PLC Communications Protocols

1. Modicon Modbus

a. Introduction

The "Modbus" network is a communication system that was originally intended to link
Modicon PLC's with intelligent terminals and computers. Since it was one of the first successful
open protocols it is now used as a virtual industry standard for a variety of applications including:
energy management, process control, production monitoring, and pipeline monitoring and control.

A Modbus network consists of a single master device (e.g. a computer, programmable

controller, or intelligent terminal), which initiates half-duplex communications with up to 247
slaves (often placed throughout a plant or in remote locations - note this value can be lower when
electrical loading restrictions occur). The network topology is normally a multi-drop bus, but
rings and stars are also possible.

The transmission media is flexible and can include twisted pair, telephone lines (voice
grade), radio, fiber optics, and baseband or broadband cable links. The chosen media and data
encoding technique (i.e.; voltage transitions, tones (modems), radio frequencies (radio), light
variations (fiber)) depends upon such factors as location of slave devices, building wiring, etc.
Twisted pair is typically used for local communications, with Modicon "Modbus modems"
attached to the wire, allowing for up to 32 devices and distances up to 15,000 ft. from the master
(electrical loading prevents more devices).

If the media is coax cable, telephone lines, or radio, a commercial modem is used to
encode the data into a form suitable for transmission on the chosen media.

b. Modbus Physical Layer Realization

Recall the physical layer specification defines media, topology, signaling methods, etc.
The following is a description of these details in the Modbus system.

Signal type: i) Bell 202 FSK (when modems used)

ii) IEEE RS-232, 485, or 422 baseband signaling

Topologies: Buses, Stars, Daisy chain rings.

Media: Twisted pair, Co-Ax, Radio, Fiber Optic.

Data Frames: Individual bytes are transmitted as asynchronous frames

NAIT #1380 PLC Protocols 15­1

b. Modbus Data Link Layer

Network Access Method: Master/Slave or Polling.

Message Frame Format: The Modbus protocol defines two message frame formats: ASCII
frames and RTU frames. Both message frames transmit the same information, but they differ in
the way error detection is done and in the way consecutive frames are differentiated from each
other. Both methods use the same core frame as shown below:

i. ASCII Message Frames consist of 6 fields of information as shown below. All

the data in every field is in the form of ASCII coded characters.

READY
BEG OF ERROR TO REC
FRAME ADDRESS FUNCTION DATA CHECK EOF RESP

: 2-CHAR 2-CHAR N X 4-CHAR 2-CHAR

16-BITS 16 BITS N X 16-BITS 16-BITS CR LF

: (colon) Denotes the Beginning of a message frame;

Addr Address (or station number) of the slave The valid range of slave addresses is 1 to
247..

Function: a command code. Refer to the application layer for a list of these.

Data: The information transmitted to the slave from the master or vice versa.

Checksum: Block check character formed by adding up the ASCII codes of the ADDR,
Function and data fields, and then two's complementing the sum.

CR/LF: Carriage Return/Line Feed denotes the end of the message frame.

NAIT #1380 PLC Protocols 15­2

ii. RTU Format Frames carry the same information as the ASCII format frames but the data
is transmitted as 8 bit binary numbers instead of ASCII codes. An RTU Format message frame is
diagrammed below.

T1 T2 T3 ADDRESS FUNCTION DATA CHECK T1 T2 T3

8-BITS 8-BITS N X 8-BITS 16-BITS

Note that the frame format is similar to the ASCII message frames except for the
following differences:

3T = 3 byte times of no transmission. This is the only separator between consecutive frames.

CRC: This is a CRC-16 block check character.

In a given network, mode mixing is illegal. The choice of which frame format to use is
based on an analysis of the advantages and disadvantages of the message types. ASCII is
convenient for troubleshooting and is well suited to masters programmed in high-level languages
such as FORTRAN, whereas RTU format frames are more efficiently transmitted and may be
more convenient for computers programmed in machine or C-level languages. In ASCII mode,
the values 0-F hex are represented with their 7 bit ASCII codes, whereas RTU mode uses binary
(only 4 bits are required to represent a value between 0 and F); because of this, it takes longer to
send info between devices using ASCII mode.

Advantages for RTU Format:

- better error detection

- more efficient

Advantages for ASCII Format:

- simpler to produce
- easier to troubleshoot

NAIT #1380 PLC Protocols 15­3

c. ModBus Applications Layer

Since ModBus is a master/slave network, there are two types of messages: query
(command)/response, and broadcast.

Query/Response messages are dialogs between the master and only one of the slaves. These
messages must have a slave addresses between 1 and 247. Slaves will always respond to a
command by transmitting a response message consisting of:
n the slave address (informing the master from where the message is coming);
n the action performed (The original command code);
n the data acquired as a result of executing the command;
n and an error check character.

Broadcast messages are transmitted from the master to all of the slaves. These messages are
contain an address of 0 to denote a message for all of the slaves. The slaves do not transmit a
response to broadcast messages.

The commands defined by this layer of the protocol are ones which are intended to get
information into or out of a PLC. As a result, they refer heavily to features found on PLC's. A
partial glossary of ModBus commands appears below.

Code Meaning Action

01 Read coil status Obtains current status (on/off) of a group of logic coils
02 Read input status Obtain current status (on/off) of a group of discrete inputs
03 Read holding registers Obtains current binary value in one or more holding
registers
04 Read input registers Obtains current binary value in one or more input
registers
05 Force single coil Force logic coil to a state of ON or OFF
06 Preset single register Place a specific binary value into a holding register
07 Read exception status Obtain the status (on/off) of the 8 internal coils whose
addresses are controller dependent. User logic can
program these coils to indicate slave status. Short
message length allows rapid reading of status.
15 Force multiple coils Forces a series of consecutive logic coils to defined on or
off states
16 Preset multiple registers Places specific binary values into a series of consecutive
holding registers

NAIT #1380 PLC Protocols 15­4

Exception Responses

Certain error conditions can be flagged by a slave, and result in the transmission of an "exception
response", which is indicated by the slave setting the high order bit of the function code field of
the response frame. An error code from the list below, will be found by the master in the data
field of the response frame:

Code Name Meaning

01 Illegal function The message function received is not an allowable 
action for addressed slave. If a poll command was 
issued, indicates no program function preceded it.
02 Illegal data address The address referenced in the data field is not an 
allowable address for the addressed slave location.
03 Illegal data value The value referenced in the data field is not allowable 
in the addressed slave location.
04 Failure in associated  The slave’s PC has failed to respond to a message or 
device an abortive error occurred.
05 Acknowledge The slave PC has accepted and is processing the long 
duration program command. Issue a POLL 
PROGRAM COMPLETE message to find out when 
processing is finished. A poll message sent to the PC 
before it is finished will result in a rejected message 
response.
06 Busy, rejected message The message was received without error, but the PC is 
engaged in processing a long duration program 
command. Retransmit later, when the PC may be free.

NAIT #1380 PLC Protocols 15­5

Introducing the Modbus Plus Network

Modbus Plus Applications

 Modbus Plus is a local area network system designed for industrial control applications. 
 Each network supports up to 64 addressable node devices, at a data transfer rate of 1,000,000
bits/s.
 Applications include transferring of process control and supervisory messages.
 Modbus Plus provides host level peer­to­peer communication for the network devices. 
 Modicon host products include a variety of programmable controllers and network adapters. 
 The network also provides distributed input/output (DIO) communications, in which 
Modicon controllers communicate directly with input/output subsystems.
 Each Modicon controller supports one network directly from its Modbus Plus port. By 
adding Network Option Modules, up to two additional networks can be configured to extend 
I/O communications in the user's application.
 The network bus uses either a single­cable or dual­cable layout.Dual­cable layouts offer 
increased protection against cable faults or noise bursts on either cable path, by continuing to 
process error­free messages on the alternate path.

Extending the Network

 Up to 32 node devices can connect directly to the network bus cable over a length of 1500 ft 
(450 meters). 
 Repeater devices are used to extend the cable distance to its maximum of 6000 ft (1800 
meters), and the node count to its maximum of 64.

Bridging Networks

 Host level networks can be joined through Bridge Plus devices. Messages originated at a 
node on one network can be routed through one or more bridges to a destination node on 
another network. This facilitates the design of time­critical applications in which each 
network employs only the devices required for timing of the local process. Messages are 
passed through bridges to other networks as needed.
 Modbus and custom serial devices can join Modbus Plus through Bridge Multiplexers. The 
Bridge Multiplexer provides four serial ports that are separately configurable to support 
Modbus or custom RS232 / RS485 devices. Serial devices can communicate with Modbus 
Plus networked devices, as well as with devices at the other serial ports.

NAIT #1380 PLC Protocols 15­6

Network Example

 The following figure is a block diagram showing four Modbus Plus networks. 
 Networks A and B are host level networks joined by a Bridge Plus device. 
 Networks C and D are DIO networks using Network Option Modules (NOMs). 
 Each DIO drop site connects to its network through a Modbus Plus DIO Adapter.

NAIT #1380 PLC Protocols 15­7

 Network Overview

NAIT #1380 PLC Protocols 15­8

  The following figure shows the token sequences in two networks joined by a Bridge Plus.

NETWORK 1

TOKEN SEQUENCE 2 - 5 - 10 - 12 - 22 - 2 ...

2 12 10 5
22 REPEATER REPEATER
NODE NODE
NODE NODE
BRIDGE
PLUS

24

5 10 4 9

REPEATER REPEATER
NODE NODE
NODE NODE

TOKEN SEQUENCE 4 - 5 - 9 - 10 - 24 -4 ...

NETWORK 2
Token Rotation Sequence

Overview of the Physical Network
 The network bus consists of twisted­pair shielded cable that is run in a direct path between 
successive nodes. The two data lines in the cable are not sensitive to polarity, however a 
standard wiring convention is followed in this guide to facilitate maintenance.
 The network consists of one or more cable sections, with any section supporting up to 32 
nodes at a maximum cable distance of 1500 ft (450 m). Sections can be joined by Repeaters 
to extend the network length and to support up to 64 nodes.
 The minimum cable length between any pair of nodes must be at least 10 ft (3 m). The 
maximum cable length between two nodes is the same as the maximum section length of 
1500 ft (450 m).
 On dual­cable networks, the cables are known as cable A and cable B. Each cable can be up 
to 1500 ft (450 m) long, measured between the two extreme end devices on a cable section. 
The difference in length between cables A and B must not exceed 500 ft (150 m), measured 
between any pair of nodes on the cable section.

NAIT #1380 PLC Protocols 15­9

 Nodes are connected to the cable by means of a tap device, supplied by Modicon. This 
provides through connections for the network trunk cable, drop connections for the cable to 
the node device, and a grounding terminal.
 The tap also contains a resistive termination that is connected by two internal jumpers. The 
tap at each end of a cable section requires both of its jumpers to be connected to prevent 
signal reflections. All of the taps that are inline on the cable section require their jumpers to 
be removed (open).

NE TW O R K NE TW O R K
TR UN K TR UNK
C ABLE C ABLE

C ABLE TAP SHOWN

T IE WITH
T E R M IN A T IO N COVER OPEN
JU M P E R S (2 )
---
E N D S IT E S : C O N N E C T E D G RO UND
T O P IN S A T O P P O S IT E S ID E DROP W IR E
FR O M TR U N K C ABLE E NTR Y C ABLE
--- TO N O D E
IN L IN E S IT E S : O P E N
Cable Tap Layout

 The previous figure illustrates a tap at an inline site. Two lengths of trunk cable are installed. 
When a tap is installed at the end site of a cable section, only one length of trunk cable is 
routed to the tap. It can enter at either side of the tap. The jumpers are connected to the signal
pins at the opposite side of the tap to provide the network termination.

 The figure below summarize the layout for one section of a network.

U p T o 3 2 N o d e s M a x ., 1 5 0 0 ft ( 4 5 0 m ) C a b le M a x .

1 0 ft ( 3 m ) C A B L E M IN .

END INLINE INLINE END

NODE NODE NODE NODE

= JU M P E R S C O N N E C T E D = J U M P E R S D IS C O N N E C T E D

NAIT #1380 PLC Protocols 15­10

 Section Physical Layout (Single Cable)

NAIT #1380 PLC Protocols 15­11

Reading and Writing with the MSTR Function

The MSTR instruction is a ladder logic function that provides access to the Modbus Plus
network. Its format is shown in the following figure.

SUMMARY OF MSTR OPERATIONS

CONTROL BLOCK 1 WRITE
ENABLE ACTIVE
(4x) 2 READ
3 GET LOCAL STATISTICS
DATA AREA START 4 CLEAR LOCAL STATISTICS
ABORT (4x) ERROR 5 WRITE GLOBAL DATABASE
6 READ GLOBAL DATABASE
MSTR 7 GET REMOTE STATISTICS
DATA AREA SIZE COMPLETE 8 CLEAR REMOTE STATISTICS
(n) 9 PEER COP HEALTH

MSTR Function Format

 A complete description of how you can program your application using the MSTR is provided
in the Modicon Ladder Logic Block Library User Guide. This overview will assist you in
following the sample communication on the next page.
 The Control Block is a 4x reference that is the starting register in a block of nine consecutive
registers. These registers define the intended actions and Modbus Plus routing for the
communication. Their contents are unique for each type of operation.

Configuration screen for MSTR instruction

NAIT #1380 PLC Protocols 15­12

For example, in a data Read or Write operation, the Control Block layout is as follows for the
Modbus Plus Network Node Transaction:

Register Content
4x Operation Type 1  =  Write
2  =  Read
4x + 1 Storage for Returned Error Status Code (if an error occurs)
x + 2 Data Block Length
4x + 3 Start of the Data Area in the Destination Device
4x + 4 Modbus Plus Routing Path 1
4x + 5 Modbus Plus Routing Path 2
4x + 6 Modbus Plus Routing Path 3
4x + 7 Modbus Plus Routing Path 4
4x + 8 Modbus Plus Routing Path 5

 The Control Block register at 4x + 2 specifies the length of the data area for the read or write
operation. For example, if this register contains a value of 32 decimal, that many registers of
data will be transferred in the operation.
 The Control Block register at 4x + 3 defines the starting location of the data buffer in the
destination device. Its contents are an offset value (not an absolute address). For example, a
value of 1 specifies reference 400001 in a programmable controller. The offset can be
incremented in successive MSTR operations to move large areas of data.
 Data Area Start is a 4x reference that is the starting register in a block of up to 100
consecutive registers that will be used as the local data buffer in the Read or Write. If the
operation is a Read, the incoming data from the destination device will be stored into this
buffer. For a Write, the buffer contents will be sent to the destination device.
 Data Area Size is an absolute value in the range 1 ... 100 decimal. It specifies the maximum
quantity of registers to be allocated for the MSTR function's data area.

NAIT #1380 PLC Protocols 15­13

 For example, in a data Read or Write operation, the Control Block layout is as follows for the
MSTR: TCP/IP Node Transaction:

Register Content
4x Operation Type 1  =  Write
2  =  Read
4x + 1 Storage for Returned Error Status Code (if an error occurs)
4x + 2 Data Block Length
4x + 3 Start of the Data Area in the Destination Device
4x + 4 Map Index (0 for our purposes)
(Refer to Modicon Documentation for further information)
4x + 4 Slot address for NOE card ( slot 3 for our purposes)
4x + 5 IP Address B4 (i.e. 192)
4x + 6 IP Address B3 (i.e. 0)
4x + 7 IP Address B2 (i.e. 0)
4x + 8 IP Address B1 (i.e. 71)

NAIT #1380 PLC Protocols 15­14

2. Allen-Bradley's Data Highway

The DATA HIGHWAY is a local area network that connects ALLEN-BRADLEY programmable
logic controllers and other intelligent devices (computers and terminals) together for
communication purposes.

Allen-Bradley has several industrial network products. Two of these are:

1) The Data Highway (DH)

2) The Data Highway Plus (DH+)

Both of these networks can connect up to 64 stations together using token passing. The topology
for it can be bus or ring with a maximum distance of 10,000 ft. The communications can be as fast
as 57.6 kBaud.
Stations on the Data Highway communicate by sending one of two message types over the
highway:
i. command messages;
or ii. Reply messages

A command message either writes data to, or requests data from, one of the stations on the LAN
while a reply message is the response from a station to a command. For example, communication
between a terminal or computer, and a PLC on the highway, consists of a command message from
the computer/terminal, and a reply message from the specified PLC station.

The networks implement the top layer and the bottom three layers of the ISO/OSI model.
They are the application layer, the network layer, the data link layer and the physical layer. A
description of how this networks implement the various layers is explained as follows.

a. Data Highway Application Layer:

- this layer handles the command vocabulary

- PLCs initiate communications using ladder program message (MSG) instructions.

Details of this instruction appear at the end of this article.

A transmitting station (Master) uses a MSG instruction to create a message packet as shown
below. This packet will then be given to the "Network Layer" (discussed later). A receiving
(slave) station creates the reply packet, which includes certain info from the original command
packet, fills in reply data, and submits this packet to its own network layer for transmission.

In both cases, the packet will ultimately be imbedded in the data link layer packet (will be
discussed later) for transmission or reception on the network.

The application layer packet for commands is shown below. Replies are similar. Note that it
consists of several fields, some of which are not always required (FNC, ADDR, DATA):

CMD STS FNC ADDR DATA

NAIT #1380 PLC Protocols 15­15

 Application Layer Packet

The CMD (command) and FNC (if required-function) fields identify the type of command, where
commands generally perform functions from the list below:
- download/upload processor memory.
- program the processor of the PLC.
- edit the PLC ladder program
- see AB documentation for detailed info!

the STS (status) field contains a code used to indicate whether command transfer was successful
between stations

the ADDR (address) field specifies the address IN the remote stations memory (when required)

the DATA field contains information sent from one station to another when required ( i.e.some
commands as well as replies do not require this field)

b. Network Layer: provides for message routing between stations

The protocol defines a frame which includes information from the application layer as
illustrated below (for commands - replies are nearly identical):

CMD STS FNC ADDR DATA

DST SRC CMD STS TNS DATA (From Application layer)

Network Layer Packet

DST (destination) specifies receiving station addr

SRC (source) specifies transmitting station addr

CMD includes the CMD field from the Application Layer, plus bits defining whether this frame is
a command or reply

STS - status; as for application layer

TNS (transaction): a 16 bit value used to enable the command initiator to associate an incoming
reply with the proper previously issued command

DATA consists of information from application layer as shown in (a).

NAIT #1380 PLC Protocols 15­16

 c. Data Link Layer: provides for error checking and recovery (i.e.; such as
requesting data re-transmission)

The network layer packet is "framed" by the data link layer; one possibility is illustrated
below (exact frame construction varies depending on whether the data link layer uses either half,
or full duplex, and whether this is a master or slave issued frame).

DST SRC CMD STS TNS DATA (From Application layer)

DLE SOH STN DLE STX Network Layer Packet DLE ETX BCC

Data Link Layer Packet

This frame includes several ASCII control characters:

SOH - start of header ENQ - enquiry

STX - start of text ACK - acknowledge
ETX - end of text DLE - data link escape
EOT - end of transmission NAK - negative acknowledge

a) DLE SOH - indicates start of packet

b) STN (station) - used for identifying stations

c) DLE STX - indicates start of network layer packet

d) DLE ETX - indicates end of network layer packet

e) BCC - (block check character) - from 00-FF - formed by adding all bytes in network
packet (truncated to 8 bits), then 2's complementing result

NAIT #1380 PLC Protocols 15­17

 d. Physical Layer

Topology: Multi-drop Bus. The following diagram illustrates a typical network.

Medium: twin axial cable - maximum length 10000 feet

PLC 5 PLC 2 PLC 5 Terminal

Gateway
or PLC 5 PLC 5 PLC 5
Bridge

Data Speed: 57.6 kBPS

The following pages from the PLC-5 Instruction Set Reference manual indicate how to use the
MSG instruction to initiate communicationn between Allen Bradley PLC's.

NAIT #1380 PLC Protocols 15­18

Message Instruction MSG (Allen­Bradley PLCs)

Using the Message Instruction
The message instruction (MSG) is used to read or write a block of data to another station on the 
DH+ link, to an attached Control Coprocessor, to the VMEbus using the PLC­5/V40, or to 
another node on an Ethernet network. You program the MSG instruction in ladder logic.

The MSG instruction over the DH+ can communicate with PLC­2, PLC­3, PLC­5, PLC­5/250, 
and SLC 5/03 and 5/04 processors on local or remote links.

MSG
Message (MSG) EN
SEND/RECEIVE MESSAGE
Control Block
DN

ER
Description:

The MSG instruction transfers up to 1000 elements of data (120 words using Control
Coprocessor); the size of each element depends on the data table section you specify and the type
of message command you use. For example, one binary element contains one 16-bit word and one
floating point element contains two 16-bit words.

The MSG instruction transfers data in packets. Each DH+ data packet can contain up to 120 
words. If your message transfer contains more words than fit in one packet, the transfer requires 
more than one packet of transfer data. The more packets of data to transfer, the longer the 
transfer takes. Over Ethernet each packet can be up to 709 words, thus making it a more efficient
networking option.

NAIT #1380 PLC Protocols 15­19

Entering Parameters

Specify a control block address when you first enter the MSG instruction. The control block is 
where all of the information relating to the message will be stored. After entering the control 
block, the programming terminal automatically displays a data entry screen, from which you 
enter instruction parameters that are stored 
at the control block address. You can also use the data monitor screen for the MSG instruction to
edit selected parameters.

Control Block Address

With Classic PLC­5 processors, use an integer file (N) without the # symbol for the message 
control block. For example N7:0 is a valid MSG control block address.

If You Have this Processor: Use this Control Block Address:
Classic PLC­5 an integer file (N) without the # symbol for the message
control block. Example: N7:0
PLC­5/11, ­5/20, ­5/20, ­5/20E,  an integer file or the message (MG) file type to access 
­5/30, ­5/40, ­5/V40, ­5/V40E,  the message control block for DH+ transfers.
­5/60, ­5/80, ­5/80E, ­5/V80 Example: MG10:0

Using the MG control block, the control block size is 
fixed at 56 words. This size is displayed on the screen 
in the BLOCK SIZE field. You must use the MG 
control block if you are sending messages to an SLC­
500 processor using the SLC read and write commands,
or if you are sending message out any port other than 
channel 1A.

Important: You cannot use indirect addresses for the control block address in an MSG 
instruction. 

The control block size varies according to the length of the message; if you communicate with a 
PLC­2 processor, the control file will be approximately 11 or 12 words. If you communicate 
with a PLC­3, PLC_5 or PLC­5/250 processor, the control file will be approximately 11 to 15 
words. This size is displayed on the screen in the BLOCK SIZE field.

For Enhanced PLC­5 processors, you can use an integer file or message (MG) file type to access 
the message control block for DH+ transfers. For example, MG10:0 is a valid MSG control 
block address for Enhanced PLC­5 processors. Using the MG file type, the control  block size is 
fixed at 56 words; this size is displayed on the screen in the BLOCK SIZE field.
MSG Data Entry Screen

After you enter the control block address for a MSG instruction, the programming software 
automatically displays the MSG Data Entry screen for the appropriate data type.

For an MG Control Block

Select the field for the data you want to modify. You can specify the following MSG parameters 
from the Data Entry screen:
This PLC­5 Specifies this Information:
Communicator Command Whether the MSG instruction performs a read or write operation and to what type of
processor the message is going to.
Data Table Address The data file address of the processor containing the message instruction. If the 
MSG operation is write, this address is the starting word of the source file. If the 
MSG operation is read, this address is the starting word of the destination.
Size in Elements The number of elements (1­1000) to be transferred.
Port Number The channel for message communications. Valid options are: 0, 1A (default), 1B, 
2A, 2B, and 3A for the ASCII command.
Target Device
Data Table Address The starting address of the source or destination file in the target processor.
Local Node The local station address on the DH+ (0­77 octal).

If you communicate with other processor on the local link, this address is the 
address of the target station on the local link.

If you communicate with a target station on a remote link, this address is the station 
number of the communication adapter module that bridges the data highway.
Local/Remote LOCAL: the message is sent to a device on the local DH+ link.
REMOTE: the message is sent through a bridge (DH, DH II, etc) to another DH+ 
link.

If you select REMOTE, the function keys – Remote Station, – Link ID, and – 
Remote Link are active.
Remote Link Toggles through DH, DH II and other choices for what connects the remote link to 
the local DH+.
Remote Station The DH or DH II address (1­376 octal) of the target station.

PLC­2 and PLC­3 processors require communication adapter modules (1771­KA2 
and 1771­KA, respectively) when they operate as stations on data highway. In these 
configurations, the remote station address is the address of the communication 
adapter module.
Remote Link Bridge ID The remote link where the processor you want to communicate with resides. The 
default is 0.
Using Status Bits

The MSG instruction uses the following status bits:

Attention: Do not modify any status bits while the instruction is enabled. Unpredictable machine
operation could occur with possible damage to equipment and/or injury to personal.

Important: The bit labels (.EN, .ST,.CO, etc.) can only be used with the message file type 
(MG). For use with an integer (N) type data file, use the bit number. For example, if N7:0 is the 
control address, N7:0/12 is the error bit.

This Bit: Is Set:
Enable .EN (bit 15) when the rung goes true.

This bit shows that the instruction is enabled (that the instruction 
is being executed).

Start .ST (bit 14)
Done .DN (bit 13)
In non­continuous mode, .EN bit remains set until the message is 
completed and the rung goes false. In continuous mode, once .EN 
bit is set, it remains set regardless of the rung condition.
when the processor begins executing the MSG instruction. The 
.ST bit is reset when the .DN bit or .ER bit is set.
when the last packet of the MSG instruction transferred. The .DN 
bit is reset the next time the associated rung goes from false to 
true.

Error .ER (bit 12)
Continue .CO (bit 11)
Enable­Waiting .EW (bit 10)
No Response .NR (bit 09)
Time Out .TO (bit 08)
The .DN bit is only active in non­continuous mode.
when the processor detects that the message transfer failed. The 
.ER bit is reset the next time the associated rung goes from false to
true.
manually for repeated operation of the MSG instruction after the 
first scan, independent of whether the processor continues to scan 
the rung. Reset the .CO bit if you want the rung condtion to 
initiate messages (return to non­continuous mode).
when the processor detects that a message request entereed the 
queue. The processor rests the .EW bit when the .ST bit is set.
if the target processor does not respond to the first MSG request. 
The .NR bit is reset when the associated rung goes from false to 
true.
If you set the .TO bit through ladder logic, the processor stops 
processing the message and sets the .ER bit (timeout error 55). A 
message will automatically time out in 30­60 seconds.
Attention: The processor controls status bits .ST and .EW asynchronously to the program scan. 
If you examine these bits in ladder logic, copy the status to a storage bit whose status is 
synchronized with the program scan. Otherwise, timing problems may invalidate your program 
with possible damage to equipment or injury to personnel.

Using the Control Block 
In addition to the status bits, the control block contains other parameters the processor uses to 
control message instructions. The following table lists these values.

Word – Integer Message Control Description

Control Block Block
0 .EN thru .RW Control bits
1 .ERR Error code
2 .RLEN Requested length
3 .DLEN Done length
4 Internal data

Error Code (.ERR)

This is where the processor stores the error code if a problem occurs during message 
transmission. A list of error codes is presented in a later table.
Requested Length (.RLEN)

This is the requested amount of elements that the user wishes to transfer with the message 
instruction.

Transmitted Length (.DLEN)

This is the number of elements the module actually transferred after the instruction completes 
execution. This number should match the requested length.
Entering Parameters

Communication Command

The following table describes the available communication commands.

Important: The PLC­5 Typed Write to SLC and PLC­5 Typed Read from SLC commands are 
accessible only with release 5.0 and later programming software.

If You Want the Instruction to: Select this Command:
Read data identified by a type code. This command reads data structures  PLC­Typed Read
without you specifying the actual word length. For example, if you choose a 
typed read of the PLC­5 timer data section with a requested data size of 5 
elements, the MSG instruction reads 15 words (5 timer structures of 3 words 
each).
Write data identified by a type code. This command writes data structures  PLC­5 Typed Write
without you specifying the actual word length.
Read 16­bit words from any area of the PLC­2 data table or PLC­2  PLC­2 Unprotected Read
compatibility file.
Write 16­bit words to any area of the PLC­2 data table or PLC­2  PLC­2 Unprotected Write
compatibility file.
Read a range of words, starting at the address specified for the external  PLC­3 Word Range Read
address in the MSG control file and reading sequentially the number of 
words specified for the requested size filed in the MSG control file. The data 
that is read is stored, starting at the address specified for the internal address 
in the MSG control file.
Write a range of words, starting at the address specified for the internal  PLC­3 Word Range Write
address in the MSG control file and writing sequentially the number of words
specified for the requested size filed in the MSG control file. The data from 
the internal address is written, starting at the address specified for the 
external address in the MSG control file.
1
The PLC­5 is limited to a maximum message of 103 words (206 bytes). The maximum message size for SLC 5/03 and SLC 5/04 processors
is 103 words (206 bytes). The maximum message size capability of all other SLC 500 processors is 41 words (82 bytes)
2
These commands are valid only with any SLC 5/04 and SLC 5/03 series C and later processors.
3
These commands are only valid with processors listed in the table on the first page of this module.

You can use the Typed Read and Typed Write commands to transfer data table sections without 
counting the actual words per data table element. You only have to specify the number of 
elements you want to transfer. For example, in the data table section, one element contains 3 
words, but in the binary data table section, one element contains one word.
Selecting Continuous Operation

Continuous mode lets you use multiple message transfers by programming only one MSG
instruction (with no input conditions on the rung). Once the continuous message transfer
starts, the transfer is continuously executed, independent of whether the processor continues
to scan the associated rung and independent of the rung condition. To enable continuous
operation, set the .CO bit.

Continuous mode works as follows:
1. When the rung that contains the MSG instruction goes true, the processor initiating 
the MSG instruction sets the .EN bit. The processor also resets the .ER bits. 
2. The processor then queues the message request. When the message request enters the 
queue, the processor sets the .EW bit.
3. When the processor starts to process the message request, the processor sets the .ST 
bit. The next time the processor receives network control, the processor transmits the 
message.
4. If an error occurs, the processor sets the .ER bit and stores an error code in the lower 
byte of word 0 of the control block for Classic PLC­5 processors and word 1 of the 
control block for Enhanced PLC­5 processors.

Important: The following figure is appropriate for Enhanced PLC­5 processors only. You can 
EN

EW

ST

CO

ER

Rung true Data sent by Instruction Instruction Next rung Rung false Rung true
instruction begins finishes with instruction
and received execution executes
in the queue

reset Classic PLC­5 processors by toggling the error or enable bits.

Timing Diagram for Status Bits in Continuous MSG Instructions
A continuous message transfer continues as long as the processor stays in Run or Test mode. If 
you switch to Program mode or the processor faults, the message transfer stops and will not start 
again until the processor scans the rung that contains the MSG instruction.

To stop continuous operation, reset the .CO bit.
Selecting Non­Continuous Operation
Non­continuous mode performs the message transfer one time for each false­to­true transition of 
the rung that contains the MSG instruction. Non­continuous operation occurs as long as the .CO 
bit remains reset. Use non­continuous mode when you want to control when the message transfer
occurs or the number of times the message transfer occurs.

Non­continuous mode works as follows (Note the following timing diagram)

1. When the rung that contains the MSG instruction goes true, the processor initiating the 
MSG instruction set the .EN bit. The processor also resets the .DN and .ER bits.

2. The processor then queues the message request. When the message requests enters the 
queue, the processor sets the .EW bit.

3. When the processor starts to process the message request, the processor sets the .ST bit. 
The next time the processor receives network control, the processor transmits the message.

4. If no errors occur during transmission, the processor sets the .DN bit after the last packet 
in the first execution of the MSG instruction transfers. If an error occurs, the processor sets the 
.ER bit and stores an error code in the lower byte of word 0 of the control block for Classic PLC­
5 and word 1 of the control block for Enhanced PLC­5 processors.

5. The next time the rung goes false, the processor goes false, the processor resets the .EN 
bit. Then when the associated rung goes true again, the message transfer cycle starts again.

Timing Diagram for Status Bits in Non­Continuous MSG Instructions
EN

EW

ST

CO

DN

ER

Rung true Data sent by Instruction Instruction Next rung Rung false Rung true
instruction begins finishes with instruction
and received execution executes
in the queue
MSG Timing
The time required for one PLC­5 processor to send or receive a message to/from another 
processor on the DH+ link depends on the number of:

 stations on the DH+ link
 messages transmitted from active stations
 bytes of data of all transmitted messages
 message requests already in the queue

Timing starts with setting the enable bit and ends with setting the done bit in the ladder program 
of the station initiating the message. The order of operation is shown in the following table.

Receiving MSG Sending MSG
(Station A reading/receiving from Station B) (Station A writing/sending to Station B)
station A enables the message instruction in the ladder  station A enables the message instruction in the 
program ladder program
station A obtains the token and transmits the read  station A obtains the token and transits data 
command (station B acknowledges immediately) (station B acknowledges immediately)
station B obtains the token and transmits requested data station B stores the data in memory
station A receives the data and acknowledges  station B obtains the token to respond that the 
immediately write is complete
station A sets the done bit station A set the done bit when it receives a 
response
You can estimate the time (in milliseconds) for transmitting one packet over DH+ using the 
following formulas:

Processor Type: Formula:
Classic PLC­5 Message time = TP + TT + OH + P + 8 (number of 
messages)
Enhanced PLC­5 Message time = TP + TT + OH + 8 (number of messages)

where:
TP = token pass = (1.5)(1 + number of stations on DH+ link)

TT = transmission time = (0.28)(number of data words)
Number of data words in all transmitted messages for one token pass around the 
DH+ link.

OH = DH+ overhead = 20ms
 P = longest program scan for any processor on the DH+ link (application value in 
milliseconds)

See the PLC­5VMEbus Programmable Controllers User Manual, and the Ethernet PLC­5 
Programmable Controllers manual for performance numbers and benchmarks.
Error Codes 

When the processor detects an error during the transfer of message data, the processor sets the 
.ER bit and enters an error code that you can monitor from your programming terminal. If the 
message is non­continuous, the processor sets the .ER bit the first time the processor scans the 
MSG instruction.

Enhanced Classic Description (Displayed on the Data Monitor screen):

PLC­51 PLC­52
0002 2 link layer timed out or received a NAK
0003 3 duplicate token holder detected by link layer
0004 4 local port id disconnected
0005 5 application layer timed out waiting for a response
0006 6 duplicate node detected
0007 7 station is off line
0008 8 hardware fault
0037 55 message timed out in local processor
0089 137 processor’s message buffer is full
0092 146 no response (regardless of station type)
0500 1280 application layer timed out waiting for response
1000 129 illegal command from local processor
2000 130 communication module not working
3000 12288 remote node is missing, disconnected, or shut down
0083 131 processor is disconnected
4000 132 processor connected but faulted (hardware)
5000 133 you used the wrong station number
6000 134 requested function is not available
7000 135 processor is in program mode
8000 136 processor’s compatibility file does not exist
9000 36864 remote node cannot buffer command
00D3 211 you formatted the control block incorrectly
00D5 213 incorrect address for the local data table
B000 139 processor is downloading so it is inaccessible
F001 231 processor incorrectly converted the address
F002 232 incomplete address
F003 233 incorrect address
F006 236 addressed file does not exist in target processor
F007 237 destination file is too small for number of words requested
F00A 240 target processor cannot put requested information in packets
F00B 241 privilege error, access denied
F00C 242 requested function is not available
F00D 243 request is redundant
F011 247 data type requested does not match data available
F012 248 incorrect command parameters
IET 440 7 - 35 PLC Networks