word of the exchange management table with the number of
characters to send. If you initialize this word with the value 0, the string that is
sent will stop at the first ZERO character it encounters. If you initialize it will a
value, the length of the character string sent will be equal to this value.
140 33002527
OUT_IN_CHAR
OUT_IN_CHAR
Parameters
Address: ... ?
Mode: ... Exchange
String to be sent:
Variable: ...
Value:
String to Receive: ...

Report: ...
OK Cancel

l ADDR(STRING).
turns gray.
33002527 141
OUT_IN_CHAR
Mode The selection from the drop-down list:

l Exchange,
l Transmission,
l Reception.
displays directly the immediate value 1, 2 or 3.
Note: simply choose from the solutions offered in the drop-down menu.
Note: if you use the entry field instead of the menu, you can enter a variable of the
INT type, either located or not.
String to be sent The string to be send is a variable of the STRING type. This variable must be
declared before being used.
If the choice of string is a variable (example String_0), the immediate value entry
field disappears.
String to be The reception zone is a variable of theSTRING type. The size of this variable is a
received function of the number of characters to be received. This variable must be declared
before being used in this screen.
142 33002527
OUT_IN_CHAR
Example of How to Send/Receive a Character String
At a Glance Let us assume we want to send a character string Str_1 from station 1 of network
20 to the terminal port of station 5, then receive a character string Str_2 from the
terminal port of station 5 of the same network.
Here, a video terminal is connected to the terminal port of station 5 of network 20.
The string to be sent contains 10 characters.
The function's management table is made up of the table of words %MW170:4.
TSX Premium TSX Micro
{20.5}
Fipway
{20.1}
33002527 143
OUT_IN_CHAR

(* initialization of the data to send *)
%MW173 := 10;
OUT_IN_CHAR(ADDR(’{20.5}0.0.0.SYS’),1,Str_1,%MW170:4,Str_2);
END_IF;
Request parameters:
ADDR(‘{20.5}0.0.0.SYS’) l {20.5}: network 20, station 5
l 0: rack
l 0: module
l 0: channel 0
l SYS: system address
1 Transmission then reception
Str_1 Variable of type STRING containing the message to send
Str_2 Variable of type STRING that will contain the message received
Note: Before the function is launched, initialize the length parameter (in the
example: %MW173 ) with the value corresponding to the number of characters (in
bytes) to send to Str_1).
At the end of the exchange, %MW173 will contain the length of the data received
(in bytes).
144 33002527
PRINT_CHAR: Sending character
strings
14
At a Glance
Subject of this This chapter describes the PRINT_CHAR function.

Chapter

Chapter?
Topic Page
Description 146
Example of How to Send Character Strings 150
33002527 145
PRINT_CHAR
Description
Function The PRINT_CHAR function is used to send a character string of a maximum of

Description 4 Kbytes, 120 bytes at the terminal port, to be transmitted on a character mode link.
The character string may be contained in a static variable or stipulated in the form
of an immediate value (series of bytes between apostrophes, e.g.: 'Message to be
sent').
These character strings may contain special characters, and must start with the
character $ followed by the hexadecimal value of the character to be sent, for
example $0D.
Certain special characters may be used, such as:
$R = CR (carriage return), $L = LF (line feed), $N = CR+LF.
FBD Representation:
Representation
PRINT_CHAR
Address ADR
String_to_Send EMIS
LD Representation:
Representation
PRINT_CHAR
EN ENO
Address ADR
String_to_Send EMIS
146 33002527
PRINT_CHAR
IL Representation:
PRINT_CHAR String_to_Send, Management_Param
ST Representation:
Representation PRINT_CHAR(Address, String_to_Send, Management_Param);

Description
Address ARRAY [0...5] OF Address of the destination entity of the
INT exchange. Only those addresses ending in SYS
are possible (e.g.:{Network.Station}SYS ).
String_to_Send STRING Character string to send. This is either latched
in a character string or provided as an
immediate value.
Note: this character string must exist, even if

there is no data to be sent.

Management_Param ARRAY [0...3] OF Word table used to manage the exchange (See
INT Structure of the management parameters,
p. 32).
33002527 147
PRINT_CHAR
Programming Special characters are preceded by the character $ in the string to be transmitted.
Rules The $ characters are not transmitted by the sender, and must therefore not be
counted during the initialization of the length parameter.
The spaces between two characters are counted in a byte.
Therefore, for the example PRINTING IN PROGRESS$L$R, the length of the data
to be sent is 22 bytes.
It takes several PLC cycles to send a character string of more than 240 bytes (the
string is fragmented).
It is therefore important to make sure that the management data is not modified
during the processing of the function. The system transmits the string consistently
over several fragments, but does not prohibit the transmission of another character
string between two fragments.
Note: To send character strings containing end of string characters (ZERO). You
must:
l use localized STRINGS,
l initialize the last word of the exchange management table with the number of
characters to send. If you initialize this word with the value 0, the string that is
sent will stop at the first ZERO character it encounters. If you initialize it will a
value, the length of the character string sent will be equal to this value.
148 33002527
PRINT_CHAR
PRINT_CHAR
Parameters
Address: ...
?
String to be sent:
Variable: ...
Value:
Report: ...
OK Cancel

l ADDR(STRING).
turns gray.
String to be sent The string to be sent is a variable of the STRING type or an immediate value. If a
STRING type variable is selected, the value field disappears.
Report The report is an array of 4 integers, that can be located or not.
33002527 149
PRINT_CHAR
Example of How to Send Character Strings
At a Glance Let us assume we want to send a character string to a video terminal connected to
the built-in link of the TSX SCY 21601 module of a PLC with a network address of
20, station 3. The TSX SCY 21601 module is located in slot 2 of the base rack.
The management table is located in %MW110:4 and the string to be sent is located
in the variable Str_1.
{20.1}
Fipway
{20.3}
150 33002527
PRINT_CHAR
Transmission Programming in ST:

PRINT_CHAR(ADDR(’{20.3}0.2.0.SYS’),Str_1,%MW110:4);
END_IF;
Request parameters:
ADDR(‘{20.3}0.2.0. l {20.3}: network 20, station 3
SYS’) l 0: rack
l 2: module
l 0: channel 0
Str_1 Character string to send, variable Str_1 is of type STRING.)
Note: Each time the function is launched, initialize the length parameter (in the
example: %MW113) with the value corresponding to the number of characters (in
bytes) to send to Str_1).
33002527 151
PRINT_CHAR
152 33002527
RCV_TLG: Receiving telegrams
15
At a Glance
Subject of this This chapter describes the RCV_TLG function.

Chapter

Chapter?
Topic Page
Description 154
Example of how to receive a telegram 156
33002527 153
RCV_TLG
Description
Function The RCV_TLG function is used to read telegram-type data from a remote application.
Description The data received must be a maximum of 16 bytes in length. Unlike the other
communication functions, this function is processed immediately (synchronous):
there are therefore no activity bit and timeout parameters.
The integer table assigned to the management parameters therefore only uses two
words instead of four (the exchange and timeout numbers being unnecessary).
Note: this function can be used on Fipway in the processor only, and for stations
0 to 15.
FBD Representation:
representation
RCV_TLG
ADR Address
RECP Received_Data
LD Representation:
representation
RCV_TLG
EN ENO
ADR Address
RECP Received_Data
LD Management_Param
RCV_TLG Address, Received_Data
154 33002527
RCV_TLG
ST Representation:
representation RCV_TLG(Management_Param, Address, Received_Data);
Parameter The following table describes the input/output parameters:

Description
Management_Param ARRAY [0.. 1] OF Table of words used to manage the exchange.
INT This table is made up of 2 words: the report
word and the word indicating the amount of data
received (in number of bytes). The report
comprises:
l the operation report (most significant byte of
the first word),
l the communication report (least significant
byte of the first word),
The operation report takes one of the following
values:
l 16#00 : correct exchange,
l 16#05 : incorrect management parameters,
l 16#06 : incorrect specific parameters,
l 16#09 : insufficient receive buffer size,
l 16#0B: no system resources,
l 16#0D: no telegram received,
l 16#10 : network module missing,
l 16#0F: telegram service not configured.

Address INT Address of the entity transmitting the telegram
at the end of the exchange.
l The least significant byte corresponds to the
hexadecimal network number.
l The most significant byte corresponds to the
hexadecimal station number.
Received_Data ARRAY [n... m] Receive buffer. Integer table containing the
OF INT data received.
This table must be a maximum of 8 integers (16
bytes) in length.
33002527 155
RCV_TLG
Example of how to receive a telegram
At a Glance Let us assume we want to receive an 8-word (16 byte) telegram from a remote
application on a Fipway network.
{20.3}
Fipway
{20.1}
IF RE(%I0.3.11) THEN
RCV_TLG(%MW200:2, %MW300,%MW310:8);
END_IF;
Request parameters:
%MW300 Contains the address of the sender at the end of the exchange.
%MW310:8 Contents of the telegram received
Note: When a RCV_TLG function is programmed in an event task, it cannot be used

in the MAST or FAST task.
To execute this function synchronously, it is necessary to test the operation report
immediately after the program line that activates the execution of this function.
156 33002527
READ_ASYN: Reading data
asynchronously
16
Description
Function The READ_ASYN function is used to read 1 Kbyte of data via the asynchronous
Description messaging channel of TSX ETY modules in TCP/IP mode.
The following data can be read-accessed:
l internal bits,
l internal words.
Asynchronous reading can only take place between two stations on the same
Ethernet TCP/IP network segment.
The READ_ASYN function is sent at the end of the MAST task only if this is configured
in periodic mode. It is possible to activate 8 functions simultaneously.
The operating principle is identical to that of the WRITE_ASYN (See Exchange
principle, p. 224) function.
The size of the send and receive buffers is expressed in words. It is 512 words, or
1024 bytes.
Note: The asynchronous server function supports UNI-TE V1 or V2.0 protocols.

The READ_ASYN function uses the UNI-TE V2.0 protocol.
33002527 157
READ_ASYN
FBD Representation:
representation
READ_ASYN
Address ADR RECP Receiving_Array
Object_Type OBJ
First_Object NUM
Object_Number NB
LD Representation:
representation
READ_ASYN
EN ENO
Object_Type OBJ
First_Object NUM
Object_Number NB
LD Address
READ_ASYN Object_Type, First_Object, Object_Number,
Management_Param, Receiving_Array
ST Representation:
representation READ_ASYN(Address, Object_Type, First_Object, Object_Number,
Management_Param, Receiving_Array);
158 33002527
READ_ASYN

Description
Address ARRAY [0.. 5] OF Address of the destination entity of the
INT exchange. Addresses are of the type:
ADDR(’{Network.Station}SYS.
Object_Type STRING Type of objects to read:
l ’%M’: internal bits,
l ’%MW’: internal words,
l ’%S’: system bits,
l ’%SW’: system words.
First_Object DINT Index of the first object to read.
Object_Number INT Number of objects to read.

INT the management parameters, p. 32)

Receiving_Array ARRAY [n... m] Word table containing the value of the objects
OF INT read.
33002527 159
READ_ASYN
160 33002527
READ_GDATA: Reading Modbus
Plus Global Data
17
Description
Function The READ_GDATA function is used to read shared data, or Global Data, on a
Description Modbus Plus network.
Global Data is shared between a maximum of 64 stations on the same Modbus Plus
network. Each station may write up to 32 integers, which can then be used by all
stations on the network. Conversely, each station can read the 32 integers
(maximum) of all the other network stations.
FBD Representation:
representation
READ_GDATA
LD Representation:
representation
READ_GDATA
EN ENO
33002527 161
READ_GDATA
LD Address
READ_GDATA Management_Param, Receiving_Array
ST Representation:
representation READ_GDATA(Address, Management_Param, Receiving_Array);

Description
INT exchange. This address is initialized, before the
exchange, with the value of the node on which
the station is connected whose Global Data is
required.
Example address: ADDR(’0.0.1.10’)

corresponds to the station connected to node
10 of the network. The first three figures (0.0.1)
correspond to the address of the channel of the
Premium Modbus Plus PCMCIA card.

It is not necessary to initialize the length
parameter before launching the exchange.
At the end of this exchange, this length
parameter (the fourth word) contains the
number of bytes that makes up the data
produced by the station specified in the
address.

OF INT read.
162 33002527
READ_REG: Read register
18
Overview
Introduction This chapter describes the READ_REG block.

Chapter?
Topic Page
Description 164
Function mode 168
33002527 163
READ_REG:
Description
Function With a rising edge at the REQ input, this function block reads a register area from an
description addressed slave via Modbus Plus, TCP/IP-Ethernet or SY/MAX-Ethernet.
Note: When programming a READ_REG function, you must be familiar with the
Quantum with Unity Pro TCP/IP Configuration User Guide.
in FBD READ_REG_Instance
READ_REG
StartReadOnce REQ NDR SetAfterReadingNewData
OffsetAddress SLAVEREG ERROR SetInCaseOfError
164 33002527
READ_REG:
in LD
READ_REG_Instance
READ_REG
EN ENO
StartReadOnce SetAfterReadingNewData
REQ NDR
SetInCaseOfError
OffsetAddress SLAVEREG ERROR
in IL CAL READ_REG_Instance (REQ:=StartReadOnce,
SLAVEREG:=OffsetAddress, NO_REG:=NumberOfRegisters,
ADDRFLD:=DataStructure, NDR=>SetAfterReadingNewData,
ERROR=>SetInCaseOfError, REG_READ=>RegisterToRead,
STATUS=>ErrorCode)
in ST READ_REG_Instance (REQ:=StartReadOnce,
ADDRFLD:=DataStructure, NDR=>SetAfterReadingNewData,
ERROR=>SetInCaseOfError, REG_READ=>RegisterToRead,
STATUS=>ErrorCode) ;
33002527 165
READ_REG:

description
Parameter Data type Meaning
REQ BOOL With a rising edge at the REQ input, this function
block reads a register area from an addressed slave
via Modbus Plus, TCP/IP-Ethernet or SY/MAX-
Ethernet.
to be read from.
NO_REG INT Number of addresses to be read from slave
ADDRFLD WordArr5 Data structure describing the Modbus Plus-
address, TCP/IP address or SY/MAX-IP address.

NDR BOOL Set to "1" for one cycle after reading new data
ERROR BOOL Set to "1" for one cycle if an error occurs
one cycle.
Error code, see
Codes, p. 122
REG_READ ANY Writing data
(For the file to be read a data structure must be
declared as a located variable.)
166 33002527
READ_REG:
Derived Data Types

description for
WordArr5 in

description for
WordArr5 with
33002527 167
READ_REG:
Element Element description for WordArr5 with SY/MAX Ethernet:

description for
WordArr5 with
Function mode
Function mode Although a large number of READ_REG function blocks can be programmed, only
of READ_REG four read operations may be active at the same time. In such a case it is insignificant
blocks whether they are the result of this function block or others (e.g. MBP_MSTR,
CREAD_REG). All function blocks use one data transaction path and require multiple
Please use:
168 33002527
READ_REG:
REQ A rising edge triggers the read transaction.

The parameter can be entered as a direct address, located variable, unlocated
variable or literal.
SLAVEREG Start of the area in the addressed slave from which the source data is read. The
source area always resides within the %MW register area.

The source area always resides within the 4x register area. SLAVEREG expects the
source reference as offset within the 4x area. The leading "4" must be omitted (e.g.
59 (contents of the variables or value of the literal) = 40059).
NO_REG Number of addresses to be read from the addressed slave (1 ... 100).
NDR Transition to ON state for one program cycle signifies receipt of new data ready to
be processed.
The parameter can be entered as a direct address, located variable or unlocated
variable.
ERROR Transition to ON state for one program cycle signifies the detection of a new error.
The parameter can be entered as a direct address, located variable or unlocated
variable.
REG_READ An ARRAY that is the same size as the requested transmission must be agreed upon
33002527 169
READ_REG:
Error code, see
variable.
170 33002527
READ_VAR: Reading variables
19
At a Glance
Subject of this This chapter describes the READ_VAR communication function.

Chapter

Chapter?
Topic Page
Description 172
Example of use on a Uni-Telway bus 178
Example of how to read bits 180
Example of use in a network 182
Example including execution check 184
33002527 171
READ_VAR
Description
Function The READ_VAR function is used to read the value of one or more language objects:
Description l internal bits,
l internal words.
The objects that are read must always be consecutive. They may be located in a
remote CPU or in a device connected to a communication channel of one of the
following types: Ethernet TCP/IP, Modbus Plus, Fipway, Uni-Telway, terminal port,
Modbus, Fipio.
The READ_VAR function can read up to 1000 consecutive bits in a remote device,
whatever the device and the protocol used may be (Uni-Telway or Modbus/Jbus).
Note: Reading over 1000 bits requires the use of the SEND_REQ function.
FBD Representation:
representation
READ_VAR
Object_Type OBJ
First_Object NUM
Object_Number NB
172 33002527
READ_VAR
LD Representation:
representation
READ_VAR
EN ENO
Object_Type OBJ
First_Object NUM
Object_Number NB
LD Address
READ_VAR Object_Type, First_Object, Object_Number,
Management_Param, Receiving_Array
ST Representation:
representation READ_VAR(Address, Object_Type, First_Object, Object_Number,
Management_Param, Receiving_Array);
33002527 173
READ_VAR

Description
INT exchange. The following addresses are
prohibited:
l {Network.Station}APP,
l {Network.Station}APP.num,
l broadcast addresses (ALL).
Object_Type STRING Type of objects to read:
First_Object DINT Index of the first object to read.
Object_Number INT Number of objects to read.


OF INT read.
174 33002527
READ_VAR
Rules of use Object types must be entered consistently. Entries must be written either all in lower
case or all in upper case, otherwise the function sends back a report equal to 16#06
(incorrect specific parameters).
For Micro, Premium or Atrium PLCs receiving the read variables function, read-only
access to internal bits has the following particularity:
l The forcing value of the bits is returned in the response.
l Reading 1 bit therefore comprises two response bytes:
l The first contains the value of the 8 bits from the one requested.
l The second indicates whether these bits have been forced.
l In order to read one of the last 8 bits of the memory it is necessary to read all the
last 8, otherwise the function sends back a 16#01 operation report.
Note: Space for the forcing indication bytes should be provided for in the receive
table. Otherwise a 16#03 fault code is sent back in the report.
33002527 175
READ_VAR
READ_VAR
Parameters
Address: ... ?
Type of Object to Read:
Address of first object to read: ...

Number of consecutive objects to read: ...
Reception zone: ...
Report: ...
OK Cancel

l ADDR(STRING).
turns gray.
Type of object to Possible choices:

read l ‘%M’ for reading internal bits.
l ‘%MW’ for reading internal bits.
l ‘%S’ for reading internal bits.
l ‘%SW’ for reading internal bits.
176 33002527
READ_VAR
Address of first The possible objects are of the DINT type:

object to read l variables,
l constants,
l immediate value.
Note: if you enter a constant, an entry field appears to enter the constant. If you
enter a variable, this can be located or not.
Number of The possible objects are of the INT type:

consecutive l variables,
objects to read l constants,
l immediate value.
enter a variable, this can be located or not.
Reception zone The reception zone is an integer array. The size of this array depends on the number
of objects to read. This integer array can be located or not.
33002527 177
READ_VAR
Example of use on a Uni-Telway bus
At a Glance The master PLC must read internal words %MW100 to %MW109 of address station 6
on a Uni-Telway bus. The values of the words that are read are sorted on the basis
of the internal word %MW10, and management parameters are stored on the basis of
%MW40.
Illustration Both stations are linked by a Uni-Telway bus.

Master Premium Slave
Ad0 = 6
Uni-Telway
178 33002527
READ_VAR
Programming Programming in LD:
%I0.3.0 %MW40.0 READ_VAR

EN ENO
ADDR
EN ENO
‘0.0.0.6’ IN OUT ADR RECP %MW10:10
‘%MW’ OBJ
100 NUM
10 NB
%MW40:4 GEST GEST %MW40:4
Request parameters:
’0.0.0.6’ l 0 : rack
l 0 : module
l 0 : channel 0
l 6 : destination address
’%MW’ Type of object (internal word)
100 Address of first object
10 Number of consecutive objects
%MW40:4 Report
%MW10:10 Contents of the response
33002527 179
READ_VAR
Example of how to read bits
At a Glance The following examples illustrate the READ_VAR communication function for reading
bits. In this case the receive table consecutively contains the value of the bits as well
as the forcing indication.
Reading 32 In ST, the syntax of the internal bit reading function is as follows:
internal bits READ_VAR (ADDR(‘{20.1}0.5.1.3’),‘%M’, 0, 32, %MW100:4,
%MW50:4);
The receive table must include 8 bytes (4 words), 4 bytes for the value and 4 bytes
for the forcing indication.
Word Byte 3 Byte 2 Byte 1 Byte 0
Value %MW100 0000 0000 1100 1100
%MW101 1111 1111 0000 1111
Forcing %MW102 0000 0000 0101 0101
%MW103 0000 0000 0000 1111
Forcing can be performed for each %MW102 or %MW103 bit set to 1; the forcing value
being that of the corresponding bit read.
Example:
Value of the first 4 bits Forcing of the first 4 bits Description
(byte 0 of word %MW100) (byte 0 of word %MW102)
0 1 The bit is forced to 0
0 0 The bit is not forced
1 1 The bit is forced to 1
1 0 The bit is not forced
180 33002527
READ_VAR
Reading 18 In ST, the syntax of the internal bit reading function is as follows:
internal bits READ_VAR (ADDR(‘{20.1}0.5.1.3’),‘%M’, 0, 18, %MW100:3,
%MW50:4);
The receive table must contain 3 words (or 6 bytes). In fact, to obtain the value of
the 18 bits, 3 bytes plus a further 3 bytes are needed in order to contain the forcing
value of the 18 bits.
Value of the 14th bit Value of the 1st bit
%MW100 0000 0000 1111 1111
%MW101 0000 0000 0000 1111
%MW102 0000 1111 0000 0000
Forcing note Forcing note

1st bit 14th bit
33002527 181
READ_VAR
Example of use in a network
At a Glance Station 2 of network 20 must read a 5-word table %MW0 to %MW4 of the Uni-Telway
slave, network address 20, station 1, communication module TSX SCM 2116 in slot
5, channel 1 in the communication module, server address Ad0 = 3.

Fipway network 20
TSX 87 Premium
{20.2}
{20.1}
Uni-Telway
Ad0 = 3
Ad0 = 1
182 33002527
READ_VAR
Programming Programming in LD:
%I0.3.1 %MW50.0 READ_VAR

EN ENO
ADDR
EN ENO
‘{20.1}0.5.1.3’ IN OUT ADR RECP %MW20:5
‘%MW’ OBJ
0 NUM
5 NB
%MW50:4 GEST GEST %M50:4
Request parameters:
ADDR(‘{20.1}0.5.1.3’) l {20.1} : network 20, station 1
l 0 : rack
l 5 : module
l 1 : channel 1
l 3 : read destination slave address
‘%MW’ Type of object (internal word)
0 address of first object
5 Number of consecutive objects
%MW20:5 Contents of the response
33002527 183
READ_VAR
Example including execution check
At a Glance The following example illustrates the READ_VAR function with a management
parameter check.

the function
IF NOT %M21 AND %I0.1.2 THEN
%MW210:4 := 0;
%MW212 := 50;
READ_VAR(ADDR(’0.3.1.7’),’%MW’,20,1,%MW210:4,%MW1701:1);
SET %M21;
END_IF;
l the input bit %I0.1.2 controls the function,
l the internet bit %M21 is used to test the activity of the function,
l %MW210:4 := 0; initializes the management table to 0,
l MW212 := 50; initializes the timeout value to 5 seconds.

the exchange IF %M21 AND NOT %M210.0 THEN
check INC %MW214;
IF %MW211 = 0 THEN
INC %MW215;
ELSE
SET %Q0.2.2;
INC %MW216;
%MW217 := %MW211;
END_IF;
END_IF;
l %MW214 counts the number of exchanges,

l %MW215 counts the number of correct exchanges,
l %MW216 counts the number of exchanges generating errors,
l %MW217 stores the error message,
l %Q0.2.2 indicates an exchange failure.
184 33002527
SEND_REQ: Sending requests
20
At a Glance
Subject of this This chapter describes the SEND_REQ function.

Chapter

Chapter?
Topic Page
Description 186
List of UNI-TE requests 190
Example of how to send a UNI-TE request 197
Changing IP Parameters with SEND_REQ (Example) 199
Using the SEND_REQ function 200
33002527 185
SEND_REQ
Description
Function The SEND_REQ function is used to code and send all UNI-TE and Modbus/Jbus
Description requests, as well as receive the associated responses.
Coding details for UNI-TE requests are provided in the reference manual:
Communication Reference TSX DR NET.
Details on coding the Modbus/Jbus requests are provided in the TSX DG MDB
manual.
Modbus requests common to all Schneider devices are presented in the
Architecture and communication services manual.
FBD
Representation
SEND_REQ
Request_Code CODE
Data_to_Send EMIS
LD
Representation
SEND_REQ
EN ENO
Request_Code CODE
Data_to_Send EMIS
186 33002527
SEND_REQ
IL LD Address
Representation SEND_REQ Request_Code, Data_to_Send, Management_Param,
Received_Data
ST SEND_REQ(Address, Request_Code, Data_to_Send,

Representation Management_Param, Received_Data);
33002527 187
SEND_REQ

Description
INT exchange. The type of address depends on the
request sent. It is therefore possible, for
example, to broadcast the RUN request (ALL)
whereas it is impossible to send an
identification request to several devices
simultaneously.
Request_Code INT Request to be sent to the destination device,
also called server. Requests may be UNI-TE
requests (See List of UNI-TE requests, p. 190)
or Modbus requests.
OF INT of the request. This table depends on the
request sent.
It must have a minimum length of 1 element,
even if the request used does not require data
to be sent (for example an identification
request).
Note: It is imperative that the length of the data

to be sent (in bytes) be assigned to the fourth
word of the management table before launching
the function, in order for this to be correctly
executed.

188 33002527
SEND_REQ

Received_Data ARRAY [n... m] Integer table containing the data returned by the
OF INT server device which was the destination of the
request. Although certain requests do not
require a response (for example a Run
request), it is nevertheless necessary to reserve
a minimum table of 1 integer each time the
SEND_REQ function is used.
Note: The size of the data received is written

automatically by the system in the fourth word of
the management table (See Management
parameters: length and Timeout, p. 38).
Note: In certain cases (reading of word tables
for example) it is necessary to resequence the
objects received by using the ROR1_ARB
function (shift of a byte in a table).
33002527 189
SEND_REQ
List of UNI-TE requests
At a Glance The UNI-TE protocol is used to:

l identify and diagnose all the devices that have a UNI-TE server,
l provide a set of services giving read/write access to type data,
l download data from device to device,
l protect a server against concurrent connections during a critical period.
These different services can be obtained using the SEND_REQ function, with coding
of the UNI-TE request to be sent.
Note: to find out details and the list of requests recognized by each device, refer to
the TSX DR NET reference manual.
The following tables provide a non-exhaustive list of the requests recognized by

Premium devices.
General Usage These requests are used to identify and diagnose all the types of devices that have
Requests a UNI-TE server.
Request Name Request Report Code Comment
Code
IDENTIFICATION 16#0F 16#3F Provides the following information
l product range,
l specific application type,
l product type,
l catalogue reference.
READ_CPU 16#4F 16#7F Performs system diagnostics on any device.
PROTOCOL_VERSION 16#30 16#60 Used to adapt the version of the protocol between two
communicating entities.
MIRROR 16#FA 16#FB Tests the correct routing of data between two
communicating devices.
190 33002527
SEND_REQ
Dynamic Change IP Parameters

Modification of IP
Request Name Request Code Comment
Parameters
REQUEST CODE 16#37 request code function
CHANGE IP PARAMETERS 16#13 changes IP parameter subfunction
To ensure that the ETY module is ready for operation, allow the PLC to run (in run
mode) for 15 seconds after the last stop mode before issuing the SEND_REQ
function. After the user issues the CHANGE IP PARAMETERS command and the
ETY module accepts the new parameters, the ETY module resets and begins
operations with the new parameters.
Note: FDR clients that use the ETY module for a server must be rebooted after the
ETY's IP address change is completed. Otherwise, these FDR clients can not
update their parameter files on the FDR server (the ETY module).
Note: Constant words contain the original configuration parameters, not those that
were updated after the IP address change.
Note: You can see the new configuration (IP parameters, subnet mask, and
gateway address) in the Unity Pro ETY debug screen. You can also see the newly
assigned IP address in the Ethernet Module Statistics web page, however, you
must be aware that the IP Address, Subnetwork mask, and Gateway data on this
page reflect the old configuration.
33002527 191
SEND_REQ
Parameter Usage for IP Address Change

This table is based on a sample IP address of 139.158.10.7, subnet mask
255.255.248.0, and gateway address of 139.158.8.1.
Parameter Type Value Comment
ADDRESS array [0...5] of INT ADDR (‘rack.slot.channel.SYS’) Example: ADDR (0.x.0.SYS’) x = slot in
which ETY module is installed
REQUEST_CODE INT 16#37
Data_to_Send array [0...8] of INT byte 1: subfunction (13h) high byte
byte 2: subfunction (96h) low byte
byte 3: 0 Value is ignored.
byte 4: 0 Value is ignored.
byte 5: IP address 2 (158) 1-239 (high byte)
byte 6: IP address 1 (139) 0-255 (low byte)
byte 7: IP address 4 (7) 0-255 (high byte)
byte 8: IP address 3 (10) 0-255 (low byte)
byte 9: subnet mask 2 (255) 255
byte 10: subnet mask 1 (255) 0-255
byte 13: gateway 2 (158) 1-239 (Gateway address must be on
the same subnet as the IP address.)
byte 14:gateway 1 (139) 0-255
byte 15:gateway 4 (1) 0-255
byte 16:gateway 3 (8) 0-255
Manage_Param word number high byte low byte
1 activity report 00
2 operation report (see note 1) communication report (see note 1)
3 time out (ms)
4 18 (INT)
Note 1: The following table gives details for IP address codes (successful and error)
Refer to the example for changing IP parameters with SEND_REQ (See Changing
IP Parameters with SEND_REQ (Example), p. 199).
192 33002527
SEND_REQ
Change IP Address Codes

Operation Report Communication Meaning
Report
successful code
FE (hex) 00 (hex) send request (SEND_REQ) successfully
changed IP address
error codes
01 (hex) FF (hex) invalid request code value (e.g., not 16#37)
00 (hex) 03 (hex) send request to ETY IP address instead of
across backplane
00 (hex) 07 (hex) bad address mapping to the ETY
16 (hex) FF (hex) invalid IP address
17 (hex) FF (hex) invalid subnet
18 (hex) FF (hex) invalid gateway address
19 (hex) FF (hex) invalid network address
1A (hex) FF (hex) ETY’s IP address was already set to send
request (SEND_REQ)
FD (hex) 00 (hex) send request (SEND_REQ) did not
successfully changed IP address
Accessing These requests provide a set of services that give read/write access to internal bit
Objects and word-type data, system bit and word-type data, floating point data, constant
data and SFC data.
Request Name Request Code Report Code Comment
READ_OBJECT 16#36 16#66 Used to read one or more consecutive objects
of the same type.
WRITE_OBJECT 16#37 16#FE Used to write one or more consecutive objects
of the same type.
READ_INTERNAL_BIT 16#00 16#30 Used to read the value of an internal bit.
WRITE_INTERNAL_BIT 16#10 16#FE Used to write the value of an internal bit.
READ_INTERNAL_WORD 16#04 16#34 Used to read the value of an internal word.
WRITE_INTERNAL_WORD 16#14 16#FE Used to write the value of an internal word.
33002527 193
SEND_REQ
Management of These requests provide a set of services that can be used to manage a processor's
Operating Modes operating modes.
RUN 16#24 16#FE Used to launch the execution of a processor's tasks.
STOP 16#25 16#FE Used to stop the execution of a processor's tasks.
INIT 16#33 16#63 Used to trigger a hot or cold re-start.
Reservation These requests provide a reservation mechanism that is used to protect a server
Management against concurrent connections during a critical period.
RESERVE 16#1D 16#FE Enables a client to generally or partially reserve a
server's functions.
RELEASE 16#1E 16#FE Enables a client to free up the reserved server.
I_AM_ALIVE 16#2D 16#FE Used to maintain the reservation.
194 33002527
SEND_REQ
SEND_REQ
Parameters
Address: ... ?
Request Code: ...
Data to send: ...
Reception zone: ...
Report: ...
OK Cancel

l ADDR(STRING).
turns gray.
Request Code The possible objects are of the INT type:

l variables,
l constants,
l immediate value.
enter a variable, it can be located or not.
33002527 195
SEND_REQ
Data to Send These data to be sent are stored in the form of an integer array. This array can be
located or not.
Reception Zone The reception zone is an array of integers. This array can be located or not, and its
size depends on the request code used.
196 33002527
SEND_REQ
Example of how to send a UNI-TE request
At a Glance Station 2 of network 20 must send an identification request to the device with
address Ad0=3 on the Uni-Telway bus of station 1 of the same network. The identifi-
cation request has the decimal code 15 (or 16#0F).
The management table is located at %MW10:4.
Illustration The two stations are connected via a Fipway network:

Premium TSX 87
{20.2} Fipway {20.1}
Uni-Telway
Ad0 = 3
Ad0 = 1
33002527 197
SEND_REQ

SEND_REQ(ADDR(’{20.1}0.5.1.3’),15,%MW0:1,
%MW10:4,%MW100:24);
END_IF;
Request parameters:
ADDR(‘{20.1}0.5.1.3’) l {20.1}: network 20, station 1
l 0: rack
l 5: module
l 1: channel 1
l 3: destination address
15 Request 15 (or 16#0F if the coding is hexadecimal)
%MW0:1 Data sent (for example: no data to send)
%MW100:24 Contents of the response (reception of 24 words)
Note: Each time the function is launched, initialize the length parameter (in the
example: %MW13 = 0).
198 33002527
SEND_REQ
Changing IP Parameters with SEND_REQ (Example)
Illustration The graphic shows you how to set IP parameters for the ETY module in slot 2 with
the SEND_REQ block:
Note:
l ADR: reflects the ETY’s position in slot 2.
l CODE: reflects the value of the REQUEST_CODE.
l EMIS: contains the IP parameters in Data_to_Send:
l address (139.158.10.7)
l subnet mask (255.255.248.0)
l gateway (139.158.8.1)
l GEST: reflects Management_Param (management parameters).
You have to assign a time to the third word of Management_Param. The fourth
word should have the INT value 18.
l RECP: This parameter requires a minimum INT value of 1, even when no
response message is returned, as in the case of an IP change request..
33002527 199
SEND_REQ
Using the SEND_REQ function
At a Glance The SEND_REQ function is used to code and send all UNI-TE and Modbus/Jbus
requests, as well as receive the associated responses.
In certain cases (reading of word tables for example) it is necessary to resequence
the objects received by using the ROR1_ARB function (shift of a byte in a table). .
Example Objects to read:

16#0201
16#0403
16#0605
16#0807
16#0A09
Reception table after execution of a SEND_REQ (read object):
%MW100=16#0107
%MW101=16#0302
%MW102=16#0504
%MW103=16#0706
%MW104=16#0908
%MW105=16#000A
Reception table after a ROR1_ARB(%MW100:6):
%MW100=16#0201
%MW101=16#0403
%MW102=16#0605
%MW103=16#0807
%MW104=16#0A09
%MW105=16#0700
200 33002527
SEND_TLG: Sending telegrams
21
At a Glance
Subject of this This chapter describes the SEND_TLG function.

Chapter

Chapter?
Topic Page
Description 202
Example of how to send a telegram 205
33002527 201
SEND_TLG
Description
Function The SEND_TLG function is used to send telegram-type data to a remote application.
Description The data to be sent must be a maximum of 16 bytes in length. Unlike the other
communication functions, this function is processed immediately (synchronous):
there are therefore no activity bit and timeout parameters.
The integer table assigned to the management parameters therefore only uses two
words instead of four (the exchange and timeout numbers being unnecessary).
WARNING
Card position
The SEND_TLG function can be used on Fipway only if the TSX FPP
20 card and only for stations 0 to 15.
Failure to follow this instruction can result in death, serious injury,
or equipment damage.
FBD Representation:
Representation
SEND_TLG
Address ADR
Data_to_Send EMIS
202 33002527
SEND_TLG
LD Representation:
Representation
SEND_TLG
EN ENO
Address ADR
Data_to_Send EMIS
IL Representation:
SEND_TLG Data_to_Send, Management_Param
ST Representation:
Representation SEND_TLG(Address, Data_to_Send, Management_Param);
33002527 203
SEND_TLG
Description of The following table describes the input parameters:

the Parameters
INT exchange. Only the {Network.Station}APP or
{Network.Station}APP.num addresses are
authorized.
OF INT of the request.
This must be a maximum of 8 integers (16
bytes) in length.
Note: it is essential that the number of bytes to

be sent is placed in the second word of the
management table before executing the
exchange.

INT This table is made up of 2 words: the report
word and the length word for the data to be sent.
The report comprises:
l the operation report (most significant byte of
the first word),
byte of the first word),
The operation report takes one of the following
values:
l 16#00: correct exchange,
l 16#03: incorrect address format,
l 16#04: incorrect destination address,
l 16#05: incorrect management parameters
(for example length),
l 16#06: incorrect specific parameters,
l 16#07: module faulty,
l 16#0A: insufficient send buffer size,
l 16#0B: no system resources,
l 16#0F: Telegram Service not configured.
204 33002527
SEND_TLG
Example of how to send a telegram
At a Glance Let us suppose we want to send an 8-word telegram from station 1 to the remote
station 3 on Fipway network 20.
We will use table %MW190:8 to contain these words to be sent, and table %MW200:2
will contain the management table of the exchange.

Fipway network 20
{20.1} {20.3}
IF RE(%I0.3.10) THEN
SEND_TLG(ADDR(’{20.3}APP’), %MW190:8, %MW200:2);
END_IF;
Request parameters:
ADDR(’{20.3}APP’) l {20.2}: network 20, station 3
l APP: application
%MW190:8 Contents of the telegram to be sent
Note: The word %MW 201 must be initialized to 16 (8 words) before the request is
sent.
To execute this function synchronously, it is necessary to test the operation report
immediately after the program line that activates the execution of this function.
33002527 205
SEND_TLG
206 33002527
SYMAX_IP_ADDR: SY/MAX
IP Address
22
Overview
Introduction This chapter describes the SYMAX_IP_ADDR block.

Chapter?
Topic Page
Description 208
33002527 207
SYMAX_IP_ADDR
Description
Function This function block allows the entry of the SY/MAX IP address for function blocks
Description REAG_REG, CREAD_REG, WRITE_REG and CWRITE_REG. The address is
SYMAX_IP_ADDR function block.
in FBD
SYMAX_IP_ADDR_Instance
SYMAX_IP_ADDR
MappingIndex DROP_NO
NOEModuleSlot SLOT_ID
ADDRFLD DataStructureSYMAX_IP
DestinationDropNumber DESTDROP
Terminator TERMINAT
in LD
SYMAX_IP_ADDR_Instance
SYMAX_IP_ADDR
EN ENO
MappingIndex DROP_NO
ADDRFLD DataStructureSYMAX_IP
DestinationDropNumber DESTDROP
Terminator TERMINAT
208 33002527
SYMAX_IP_ADDR
in IL CAL SYMAX_IP_ADDR_Instance (DROP_NO:=MappingIndex,
SLOT_ID:=NOEModuleSlot, DESTDROP:=DestinationDropNumber,
TERMINAT:=Terminator, ADDRFLD=>DataStructureSYMAX_IP)
in ST SYMAX_IP_ADDR_Instance (DROP_NO:=MappingIndex,
SLOT_ID:=NOEModuleSlot, DESTDROP:=DestinationDropNumber,
TERMINAT:=Terminator, ADDRFLD=>DataStructureSYMAX_IP) ;

description
Parameters Data type Description
DROP_NR BYTE MBP on Ethernet Transporter (MET) mapping index
Slot_ID BYTE Slot of the NOE module
DESTDROP WORD Destination drop number (or set to FF hex)
TERMINAT WORD Terminator (set to FF hex)

ADDRFLD WordArr5 Data structure used to transfer the SY/MAX IP
address
33002527 209
SYMAX_IP_ADDR
Element Element description for WordArr5:

description of
WordArr5
WordArr5[1] WORD Most significant byte:
Slots of the NOE module
DROP_NR The MBP to Ethernet Transporter (MET) mapping index is given at the DROP_NR
input, i.e. if MET is 6, the value appears as follows:
0 0 0 0 0 1 1 0
Slot_ID If a NOE in the rack of a Quantum controller is addressed as destination node, the
value at the SLOT_ID input represents the physical NOE slot, i.e. if the NOE is
plugged in at Slot 7 of the rack, the value appears as follows:
0 0 0 0 0 1 1 1
ADDRFLD If a NOE in the rack of a Quantum controller is addressed as a destination node, the
value in the most significant byte represents the physical slot of the NOE and the
least significant byte represents the MBP on Ethernet Transporter (MET) mapping
index, i.e. if the NOE is inserted in slot 7 of the rack and the MET mapping index is
6, the first element of the data structure looks as follows:
0 0 0 0 0 1 1 1 0 0 0 0 0 1 1 0
Most significant byte Slots 1 to ... 16

Least significant byte MBP on Ethernet Transporter (MET) mapping index
210 33002527
TCP_IP_ADDR: TCP/IP Address
23
Overview
Introduction This chapter describes the TCP_IP_ADDR block.

Chapter?
Topic Page
Description 212
33002527 211
TCP_IP_ADDR
Description
Function This function block allows the entry of the TCP/ IP address for function blocks
Description READ_REG, CREAD_REG, WRITE_REG and CWRITE_REG. The address is
TCP_IP_ADDR function block. The "Quantum Ethernet TCP/IP Module User
Guide" provides a complete description of the TCP/IP routing.
in FBD
TCP_IP_ADDR_Instance
TCP_IP_ADDR
MapIndex MAP_IDX
ADDRFLD DataStructureTCP_IPAddress
Byte4OfIPAddress IP_B4
212 33002527
TCP_IP_ADDR
in LD TCP_IP_ADDR_Instance
TCP_IP_ADDR
EN ENO
MapIndex MAP_IDX
ADDRFLD DataStructureTCP_IPAddress
in IL CAL TCP_IP_ADDR_Instance (MAP_IDX:=MapIndex,
SLOT_ID:=NOEModuleSlot, IP_B4:=Byte4OfIPAddress,
IP_B3:=Byte3OfIPAddress, IP_B2:=Byte2OfIPAddress,
IP_B1:=Byte1OfIPAddress,
ADDRFLD=>DataStructureTCP_IPAddress)
in ST TCP_IP_ADDR_Instance (MAP_IDX:=MapIndex,
SLOT_ID:=NOEModuleSlot, IP_B4:=Byte4OfIPAddress,
IP_B3:=Byte3OfIPAddress, IP_B2:=Byte2OfIPAddress,
IP_B1:=Byte1OfIPAddress,
ADDRFLD=>DataStructureTCP_IPAddress) ;
33002527 213
TCP_IP_ADDR

description
MAP_IDX BYTE Map index
Slot_ID BYTE Slot ID
IP_B4 BYTE Byte 4 (MSB) of the 32-bit destination IP address
IP_B3 BYTE Byte 3 of the 32-bit destination IP address
IP_B2 BYTE Byte 2 of the 32-bit destination IP address
IP_B1 BYTE Byte 1 (LSB) of the 32-bit destination IP address

ADDRFLD WordArr5 Data structure used to transfer the TCP/IP address
214 33002527
TCP_IP_ADDR
Element Element description for WordArr5:

description of
WordArr5
WordArr5[1] WORD Most significant byte:
MAP_IDX The MBP to Ethernet Transporter (MET) mapping index is given at the Map_Idx+
input, i.e. if MET is 6, the value appears as follows:
0 0 0 0 0 1 1 0
Slot_ID If a NOE in the rack of a Quantum controller is addressed as destination node, the
value at the SLOT_ID input represents the physical NOE slot, i.e. if the NOE is
plugged in at Slot 7 of the rack, the value appears as follows:
0 0 0 0 0 1 1 1
ADDRFLD If a NOE in the rack of a Quantum controller is addressed as a destination node, the
value in the most significant byte represents the physical slot of the NOE and the
least significant byte represents the MBP on Ethernet Transporter (MET) mapping
index, i.e. if the NOE is inserted in slot 7 of the rack and the MET mapping index is
6, the first element of the data structure looks as follows:
0 0 0 0 0 1 1 1 0 0 0 0 0 1 1 0
Most significant byte Slots 1 to ... 16

Least significant byte MBP on Ethernet Transporter (MET) mapping index
33002527 215
TCP_IP_ADDR
216 33002527
UNITE_SERVER: Immediate
server
24
At a Glance
Subject of this This chapter describes the UNITE_SERVER communication function.

Chapter

Chapter?
Topic Page
Description 218
Example of immediate server 222
33002527 217
UNITE_SERVER
Description
Function The UNITE_SERVER function is used to process UNI-TE requests immediately from
Description the application program.
This function can be activated in the MAST task or the FAST task.
Note: At any given time, only one UNITE_SERVER function can be activated by the
application.
Note: The UNITE_SERVER function is used to process requests from a Modbus

link (TSX SCP 114 PCMCIA card in a TSX SCY 21601 module configured as a
Modbus slave with immediate server).
218 33002527
UNITE_SERVER
Exchange The following diagram illustrates the exchanges made during the use of the
principle UNITE_SERVER communication function.
Inputs
First request:
READ_VAR1
UNITE_SERVER
Response to the first function activated
request READ_VAR1
Second request: Application

READ_VAR2
UNITE_SERVER
Response to the second
function activated
request READ_VAR2
Outputs
FBD Representation:
representation
UNITE_SERVER
ADR Address
RqRp Received_Codes
33002527 219
UNITE_SERVER
LD Representation:
representation
UNITE_SERVER
EN ENO
ADR Address
RqRp Received_Codes
LD Management_Param
UNITE_SERVER Address, Received_Codes
ST Representation:
representation UNITE_SERVER(Management_Param, Address, Received_Codes);
220 33002527
UNITE_SERVER
Parameter The following table describes the input/output parameters:

Description
INT This table is made up of 2 words: the first word
contains the exchange number and the activity
bit, the second word contains the report. The
report comprises:
l the operation report (most significant byte),
byte).
The communication report takes one of the
following values:
l 16#00: correct exchange,
l 16#01: stop on timeout, the response was
not able to be sent in under 2 seconds,
l 16#02: stop on user request (STOP, %S0,
INIT, hot or cold re-start),
l 16#03: unknown address format,
l 16#05: incorrect management parameters,
l 16#07: problem in sending to the
destination,
l 16#11: no request received,
l 16#12: UNITE_SERVER function already
called by another task,
l 16#FF: message refused.
Note: When a message is refused (code

16#FF), the operation report can then take the
value 16#14 (server stopped).

INT exchange. This address corresponds to the
channel to which the sender of the request is
linked.
Received_Codes INT At the end of the exchange, this word contains:
l the request code received (most significant),
l the response code sent back (least
significant).
33002527 221
UNITE_SERVER
Example of immediate server
At a Glance This example covers implementation of a UNITE_SERVER function as an immediate

server for a READ_VAR communication function. The Modbus link concerned is
connected to the PCMCIA card of a TSX SCY 21601 module located in slot 2 of the
base rack.
IF NOT %MW100:X0 THEN

UNITE_SERVER(%MW100:2, ADDR(’0.2.1.SYS’), %MW10);
END_IF;
Request parameters:
ADDR(’0.2.1.SYS’) l 0: rack
l 2: module
l 1: channel 1
%MW10 Response:
l Most significant byte: 16#03, Modbus read n words function
code.
l Least significant byte: 16#03, Modbus read n words function
response code.
222 33002527
WRITE_ASYN: Writing data
asynchronously
25
Description
Function The WRITE_ASYN function is used to write 1 Kbyte of data via the asynchronous
Description messaging channel of TSX ETY modules in TCP/IP mode.
The following data can be write-accessed:
l internal bits,
l internal words.
Asynchronous writing can only take place between two stations on the same
Ethernet TCP/IP network segment.
The WRITE_ASYN function is sent at the end of the MAST task only if this is
configured in periodic mode. It is possible to activate 8 functions simultaneously.
The size of the send and receive buffers is expressed in words. It is 512 words, or
1024 bytes.
Note: The asynchronous server function supports UNI-TE V1 or V2.0 protocols.

The WRITE_ASYN function uses the UNI-TE V2.0 protocol.
33002527 223
WRITE_ASYN
Exchange The following diagram illustrates the exchanges between two stations for a
principle WRITE_ASYN function:
I
P Triggering of the WRITE_ASYN
function
O
I
Sending of the function
P
Reception of the function

I
Processing of requests
P Immediate sending of the response
Reception of messages
Routing the responses to the I
WRITE_ASYN functions P
Reception of the response in the O

I WRITE_ASYN function
P Falling activity bit
224 33002527
WRITE_ASYN
FBD Representation:
representation
WRITE_ASYN
Address ADR
Object_Type OBJ
First_Object NUM
Object_Number NB
Data_to_Write EMIS
LD Representation:
representation
WRITE_ASYN
EN ENO
Address ADR
Object_Type OBJ
First_Object NUM
Object_Number NB
Data_to_Write EMIS
LD Address
WRITE_ASYN Object_Type, First_Object, Object_Number,
Data_to_Write, Management_Param
ST Representation:
representation WRITE_ASYN(Address, Object_Type, First_Object, Object_Number,
Data_to_Write, Management_Param);
33002527 225
WRITE_ASYN

Description
INT exchange. Addresses are of the type:
ADDR(’{Network.Station}SYS.
Object_Type STRING Type of objects to write:
First_Object DINT Index of the first object to be written in the
destination device.
Object_Number INT Number of objects to write.
Data_to_Write ARRAY [n... m] Word table containing the value of the objects to
OF INT be written.

INT the management parameters, p. 32). The
operation report takes one of the following
values:
l 16#00 : correct exchange,
l 16#01 : stop on timeout, the response was
not able to be sent in under 2 seconds,
l 16#02 : stop on user request (STOP, S0,
INIT, hot or cold re-start),
l 16#03 : incorrect address format,
l 16#05 : incorrect management parameters,
l 16#07 : destination missing,
l 16#09 : insufficient receive buffer size,
l 16#10 : insufficient send buffer size,
l 16#11 : no system resources (8 functions
already active),
l 16#19 : incorrect exchange number,
l 16#FF: message refused.
Note: do not forget to program a Timeout value

to stop an exchange in progress when the
response is not returned to the sender.
226 33002527
WRITE_GDATA: Writing the
Global Data Modbus Plus
26
Description
Function The WRITE_GDATA function is used to write shared data, or Global Data, on a
Description Modbus Plus network.
Global Data is shared between a maximum of 64 stations on the same Modbus Plus
network. Each station may write up to 32 integers, which can then be used by all
stations on the network. Conversely, each station can read the 32 integers
(maximum) of all the other network stations.
FBD Representation:
representation
WRITE_GDATA
Address ADR
Data_to_Write OUT
33002527 227
WRITE_GDATA
LD Representation:
representation
WRITE_GDATA
EN ENO
Address ADR
Data_to_Write OUT
LD Address
WRITE_GDATA Data_to_Write, Management_Param
ST Representation:
representation WRITE_GDATA(Address, Data_to_Write, Management_Param);
228 33002527
WRITE_GDATA

Description
Address ARRAY [0.. 5] OF Address of the PCMCIA card that connects the
INT Premium to the Modbus Plus network. The
value of this address is:
ADDR(’0.0.1.SYS’).
Note: data is written to the PCMCIA card, which

then shares it.
OF INT be written. This table must always be 32
integers of 16 bits in size, the maximum size of
Global Data on a Modbus Plus network.

It is not necessary to initialize the length
parameter before launching the exchange.
33002527 229
WRITE_GDATA
230 33002527
WRITE_REG: Write register
27
Overview
Introduction This chapter describes the WRITE_REG block.

Chapter?
Topic Page
Description 232
Function mode 237
33002527 231
WRITE_REG
Description
Function With a rising edge at the REQ input, this function block writes a register area from a
description register area from the PLC via Modbus Plus, TCP/IP Ethernet or SY/MAX-Ethernet
to an addressed slave.
Note: When programming a WRITE_REG function, you must be familiar with the
in FBD
WRITE_REG_Instance
WRITE_REG
StartWriteOnce REQ DONE SetAfterWritingData
OffsetAddress SLAVEREG ERROR SetInCaseOfError
DataStructureForTransfer ADDRFLD STATUS ErrorCode
232 33002527
WRITE_REG
in LD
WRITE_REG_Instance
WRITE_REG
EN ENO
StartWriteOnce SetAfterWritingData
REQ DONE
SetInCaseOfError
OffsetAddress SLAVEREG ERROR
DataStructureForTransfer ADDRFLD STATUS ErrorCode
in IL CAL WRITE_REG_Instance (REQ:=StartWriteOnce,
REG_WRIT:=SourceDataArea,
ADDRFLD:=DataStructureForTransfer,
DONE=>SetAfterWritingData, ERROR=>SetInCaseOfError,
STATUS=>ErrorCode)
in ST WRITE_REG_Instance (REQ:=StartWriteOnce,
REG_WRIT:=SourceDataArea,
ADDRFLD:=DataStructureForTransfer,
DONE=>SetAfterWritingData, ERROR=>SetInCaseOfError,
STATUS=>ErrorCode) ;
33002527 233
WRITE_REG

description
REQ BOOL With a rising edge at the REQ input, this function
block writes a register area from a register area from
the PLC via Modbus Plus, TCP/IP Ethernet or
SY/MAX-Ethernet to an addressed slave.
to be written to.
NO_REG INT Number of addresses to be written from slave
REG_WRIT ANY Source data field
(A data structure must be declared as a located
variable for the source file .)
ADDRFLD WordArr5 Data structure transferring the Modbus Plus-
address, TCP/IP address or SY/MAX-IP address.

DONE BOOL Set to "1" for one cycle after writing data.
ERROR BOOL Set to "1" for one cycle if an error occurs.
one cycle.
Error code, see
Codes, p. 122
234 33002527
WRITE_REG
Derived Data Types

description for
WordArr5 in

description for
WordArr5 with
TCP/IP Ethernet WordArr5[1] WORD Most significant byte:
33002527 235
WRITE_REG
Element Element description for WordArr5 with SY/MAX Ethernet:

description for
WordArr5 with
SY/MAX Ethernet WordArr5[1] WORD Most significant byte:
236 33002527
WRITE_REG
Function mode
Function mode Although a large number of WRITE_REG function blocks can be programmed, only
of the four write operations may be active at the same time. In such a case it is insignificant
WRITE_REG whether they are the result of this function block or others (e.g. MBP_MSTR,
block CWRITE_REG). All function blocks use one data transaction path and require
multiple cycles to complete a job.
If several WRITE_REG function blocks are used within an application, they must at
least differ in the values of their NO_REG or REG_WRIT parameters.
The status signals DONE and ERROR report the function block state to the user
program.
Please use:
l Modbus Plus for function block ModbusP_ADDR (See ModbusP_ADDR:
Modbus Plus Address, p. 131)
l TCP/IP Ethernet for function block TCP_IP_ADDR (See TCP_IP_ADDR: TCP/
IP Address, p. 211)
l SY/MAX Ethernet for function block SYMAX_IP_ADDR (See SYMAX_IP_ADDR:
SY/MAX IP Address, p. 207)
33002527 237
WRITE_REG
REQ A rising edge triggers the write transaction.

or literal.
SLAVEREG Start of the area in the addressed slave to which the source data is written. The
source area always resides within the %MW address area.

The destination area always resides within the 4x register area. SLAVEREG expects
the target address as an offset within the 4x area. The leading "4" must be omitted
(e.g. 59 (contents of the variables or value of the literal) = 40059).
or literal.
NO_REG Number of addresses to be written to slave processor (1 ... 100).

or literal.
REG_WRIT An ARRAY that is the same size as the planned transmission must be agreed upon
DONE Transition to ON state for one program scan signifies that the data has been
transferred.
variable.
ERROR Transition to ON state for one program cycle signifies the detection of a new error.
variable.
238 33002527
WRITE_REG
Error code, see
variable.
33002527 239
WRITE_REG
240 33002527
WRITE_VAR: Writing variables
28
At a Glance
Subject of this This chapter describes the WRITE_VAR communication function.

Chapter

Chapter?
Topic Page
Description 242
Example of how to write words on a network 247
Example including execution check 249
33002527 241
WRITE_VAR
Description
Function The WRITE_VAR function is used to write one or more language objects of the same
Description type:
l internal bits,
l internal words.
The objects to be written must always be consecutive. They may be located in a
remote CPU or in a device connected to a communication channel of one of the
following types: Ethernet TCP/IP, Ethway, Uni-Telway, terminal port, Fipway,
Modbus, Modbus Plus, Ethway, Fipio.
FBD Representation:
representation
WRITE_VAR
Address ADR
Object_Type OBJ
First_Object NUM
Object_Number NB
Data_to_Write EMIS
242 33002527
WRITE_VAR
LD Representation:
representation
WRITE_VAR
EN ENO
Address ADR
Object_Type OBJ
First_Object NUM
Object_Number NB
Data_to_Write EMIS
LD Address
WRITE_VAR Object_Type, First_Object, Object_Number,
Data_to_Write, Management_Param
ST Representation:
representation WRITE_VAR(Address, Object_Type, First_Object, Object_Number,
Data_to_Write, Management_Param);
33002527 243
WRITE_VAR

Description
INT exchange. The following addresses are
prohibited:
l {Network.Station}APP,
l {Network.Station}APP.num,
l broadcast addresses (ALL).
Object_Type STRING Type of objects to write:
First_Object DINT Index of the first object to be written in the
destination device.
Object_Number INT Number of objects to write.
OF INT be written.

Note: The length parameter must not be initialized before launching the function.
244 33002527
WRITE_VAR
WRITE_VAR
Parameters
Address: ... ?
Type of Object to Write:
Address of the first Object to Write: ...

Number of Consecutive Objects to Write: ...
Data to write: ...
Report: ...
OK Cancel
Address The types of object possible are:

l ADDR(STRING),
turns gray.
33002527 245
WRITE_VAR
Type of object to Possible choices:

write. l ‘%M’ for writing internal bits.
l ‘%MW’ for writing internal words.
l ‘%S’ for writing system bits.
l ‘%SW’ for writing system words.
Address of the The possible objects are of the DINT type:

first object to l variables,
write l constants,
l immediate value.
enter a variable, it can be localised (See , p. 277) or not. On the other hand the
objects to be written are mandatory located variables.
Number of The possible objects are of the INT type:

consecutive l variables,
objects to write l constants,
l immediate value.
enter a variable, it can be localised or not.
Data to write The data to write zone is an integer array. The size of this array depends on the
number of objects to write. This integer array can be located or not.
246 33002527
WRITE_VAR
Example of how to write words on a network
At a Glance Until now, the examples have been written using direct addressing (use of %MWi),
but it is also possible to create these same examples using unlocated variables.
The following example uses unlocated variables, and covers the writing of a 50-word
table named Tab_1 (declared as an ARRAY [0..49] OF INT) in the Uni-Telway
slave, with the address:
l Network 20
l Station 1
l SCM2116 module in a TSX 87 in slot 5 of the base rack
l Channel 1
l Server address of slave Ad0 = 3.
The values to write are in the variable Tab_1 of the sender.
The management parameters are located in a table of 4 integers called
Management_Parameter (declared as ARRAY [0..3] OF INT).

Fipway network 20
TSX 87 TSX Premium
{20.2}
{20.1}
Uni-Telway
Ad0 = 3
Ad0 = 1
33002527 247
WRITE_VAR
IF RE(%I0.3.1) AND NOT Management_Parameter[0].0 THEN
WRITE_VAR(ADDR(’{20.1}0.5.1.3’),’%MW’,0,50,Tab_1,Management_
Parameter);
END_IF;
Request parameters:
ADDR(’{20.1}5.1.3’) l {20.1}: network 20, station 1
l 0: rack
l 5: module
l 1: channel 1
l 3: destination address
’%MW’ Type of object (internal word)
0 address of the first object to write
50 Number of consecutive objects to write
Tab_1 Data to write
Management_Parameter Management table
248 33002527
WRITE_VAR
Example including execution check
At a Glance The following example illustrates the WRITE_VAR function with a management
parameter check.

the function
IF NOT %M20 AND %I0.1.2 THEN
%MW200:4:= 0;
INC %MW1700
%MW202:= 50;
WRITE_VAR(ADDR(’0.3.1.7’),’%MW’,20,1,%MW1700:1,%MW200:4);
SET %M20;
END_IF;
l the input bit %I0.1.2 controls the function,
l the internet bit %M20 is used to test the activity of the function,
l %MW200:4:= 0; sets the management table to 0,
l INC %MW1700; increments the word %MW1700,
l MW202:= 50; initializes the timeout value to 5 seconds.

the exchange
check IF %M20 AND NOT %M200.0 THEN
INC %MW204;
IF %MW201 = 0 THEN
INC %MW205;
ELSE
SET %Q0.2.2;
INC %MW206;
%MW207 := %MW201;
END_IF;
END_IF;
l %MW204 counts the number of exchanges,

l %MW205 counts the number of correct exchanges,
l %MW206 counts the number of exchanges generating errors,
l %MW207 stores the error message,
l %Q0.2.2 indicates an exchange failure.
33002527 249
WRITE_VAR
250 33002527
Appendices
Introduction
Overview This section contains the appendicies.
What's in this The appendix contains the following chapters:

Appendix?
A EFB Error Codes and Values 253
B System objects 259
33002527 251
Appendices
252 33002527
EFB Error Codes and Values
A
Overview
Introduction The following tables show the error codes and error values created for the EFBs of
the Communication Library.

Chapter?
Topic Page
Tables of Error Codes for the Communication Library 254
Common Floating Point Errors 257
33002527 253
Tables of Error Codes for the Communication Library
Introduction The following tables show the error codes and error values created for the EFBs of
the Communication Library.
Extended Table of error codes and errors values created for EFBs of the Extended family.
EFB name Error code ENO Error Error Error description
state in value in value in
case of Dec Hex
error
CREAD_REG E_EFB_MSTR_ERROR F -30191 16#8A11 MSTR communication error
CREAD_REG E_EFB_NOT_STATE_ F -30531 16#88BD Variable not mapped to % MW (4x)
RAM_4X area
CREAD_REG - F 8195 16#2003 Value displayed in status word.
(Comes together with
E_EFB_MSTR_ERROR)
CREAD_REG - F 8206 16#200E Value displayed in status word.
Comes together with
E_EFB_NOT_STATE_RAM_4X
CREAD_REG - F - - See tables of :
l Modbus Plus and SY/MAX
EtherNet Error Codes (See
Modbus Plus and SY/MAX
l SY/MAX specific Error Codes
(See SY/MAX-specific error
codes, p. 124)
l TCP/IP EtherNet Error Codes
(See TCP/IP Ethernet error
codes, p. 126)
CWRITE_REG E_EFB_MSTR_ERROR F -30191 16#8A11 MSTR communication error
CWRITE_REG - F 8195 16#2003 Value displayed in status word
Comes together with
E_EFB_MSTR_ERROR
CWRITE_REG - F 8206 16#200E Value displayed in status word
Comes together with
254 33002527

case of Dec Hex
error
CWRITE_REG - F - - See tables of :
codes, p. 124)
codes, p. 126)
MBP_MSTR E_EFB_OUT_OF_ F -30192 16#8A10 Internal error: EFB has detected a
RANGE violation e.g. write exceeds %MW
(4x) boundaries
MBP_MSTR E_EFB_NOT_STATE_ F -30531 16#88BD Variable not mapped to %MW (4x)
RAM_4X area
MBP_MSTR - F 8195 16#2003 Value displayed in status word
Comes together with
E_EFB_MSTR_ERROR in status
of control block
MBP_MSTR - F 8206 16#200E Value displayed in status word
Comes together with
in status of control block
MBP_MSTR - F - - See tables of :
codes, p. 124)
codes, p. 126)
READ_REG W_WARN_OUT_OF_ F 30110 16#759E Parameter out of range
RANGE
READ_REG E_EFB_NOT_STATE_ F -30531 16#88BD Variable not mapped to %MW (4x)
RAM_4X area
33002527 255

case of Dec Hex
error
READ_REG E_EFB_MSTR_ERROR F -30191 16#8A11 MSTR communication error
READ_REG - F 8195 16#2003 Value displayed in status word
Comes together with
W_WARN_OUT_OF_RANGE
READ_REG MBPUNLOC F 8206 16#200E Value displayed in status word
Comes together with
READ_REG - F - - See tables of :
codes, p. 124)
codes, p. 126)
WRITE_REG W_WARN_OUT_OF_ F 30110 16#759E Parameter out of range
RANGE
WRITE_REG E_EFB_NOT_STATE_ F -30531 16#88BD Variable not mapped to %MW (4x)
RAM_4X area
WRITE_REG E_EFB_MSTR_ERROR F -30191 16#8A11 MSTR communication error
WRITE_REG - F 8195 16#2003 Value displayed in status word
Comes together with
W_WARN_OUT_OF_RANGE
WRITE_REG - F 8206 16#200E Value displayed in status word
Comes together with
256 33002527

case of Dec Hex
error
WRITE_REG - F - - See tables of :
codes, p. 124)
codes, p. 126)
Common Floating Point Errors
Introduction The following table shows the commen error codes and error values created for
floating point errors.
Common Table of common floating point errors

Floating Point
Errors
Error codes Error value in Error value Error description
Dec in Hex
FP_ERROR -30150 16#8A3A Base value (not apearing as an error value)
E_FP_STATUS_FAILED_IE -30151 16#8A39 Illegal floating point operation
E_FP_STATUS_FAILED_DE -30152 16#8A38 Operand is denormalized - not a valid REAL
number
E_FP_STATUS_FAILED_ZE -30154 16#8A36 Illegal divide by zero
E_FP_STATUS_FAILED_ZE_IE -30155 16#8A35 Illegal floating point operation / Divide by zero
E_FP_STATUS_FAILED_OE -30158 16#8A32 Floating point overflow
E_FP_STATUS_FAILED_OE_IE -30159 16#8A31 Illegal floating point operation / Overflow
E_FP_STATUS_FAILED_OE_ZE -30162 16#8A2E Floating point overflow / Divide by zero
E_FP_STATUS_FAILED_OE_ZE_ -30163 16#8A2D Illegal floating point operation / Overflow /
IE Divide by zero
E_FP_NOT_COMPARABLE -30166 16#8A2A Internal error
33002527 257
258 33002527
System objects
B
At a Glance
Subject of this This chapter describes the system bits and words of Unity Pro language.
Chapter Note: The symbols, associated with each bit object or system word, mentioned in
the descriptive tables of these objects, are not implemented as standard in the
software, but can be entered using the data editor.
They are proposed in order to ensure the homogeneity of their names in the different
applications.

Chapter?
Topic Page
System bit introduction 260
Description of system bits %S15 to %S21 261
Description of System Words %SW12 to %SW19 265
33002527 259
System objects
System bit introduction
General The Premium, Atrium and Quantum PLCs use %Si system bits which indicate the
state of the PLC, or they can be used to control how it operates.
These bits can be tested in the user program to detect any functional development
requiring a set processing procedure.
Some of these bits must be reset to their initial or normal state by the program.
However, the system bits that are reset to their initial or normal state by the system
must not be reset by the program or by the terminal.
260 33002527
System objects
Description of system bits %S15 to %S21
Detailed Description of system bits %S15 to %S21:

description
Bit Function Description Initial Quantum Premium
Symbol state Atrium
%S15 Character Normally set to 0, this bit is set to 1 when the 0 YES YES
STRINGERROR string fault destination zone for a character string
transfer is not of sufficient size (including the
number of characters and the end of string
character) to receive this character string.
The application stops in error state if the
%S78 bit has been to set to 1.
This bit must be reset to 0 by the application.
%S16 Task input/ Normally set to 1, this is set to 0 by the 1 YES YES
IOERRTSK output fault system when a fault occurs on an in-rack I/O
module or a Fipio device configured in the
task.
This bit must be reset to 1 by the user.
%S17 Rotate shift Normally at 0. 0 YES YES
CARRY output During a rotate shift operation, this takes the
state of the outgoing bit.
33002527 261
System objects

Symbol state Atrium
%S18 Overflow or Normally set to 0, this is set to 1 in the event 0 YES YES
OVERFLOW arithmetic of a capacity overflow if there is:
error l a result greater than + 32 767 or less than
- 32 768, in single length,
l result greater than + 65 535, in unsigned
integer,
l a result greater than + 2 147 483 647 or
less than - 2 147 483 648, in double
length,
l result greater than +4 294 967 296, in
double length or unsigned integer,
l real values outside limits,
l division by 0,
l the root of a negative number,
l forcing to a non-existent step on a drum.
l stacking up of an already full register,
emptying of an already empty register.
It must be tested by the user program after
each operation where there is a risk of
overflow, then reset to 0 by the user if there
is indeed an overflow.
When the %S18 bit switches to 1, the
application stops in error state if the %S78 bit
has been to set to 1.
%S19 Task period Normally set to 0, this bit is set to 1 by the 0 YES YES
OVERRUN overrun system in the event of a time period overrun
(periodical (i.e. task execution time is greater than the
scanning) period defined by the user in the
configuration or programmed into the %SW
word associated with the task). The user
must reset this bit to 0. Each task manages
its own %S19 bit.
262 33002527
System objects

Symbol state Atrium
%S18 Overflow or Normally set to 0, this is set to 1 in the event 0 YES YES
OVERFLOW arithmetic of a capacity overflow if there is:
error l a result greater than + 32 767 or less than
- 32 768, in single length,
l result greater than + 65 535, in unsigned
integer,
l a result greater than + 2 147 483 647 or
less than - 2 147 483 648, in double
length,
l result greater than +4 294 967 296, in
double length or unsigned integer,
l real values outside limits,
l division by 0,
l the root of a negative number,
l forcing to a non-existent step on a drum.
l stacking up of an already full register,
emptying of an already empty register.
overflow, then reset to 0 by the user if there
is indeed an overflow.
%S19 Task period Normally set to 0, this bit is set to 1 by the 0 YES YES
OVERRUN overrun system in the event of a time period overrun
(periodical (i.e. task execution time is greater than the
scanning) period defined by the user in the
configuration or programmed into the %SW
word associated with the task). The user
must reset this bit to 0. Each task manages
its own %S19 bit.
33002527 263
System objects

Symbol state Atrium
%S20 Index Normally set to 0, this is set to 1 when the 0 YES YES
INDEXOVF overflow address of the indexed object becomes less
than 0 or exceeds the number of objects
declared in the configuration.
In this case, it is as if the index were equal to
0.
overflow, then reset to 0 if there is indeed an
overflow.
%S21 First task Tested in a task (Mast, Fast, Aux0, Aux1, 0 YES YES
1RSTTASKRUN cycle Aux2 Aux3), the bit %S21 indicates the first
cycle of this task. %S21 is set to 1 at the start
of the cycle and reset to zero at the end of the
cycle.
Notes: the bit %S21 does not have the same
meaning in PL7 as in Unity Pro.
CAUTION
%S16 for Quantum PLCs
On Quantum, communication errors from modules (NOM, NOE, NWM,
CRA, CRP) and MMS modules are not reported on bits %S10 and
%S16.
It is entirely your responsibility to ensure that these system bits are used
correctly
Failure to follow this instruction can result in injury or equipment
damage.
264 33002527
System objects
Description of System Words %SW12 to %SW19
Detailed Description of system words %SW12 to %SW19:

Description
Word Function Description Initial Quantum Premium
Symbol state Atrium
%SW12 Uni-Telway Uni_Telway address of terminal port (in - NO YES
UTWPORTADDR terminal slave mode) as defined in the configuration
port and loaded into this word on cold start.
address Note: The modification of the value of this
word is not taken into account by the
system
%SW13 Main Indicates the following for the main network 254 NO YES
XWAYNETWADDR address of (Fipway or Ethway): (16#00FE)
the station l the station number (least significant
byte) from 0 to 127,
l the network number (most significant
byte) from 0 to 63,
(value of the micro-switches on the
PCMCIA card).
%SW14 Commercia This word contains the commercial version - YES YES
OSCOMMVERS l version of of the PLC processor.
PLC Example: 16#0135
processor version: 01
issue number: 35
%SW15 PLC This word contains the commercial version - YES YES
OSCOMMPATCH processor of the PLC processor patch.
patch It is coded onto the least significant byte of
version the word.
Coding: 0 = no patch, 1 = A, 2 = B...
Example: 16#0003 corresponds to
patch C.
%SW16 Firmware This word contains the Firmware version - YES YES
OSINTVERS version number in hexadecimal of the PLC
number processor firmware.
Example: 16#0017
version: 2.1
VN: 17
33002527 265
System objects
Word Function Description Initial Quantum Premium

Symbol state Atrium
%SW17 Error status On detection of an error in a floating 0 YES YES
FLOATSTAT on floating arithmetic operation, bit %S18 is set to 1
operation and %SW17 error status is updated
according to the following coding:
l %SW17.0 = Invalid operation / result is
not a number
l %SW17.1 = Non-standardized operand
/ result is acceptable
l %SW17.2 = Division by 0 / result is
infinity
l %SW17.3 = Overflow / result is infinity
l %SW17.4 = Underflow / result is 0
l %SW17.5 to 15 = not used
This word is reset to 0 by the system on
cold start, and also by the program for re-
usage purposes.
%SW18 Absolute The words %SW18 and %SW19 are used 0 YES YES
%SW19 time to calculate duration.
100MSCOUNTER counter They are incremented every 1/10th of a
second by the system (even when PLC is in
STOP, they are no longer incremented if
the PLC is powered down). They can be
read and written by the user program or by
the terminal.
266 33002527
Glossary
%I According to the IEC standard, %I indicates a discrete input-type language object.
%IW According to the IEC standard, %IW indicates an analog input -type language object.
%KW According to the IEC standard, %KW indicates a constant word-type language object.
%M According to the IEC standard, %M indicates a memory bit-type language object.
%MW According to the IEC standard, %MW indicates a memory word-type language object.
%Q According to the IEC standard, %Q indicates a discrete output-type language object.
%QW According to the IEC standard, %QW indicates an analog output-type language
object.
ADDR_TYPE This predefined type is used as output for ADDR function. This type is ARRAY[0..5]
OF Int. You can find it in the libset, in the same family than the EFs which use it.
ANL_IN ANL_IN is the abbreviation of Analog Input data type and is used when processing
analog values. The %IW adresses for the configured analog input module, which
were specified in the I/O component list, are automatically assigned data types and
should therefore only be occupied with Unlocated Variables.
33002527 267
Glossary
ANL_OUT ANL_OUT is the abbreviation of Analog Output data type and is used when
processing analog values. The %MW adresses for the configured analog input
module, which were specified in the I/O component list, are automatically assigned
data types and should therefore only be occupied with Unlocated Variables.
ANY There is a hierarchy between the different types of data. In the DFB, it is sometimes
possible to declare which variables can contain several types of values. Here, we
use ANY_xxx types.
The following diagram shows the hierarchically-ordered structure:
ANY
ANY_ELEMENTARY
ANY_MAGNITUDE_OR_BIT
ANY_MAGNITUDE
ANY_NUM
ANY_REAL
REAL
ANY_INT
DINT, INT, UDINT, UINT
TIME
ANY_BIT
DWORD, WORD, BYTE, BOOL
ANY_STRING
STRING
ANY_DATE
DATE_AND_TIME, DATE, TIME_OF_DAY
EBOOL
ANY_DERIVED
ANY_ARRAY
ANY_ARRAY_ANY_EDT
ANY_ARRAY_ANY_MAGNITUDE
ANY_ARRAY_ANY_NUM
ANY_ARRAY_ANY_REAL
ANY_ARRAY_REAL
ANY_ARRAY_ANY_INT
ANY_ARRAY_DINT
ANY_ARRAY_INT
ANY_ARRAY_UDINT
ANNY_ARRAY_UINT
ANY_ARRAY_TIME
ANY_ARRAY_ANY_BIT
ANY_ARRAY_DWORD
ANY_ARRAY_WORD
ANY_ARRAY_BYTE
ANY_ARRAY_BOOL
ANY_ARRAY_ANY_STRING
ANY_ARRAY_STRING
ANY_ARRAY_ANY_DATE
ANY_ARRAY_DATE_AND_TIME
ANY_ARRAY_DATE
ANY_ARRAY_TIME_OF_DAY
ANY_ARRAY_EBOOL
ANY_ARRAY_ANY_DDT
ANY_STRUCTURE
ANY_DDT
ANY_IODDT
ANY_FFB
ANY_EFB
ANY_DFB
268 33002527
Glossary
ARRAY An ARRAY is a table of elements of the same type.

The syntax is as follows: ARRAY [<terminals>] OF <Type>
Example:
ARRAY [1..2] OF BOOL is a one-dimensional table made up of two BOOL-type
elements.
ARRAY [1..10, 1..20] OF INT is a two-dimensional table made up of 10x20
INT-type elements.
Base 10 literals A literal value in base 10 is used to represent a decimal integer value. This value can
be preceded by the signs "+" and "-". If the character "_" is employed in this literal
value, it is not significant.
Example:
-12, 0, 123_456, +986
Base 16 Literals An literal value in base 16 is used to represent an integer in hexadecimal. The base
is determined by the number "16" and the sign "#". The signs "+" and "-" are not
allowed. For greater clarity when reading, you can use the sign "_" between bits.
Example:
16#F_F or 16#FF (in decimal 255)
16#F_F or 16#FF (in decimal 224)
Base 2 Literals A literal value in base 2 is used to represent a binary integer. The base is determined
by the number "2" and the sign "#". The signs "+" and "-" are not allowed. For greater
clarity when reading, you can use the sign "_" between bits.
Example:
2#1111_1111 or 2#11111111 (in decimal 255)
2#1110_0000 or 2#11100000 (in decimal 224)
Base 8 Literals A literal value in base 8 is used to represent an octal integer. The base is determined
by the number "8" and the sign "#". The signs "+" and "-" are not allowed. For greater
clarity when reading, you can use the sign "_" between bits.
Example:
8#3_77 or 8#377 (in decimal 255)
8#34_0 or 8#340 (in decimal 224)
33002527 269
Glossary
BCD BCD is the abbreviation of Binary Coded Decimal format

BCD is used to represent decimal numbers between 0 and 9 using a group of four
bits (half-byte).
In this format, the four bits used to code the decimal numbers have a range of
unused combinations.
Example of BCD coding:
l the number 2450
l is coded: 0010 0100 0101 0000
BOOL BOOL is the abbreviation of Boolean type. This is the elementary data item in
computing. A BOOL type variable has a value of either: 0 (FALSE) or 1 (TRUE).
A BOOL type word extract bit, for example: %MW10.4.
BYTE When 8 bits are put together, this is callad a BYTE. A BYTE is either entered in
binary, or in base 8.
The BYTE type is coded in an 8 bit format, which, in hexadecimal, ranges from
16#00 to 16#FF
DATE The DATE type coded in BCD in 32 bit format contains the following information:
l the year coded in a 16-bit field,
l the month coded in an 8-bit field,
l the day coded in an 8-bit field.
The DATE type is entered as follows: D#<Year>-<Month>-<Day>
This table shows the lower/upper limits in each field:
Field Limits Comment

Year [1990,2099] Year
Month [01,12] The left 0 is always displayed, but can be omitted at the
time of entry
Day [01,31] For the months 01\03\05\07\08\10\12
[01,30] For the months 04\06\09\11
[01,29] For the month 02 (leap years)
[01,28] For the month 02 (non leap years)
DATE_AND_ see DT
TIME
270 33002527
Glossary
DBCD Representation of a Double BCD-format double integer.

The Binary Coded Decimal (BCD) format is used to represent decimal numbers
between 0 and 9 using a group of four bits.
In this format, the four bits used to code the decimal numbers have a range of
unused combinations.
Example of DBCD coding:
l the number 78993016
l is coded: 0111 1000 1001 1001 0011 0000 0001 0110
DDT DDT is the abbreviation of Derived Data Type.

A derived data type is a set of elements of the same type (ARRAY) or of various types
(structure)
DFB DFB is the abbrevation of Derived Function Block.

DFB types are function blocks that can be programmed by the user ST, IL, LD or
FBD.
By using DFB types in an application, it is possible to:
l simplify the design and input of the program,
l increase the legibility of the program,
l facilitate the debugging of the program,
l reduce the volume of the generated code.
DINT DINT is the abbrevation of Double Integer format (coded on 32 bits).

The lower and upper limits are as follows: -(2 to the power of 31) to (2 to the power
of 31) - 1.
Example:
-2147483648, 2147483647, 16#FFFFFFFF.
33002527 271
Glossary
DT DT is the abbreviation of Date and Time.

The DT type coded in BCD in 64 bit format contains the following information:
l The year coded in a 16-bit field,
l the month coded in an 8-bit field,
l the day coded in an 8-bit field,
l the hour coded in a 8-bit field,
l the minutes coded in an 8-bit field,
l the seconds coded in an 8-bit field.
Note: The 8 least significant bits are unused.
The DT type is entered as follows:

DT#<Year>-<Month>-<Day>-<Hour>:<Minutes>:<Seconds>

Year [1990,2099] Year
Month [01,12] The left 0 is always displayed, but can be omitted at
the time of entry
Day [01,31] For the months 01\03\05\07\08\10\12
[01,30] For the months 04\06\09\11
[01,29] For the month 02 (leap years)
[01,28] For the month 02 (non leap years)
Hour [00,23] The left 0 is always displayed, but can be omitted at
the time of entry
Minute [00,59] The left 0 is always displayed, but can be omitted at
the time of entry
Second [00,59] The left 0 is always displayed, but can be omitted at
the time of entry
272 33002527
Glossary
DWORD DWORD is the abbreviation of Double Word.

The DWORD type is coded in 32 bit format.
This table shows the lower/upper limits of the bases which can be used:
Base Lower limit Upper limit

Hexadecimal 16#0 16#FFFFFFFF
Octal 8#0 8#37777777777
Binary 2#0 2#11111111111111111111111111111111
Representation examples:
Data content Representation in one of the bases

00000000000010101101110011011110 16#ADCDE
00000000000000010000000000000000 8#200000
00000000000010101011110011011110 2#10101011110011011110
EBOOL EBOOL is the abbrevation of Extended Boolean type. A EBOOL type variable brings
a value (0 (FALSE) or 1 (TRUE) but also rising or falling edges and forcing
capabilities.
An EBOOL type variable takes up one byte of memory.
The byte split up into:
l one bit for the value,
l one bit for the history bit (each time the state’s object changes, the value is copied
inside the history bit),
l one bit for the forcing bit (equals to 0 if the object isn’t forced, equal to 1 if the bit
is forced.
The default type value of each bit is 0 (FALSE).
33002527 273
Glossary
EF Is the abbreviation of Elementary Function.

This is a block which is used in a program, and which performs a predefined
software function.
A function has no internal status information. Multiple invocations of the same
function using the same input parameters always supply the same output values.
Details of the graphic form of the function invocation can be found in the "[Functional
block (instance)] ". In contrast to the invocation of the function blocks, function
invocations only have a single unnamed output, whose name is the same as the
function. In FBD each invocation is denoted by a unique [number] via the graphic
block, this number is automatically generated and can not be altered.
You position and set up these functions in your program in order to carry out your
application.
You can also develop other functions using the SDKC development kit.
EFB Is the abbreviation for Elementary Function Block.

This is a block which is used in a program, and which performs a predefined
software function.
EFBs have internal statuses and parameters. Even where the inputs are identical,
the output values may be different. For example, a counter has an output which
indicates that the preselection value has been reached. This output is set to 1 when
the current value is equal to the preselection value.
Elementary see EF
Function
EN EN means ENable, this is an optional block input. When EN is activated, an ENO

output is automatically drafted.
If EN = 0, the block is not activated, its internal program is not executed and ENO is
set to 0.
If EN = 1, the internal program of the block is executed, and ENO is set to 1 by the
system. If an error occurs, ENO is set to 0.
If EN is not connected, it is automatically set to 1.
ENO ENO means Error NOtification, this is the output associated to the optional input EN.
If ENO is set to 0 (caused by EN=0 or in case of an execution error),
l the outputs of function blocks remain in the status they were in for the last correct
executed scanning cycle and
l the output(s) of functions and procedures are set to "0".
274 33002527
Glossary
FBD FBD is the abbreviation of Function Block Diagram.

FBD is a graphic programming language that operates as a logic diagram. In
addition to the simple logic blocks (AND, OR, etc.), each function or function block of
the program is represented using this graphic form. For each block, the inputs are
located to the left and the outputs to the right. The outputs of the blocks can be linked
to the inputs of other blocks to form complex expressions.
FFB Collective term for EF (Elementary Function), EFB (Elementary Function Block) and
DFB (Derived Function block)
Function see EF
Function Block see FBD

Diagram
GRAY Gray or "reflected binary" code is used to code a numerical value being developed
into a chain of binary configurations that can be differentiated by the change in
status of one and only one bit.
This code can be used, for example, to avoid the following random event: in pure
binary, the change of the value 0111 to 1000 can produce random numbers between
0 and 1000, as the bits do not change value altogether simultaneously.
Equivalence between decimal, BCD and Gray:
Decimal 0 1 2 3 4 5 6 7 8 9
BCD 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001
Gray 0000 0001 0011 0010 0110 0111 0101 0100 1100 1101
33002527 275
Glossary
IEC 61131-3 International standard: Programmable Logic Controls

Part 3: Programming languages.
IL IL is the abbreviation of Instruction List.

This language is a series of basic instructions.
This language is very close to the assembly language used to program processors.
Each instruction is composed of an instruction code and an operand.
INF Used to indicate that a number overruns the allowed limits.

For a number of Integers, the value ranges (shown in gray) are as follows:
-INF INF
-3.402824e+38 -1.1754944e-38 0.0 1.1754944e-38 3.402824e+38
When a calculation result is:

l less than -3.402824e+38, the symbol -INF (for -infinite) is displayed,
l greater than +3.402824e+38, the symbol INF (for +infinite) is displayed.
INT INT is the abbreviation of single integer format (coded on 16 bits).

The lower and upper limits are as follows: -(2 to the power of 15) to (2 to the power
of 15) - 1.
Example:
-32768, 32767, 2#1111110001001001, 16#9FA4.
Integer Literals Integer literal are used to enter integer values in the decimal system. The values can
have a preceding sign (+/-). Individual underlines (_ ) between numbers are not
significant.
Example:
-12, 0, 123_456, +986
IODDT IODDT is the abbreviation of Input/Output Derived Data Type.

The term IODDT designates a structured data type representing a module or a
channel of a PLC module. Each application expert module possesses its own
IODDTs.
276 33002527
Glossary
Keyword A keyword is a unique combination of characters used as a syntactical programming

language element (See annex B definition of the IEC standard 61131-3. All the key
words used in Unity Pro and of this standard are listed in annex C of the IEC
standard 61131-3. These keywords cannot be used as identifiers in your program
(names of variables, sections, DFB types, etc.)).
LD LD is the abbreviation of Ladder Diagram.

LD is a programming language, representing the instructions to be carried out in the
form of graphic diagrams very close to a schematic electrical diagram (contacts,
coils, etc.).
Located A located variable is a variable for which it is possible to know its position in the PLC
variables memory. For example, the variable Water_pressure, is associated with%MW102.
Water_pressure is said to be localized.
Multiple Token Operating mode of an SFC. In multitoken mode, the SFC may possess several
active steps at the same time.
33002527 277
Glossary
Naming An identifier is a sequence of letters, numbers and underlines beginning with a letter
conventions or underline (e.g. name of a function block type, an instance, a variable or a section).
(Identifier) Letters from national character sets (e.g: ö,ü, é, õ) can be used except in project and
DFB names. Underlines are significant in identifiers; e.g. A_BCD and AB_CD are
interpreted as different identifiers. Multiple leading underlines and consecutive
underlines are invalid.
Identifiers cannot contain spaces. Not case sensitive; e.g. ABCD and abcd are
interpreted as the same identifier.
According to IEC 61131-3 leading digits are not allowed in identifiers. Nevertheless,
you can use them if you activate in dialog Tools → Project settings in tab
Language extensions the ceck box Leading digits.
Identifiers cannot be keywords.
NAN Used to indicate that a result of an operation is not a number (NAN = Not A Number).
Example: calculating the square root of a negative number.
Note: The IEC 559 standard defines two classes of NAN: quiet NAN (QNAN) and
signaling NaN (SNaN) QNAN is a NAN with the most significant fraction bit set and a
SNAN is a NAN with the most significant fraction bit clear (Bit number 22). QNANs
are allowed to propagate through most arithmetic operations without signaling an
exception. SNAN generally signal an invalid-operation exception whenever they
appear as operands in arithmetic operations (See %SW17 and %S18).
Network There are two meanings for Network.

l In LD:
A network is a set of interconnected graphic elements. The scope of a network
is local to the program organization unit (section) in which the network is located.
l With communication expert modules:
A network is a group of stations which communicate among one another. The
term network is also used to define a group of interconnected graphic elements.
This group forms then a part of a program which may be composed of a group of
networks.
278 33002527
Glossary
Procedure Procedures are functions view technically. The only difference to elementary
functions is that procedures can take up more than one output and they support data
type VAR_IN_OUT. To the eye, procedures are no different than elementary
functions.
Procedures are a supplement to IEC 61131-3.
REAL Real type is a coded type in 32 bits.

The ranges of possible values are illustrated in gray in the following diagram:
-INF INF
-3.402824e+38 -1.1754944e-38 0.0 1.1754944e-38 3.402824e+38
When a calculation result is:

l between -1.175494e-38 and 1.175494e-38 it is considerd as a DEN,
l less than -3.402824e+38, the symbol -INF (for - infinite) is displayed,
l greater than +3.402824e+38, the symbol INF (for +infinite) is displayed,
l undefined (square root of a negative number), the symbol NAN or NAN is
displayed.
Note: The IEC 559 standard defines two classes of NAN: quiet NAN (QNAN) and
signaling NaN (SNaN) QNAN is a NAN with the most significant fraction bit set and a
SNAN is a NAN with the most significant fraction bit clear (Bit number 22). QNANs
are allowed to propagate through most arithmetic operations without signaling an
exception. SNAN generally signal an invalid-operation exception whenever they
appear as operands in arithmetic operations (See %SW17 and %S18).
Note: when an operand is a DEN (Denormalized number) the result is not

significant.
Real Literals An literal real value is a number expressed in one or more decimals.
Example:
-12.0, 0.0, +0.456, 3.14159_26
33002527 279
Glossary
Real Literals with An Literal decimal value can be expressed using standard scientific notation. The
Exponent representation is as follows: mantissa + exponential.
Example:
-1.34E-12 or -1.34e-12
1.0E+6 or 1.0e+6
1.234E6 or 1.234e6
SFC SFC is the abbreviation of Sequential Function Chart.

SFC enables the operation of a sequential automation device to be represented
graphically and in a structured manner. This graphic description of the sequential
behavior of an automation device, and the various situations which result from it, is
performed using simple graphic symbols.
Single Token Operating mode of an SFC chart for which only a single step can be active at any
one time.
ST ST is the abbreviation of Structured Text language.

Structured Text language is an elaborated language close to computer
programming languages. It enables you to structure series of instructions.
STRING A variable of the type STRING is an ASCII standard character string. A character
string has a maximum length of 65534 characters.
TIME The type TIME expresses a duration in milliseconds. Coded in 32 bits, this type
makes it possible to obtain periods from 0 to 2 32-1 milliseconds.
The units of type TIME are the following: the days (d), the hours (h), the minutes (m),
the seconds (s) and the milliseconds (ms). A literal value of the type TIME is
represented by a combination of previous types preceded by T#, t#, TIME# or
time#.
Examples: T#25h15m, t#14.7S, TIME#5d10h23m45s3ms
280 33002527
Glossary
Time literals The units of type TIME are the following: the days (d), the hours (h), the minutes (m),
the seconds (s) and the milliseconds (ms). A literal value of the type TIME is
represented by a combination of previous types preceded by T#, t#, TIME# or
time#.
Examples: T#25h15m, t#14.7S, TIME#5d10h23m45s3ms
TIME_OF_DAY see TOD
TOD TOD is the abbreviation of Time of Day.

The TOD type coded in BCD in 32 bit format contains the following information:
l the hour coded in a 8-bit field,
l the minutes coded in an 8-bit field,
l the seconds coded in an 8-bit field.
Note: The 8 least significant bits are unused.
The Time of Day type is entered as follows: TOD#<Hour>:<Minutes>:<Seconds>


Hour [00,23] The left 0 is always displayed, but can be omitted at the time of
entry
Minute [00,59] The left 0 is always displayed, but can be omitted at the time of
entry
Second [00,59] The left 0 is always displayed, but can be omitted at the time of
entry
Example: TOD#23:59:45.
Token An active step of an SFC is known as a token.
TOPO_ADDR_ This predefined type is used as output for READ_TOPO_ADDR function. This type
TYPE is an ARRAY[0..4] OF Int. You can find it in the libset, in the same family than the
EFs which use it.
33002527 281
Glossary
UDINT UDINT is the abbreviation of Unsigned Double Integer format (coded on 32 bits)
unsigned. The lower and upper limits are as follows: 0 to (2 to the power of 32) - 1.
Example:
0, 4294967295, 2#11111111111111111111111111111111, 8#37777777777,
16#FFFFFFFF.
UINT UINT is the abbreviation of Unsigned integer format (coded on 16 bits). The lower
and upper limits are as follows: 0 to (2 to the power of 16) - 1.
Example:
0, 65535, 2#1111111111111111, 8#177777, 16#FFFF.
Unlocated An unlocated variable is a variable for which it is impossible to know its position in
variable the PLC memory. A variable which have no address assigned is said to be
unlocated.
Variable Memory entity of the type BOOL, WORD, DWORD, etc., whose contents can be modified
by the program during execution.
282 33002527
Glossary
WORD The WORD type is coded in 16 bit format and is used to carry out processing on bit
strings.
This table shows the lower/upper limits of the bases which can be used:
Base Lower limit Upper limit

Hexadecimal 16#0 16#FFFF
Octal 8#0 8#177777
Binary 2#0 2#1111111111111111
Representation examples
Data content Representation in one of the bases

0000000011010011 16#D3
1010101010101010 8#125252
0000000011010011 2#11010011
33002527 283
Glossary
284 33002527
Index
B
AC
Symbols C
%S15, 261 CANCEL, 45, 48
%S16, 261 CARRY, 261
%S17, 261 Communication
%S18, 262, 263 ADDR, 43
%S19, 262, 263 CANCEL, 45
%S20, 264 DATA_EXCH, 65
%S21, 264 INPUT_BYTE, 75
%SW12, 265 INPUT_CHAR, 79
%SW13, 265 Length, 38
%SW14, 265 Management table, 32
%SW15, 265 OUT_IN_CHAR, 137
%SW16, 265 PRINT_CHAR, 145
%SW17, 266 RCV_TLG, 153
%SW18, 266 READ_ASYN, 157
%SW19, 266 READ_GDATA, 161
READ_VAR, 171
Report, 32
Numerics SEND_REQ, 185
100MSCOUNTER, 266 SEND_TLG, 201
1RSTTASKRUN, 264 UNITE_SERVER, 217
WRITE_ASYN, 223
WRITE_GDATA, 227
A WRITE_VAR, 241
ADDR, 43 Conditional FFB Call, 19
Address conversion constant word, 191
ADDR, 43 Continuous register reading
CREAD_REG, 49
Continuous register writing
B CWRITE_REG, 57
Block types, 14 CREAD_REG, 49
CWRITE_REG, 57
33002527 285
Index
D Extensions
ADDR, 43
DATA_EXCH, 65
CANCEL, 45
Assisted entry, 69
DATA_EXCH, 65
Example, 71
INPUT_BYTE, 75
Derived function block, 14
INPUT_CHAR, 79
OUT_IN_CHAR, 137
E PRINT_CHAR, 145
RCV_TLG, 153
Elementary Function, 14 READ_ASYN, 157
Elementary function block, 14 READ_GDATA, 161
EN, 18 READ_VAR, 171
ENO, 18 SEND_REQ, 185
Error Codes, 253 SEND_TLG, 201
Error Values, 253 UNITE_SERVER, 217
ETY WRITE_ASYN, 223
constant word, 191 WRITE_GDATA, 227
Example, 48, 143 WRITE_VAR, 241
Exchanging data between applications
DATA_EXCH, 65
Expanded F
ModbusP_ADDR, 131
FLOATSTAT, 266
SYMAX_IP_ADDR, 207
Extended
CREAD_REG, 49 I
CWRITE_REG, 57
Immediate server
MBP_MSTR, 87
UNITE_SERVER, 217
READ_REG, 163
INDEXOVF, 264
TCP_IP_ADDR, 211
INPUT_BYTE, 75
WRITE_REG, 231
INPUT_CHAR, 79
Assisted entry, 83
Example, 85
IOERRTSK, 261
L
Located variables
Communication, 26
286 33002527
Index
M Reading object
Shift in a table, 200
Management parameters, 32
Reading variables
Management table, 32
READ_VAR, 171
MBP_MSTR, 87
Receiving character strings
Modbus Plus Address
INPUT_BYTE, 75
ModbusP_ADDR, 131
INPUT_CHAR, 79
Modbus Plus Master
Receiving telegrams
MBP_MSTR, 87
RCV_TLG, 153
ModbusP_ADDR, 131
Report, 32, 34
ROR1_ARB
O with SEND_REQ, 200
OSCOMMPATCH, 265
OSCOMMVERS, 265 S
OSINTVERS, 265
SEND_REQ, 185
OUT_IN_CHAR, 137, 143
Assisted entry, 195
Assisted entry, 141
Example, 197
OVERFLOW, 262, 263
SEND_REQ block
OVERRUN, 262, 263
IP parameters, 199
SEND_TLG, 201, 202
Example, 205
P Sending character strings
PRINT_CHAR, 145 PRINT_CHAR, 145
Assisted entry, 149 Sending requests
Example, 150 SEND_REQ, 185
Procedure, 14 Sending telegrams
SEND_TLG, 201
Sending/receiving character strings
R OUT_IN_CHAR, 137
RCV_TLG, 153 Server, 39
Example, 156 Shift in a table, 200
Read Register Stopping an exchange in progress
READ_REG, 163 CANCEL, 45
READ_ASYN, 157 STRINGERROR, 261
READ_GDATA, 161 Structure
READ_REG, 163 Communication function, 30
READ_VAR, 171 SY/MAX-IP Address
Assisted entry, 176 SYMAX_IP_ADDR, 207
Example, 178, 180 SYMAX_IP_ADDR, 207
Execution check, 184
Network example, 182
Reading data asynchronously
READ_ASYN, 157
Reading Modbus Plus Global Data
READ_GDATA, 161
33002527 287
Index
T W
TCP/IP address Write Register
TCP_IP_ADDR, 211 WRITE_REG, 231
TCP_IP_ADDR, 211 WRITE_ASYN, 223
Timeout, 38 WRITE_GDATA, 227
WRITE_REG, 231
WRITE_VAR, 241, 242
U Assisted entry, 245
Unconditional FFB Call, 19 Example, 247
UNI-TE requests, 190 Example of how to check execution, 249
UNITE_SERVER, 217 Writing data asynchronously
Example, 222 WRITE_ASYN, 223
UTWPORTADDR, 265 Writing the Global Data Modbus Plus
WRITE_GDATA, 227
Writing variables
WRITE_VAR, 241
X
XWAYNETWADDR, 265
288 33002527

11 Unity EN PDF

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

11 Unity EN PDF

Încărcat de

Drepturi de autor:

Formate disponibile

Unity Pro 2.

About the Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Part I General Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Chapter 1 Block types and their applications . . . . . . . . . . . . . . . . . . . . . . 13

Chapter 2 Availability of the modules on the various

Chapter 3 Operation of the communication EFs . . . . . . . . . . . . . . . . . . . . 23

Chapter 4 ADDR: Address conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Chapter 5 CANCEL: Stopping an exchange in progress . . . . . . . . . . . . . 45

Chapter 6 CREAD_REG: Continuous register reading . . . . . . . . . . . . . . 49

Chapter 7 CWRITE_REG: Continuous register writing . . . . . . . . . . . . . . 57

Chapter 8 DATA_EXCH: Exchanging data between applications. . . . . . 65

Chapter 9 INPUT_BYTE: Receiving character strings . . . . . . . . . . . . . . . 75

Chapter 10 INPUT_CHAR: Receiving character strings . . . . . . . . . . . . . . 79

Chapter 12 ModbusP_ADDR: Modbus Plus Address . . . . . . . . . . . . . . . . 131

Chapter 13 OUT_IN_CHAR: Sending/receiving character strings. . . . . . 137

Chapter 14 PRINT_CHAR: Sending character strings . . . . . . . . . . . . . . . 145

Chapter 16 READ_ASYN: Reading data asynchronously . . . . . . . . . . . . 157

Chapter 17 READ_GDATA: Reading Modbus Plus Global Data . . . . . . . 161

Chapter 18 READ_REG: Read register . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Chapter 19 READ_VAR: Reading variables . . . . . . . . . . . . . . . . . . . . . . . 171

Chapter 20 SEND_REQ: Sending requests . . . . . . . . . . . . . . . . . . . . . . . . 185

Chapter 21 SEND_TLG: Sending telegrams . . . . . . . . . . . . . . . . . . . . . . . 201

Chapter 22 SYMAX_IP_ADDR: SY/MAX IP Address. . . . . . . . . . . . . . . . . 207

Chapter 24 UNITE_SERVER: Immediate server . . . . . . . . . . . . . . . . . . . . 217

Chapter 25 WRITE_ASYN: Writing data asynchronously. . . . . . . . . . . . . 223

Chapter 26 WRITE_GDATA: Writing the Global Data Modbus Plus . . . . 227

Chapter 27 WRITE_REG: Write register . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Chapter 28 WRITE_VAR: Writing variables . . . . . . . . . . . . . . . . . . . . . . . . 241

Appendix A EFB Error Codes and Values . . . . . . . . . . . . . . . . . . . . . . . . . 253

Appendix B System objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

What's in this This part contains the following chapters:

What's in this This chapter contains the following topics:

Procedure Procedures are technical functions.

Formal call of a function block in the ST programming language:

MY_TON (EN:=ENABLE, IN:=EXAMP, PT:=TIME1, ENO=>ERROR, Q=>OUT, ET=>TIME2);

Actual parameters (inputs) Actual parameters (outputs)

Function block with VAR_IN_OUT variable in ST:

If EN from FunctionBlock_1 is set to "0", the output connection OUT from

If EN from FunctionBlock_1 is set to "0", the output connection OUT from

If EN from Function/Procedure_1 is set to "0", the output connection OUT

If EN from Function/Procedure_1 is set to "0", the output connection OUT

Expanded Availability of the modules:

What's in this This chapter contains the following sections:

3.1 General information on Premium and Atrium

What's in this This section contains the following topics:

Note: To perform inter-PLC transfers of unlocated variables, it is necessary to use

Communication functions on Premium and Atrium PLCs

Note: Communication functions are processed asynchronously with regard to the

Asynchronous A communication function is asynchronous when it is executed during one or several

Note: It is recommended that asynchronous functions be triggered on edge and

Synchronous A communication function is said to be synchronous when it is wholly executed

Structure of Premium and Atrium communication functions

At a Glance A communication function on Premium and Atrium PLCs uses:

Syntax The syntax of a communication function is as follows:

At a Glance This parameter indicates the exchange's destination device address.

Structure of the management parameters

Note: in technical documentation, these management parameters are also

Exchange When a communication function is sent, the system automatically allocates it a

Management Parameters: Communication and Operation Reports

Note: It is recommended that communication function reports always be tested at

Management parameters: length and Timeout

At a Glance You are responsible for these two parameters.

Launch of the function Activity bit = 1