LOGIX5000 Data Access

Logix5000 Data Access
Catalog Numbers 1756 ControlLogix, 1756 GuardLogix,

1768 CompactLogix, 1768 CompactLogix, 1769 CompactLogix,
1789 SoftLogix, 1794 FlexLogix
Programming Manual
Important User Information

Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety Guidelines
for the Application, Installation and Maintenance of Solid State Controls (publication SGI-1.1 available from your local Rockwell
Automation sales office or online at http://www.rockwellautomation.com/literature/) describes some important differences
between solid state equipment and hard-wired electromechanical devices. Because of this difference, and also because of the
wide variety of uses for solid state equipment, all persons responsible for applying this equipment must satisfy themselves that
each intended application of this equipment is acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use
or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software
described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is
prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNING
Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property damage, or economic loss.
IMPORTANT
Identifies information that is critical for successful application and understanding of the product.
ATTENTION
Identifies information about practices or circumstances that can lead to personal injury or death, property damage,
or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence
SHOCK HAZARD
Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may
be present.
BURN HAZARD
Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach
dangerous temperatures.
Allen-Bradley, Rockwell Automation, Logix5000, RSLogix 5000, PLC-5, ControlLogix, PLC-2, SLC, and TechConnect are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
Table of Contents
Preface
Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Who Should Use This Manual. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Chapter 1
CIP Services
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
CIP Services Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
CIP Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Logix5000 Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Data Type Reporting Value. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Segment Encoding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
CIP Service Request/Response Format . . . . . . . . . . . . . . . . . . . . . 14
Services Supported by Logix5000 Controllers . . . . . . . . . . . . . . . . . . . 16
Read Tag Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Read Tag Fragmented Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Write Tag Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Write Tag Fragmented Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Read Modify Write Tag Service . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Multiple Service Packet Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Logix Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Chapter 2
CIP Addressing Examples
Access Atomic Tags and Atomic Members of

Pre-defined Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Access User-defined Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Chapter 3
CIP Over the Controller Serial Port Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Unconnected Messaging (UCMM) via PCCC. . . . . . . . . . . . . . . . . . . . 45
Connected Explicit Messages via PCCC . . . . . . . . . . . . . . . . . . . . . . . . 47
Fragmentation Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Chapter 4
PCCC Commands
Publication 1756-PM020A-EN-P - October 2009
PLC-2 Communication Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Unprotected Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Protected Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Unprotected Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Protected Bit Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Unprotected Bit Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
PLC-5 Communication Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Read Modify Write. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Read Modify Write N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Typed Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Typed Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
3
Table of Contents
Word Range Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Word Range Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Bit Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
SLC Communication Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
SLC Protected Typed Logical Read with 3 Address Fields . . . . . . 62
SLC Protected Typed Logical Write with 3 Address Fields . . . . . 62
SLC Protected Typed Logical Read with 2 Address Fields . . . . . . 62
SLC Protected Typed Logical Write with 2 Address Fields . . . . . 63
Addressing Examples for PCCC Messages . . . . . . . . . . . . . . . . . . 63
Preface
Purpose
This manual describes how to access data within a controller from another
product or application that connects to the controller through the
EtherNet/IP network or the serial port. The following methods of data access
from a Logix5000 controller are described in this manual:
Control and Information Protocol (CIP)
This native mode of communication for Logix5000 controllers is based
on the CIP common protocol of these networks:
EtherNet/IP
ControlNet
DeviceNet
These services are also supported over the DF1 serial port by using
Programmable Controller Communication Commands.
The EtherNet/IP network (CIP over standard Ethernet network) is the
preferred method of data access and therefore the focus of this manual.
The ControlNet network can also be used for data access, but generally
speaking, not the DeviceNet network.
Programmable Controller Communication Commands (PCCC), for
compatibility with PLC and SLC controllers:
CIP Over the Controller Serial Port on page 45
PLC-2 Communication Commands on page 51
PLC-5 Communication Commands on page 55
SLC Communication Commands on page 61
The DF1/PCCC method via the serial port is sometimes the most
convenient way to access the controller, typically because of physical
proximity, but it requires using multiple protocols and can require that
tags be mapped to data tables, which is an extra configuration step.
PCCC commands can also be encapsulated in CIP messages and sent
over a CIP network. The commands shown here are not described in
that context.
Visit http://www.rockwellautomation.com/enabled/guides.html for
more information.
5Publication 1756-PM020A-EN-P - October 2009
Preface
This manual is one of a set of related manuals that show common procedures
for programming and operating Logix5000 controllers. For a complete list of
common procedures manuals, see the Logix5000 Controllers Common
Procedures Programming Manual, publication 1756-PM001.
The term Logix5000 controller refers to any controller that is based on the
Logix5000 operating system, such as:
Who Should Use This

Manual
CompactLogix controllers.
ControlLogix controllers.
DriveLogix controllers.
FlexLogix controllers.
SoftLogix5800 controllers.
Before using this document, make sure you:

have a thorough understanding of CIP.
have purchased a copy of the pertinent volumes of the CIP Networks
Library.
are properly licensed through ODVA to use the technology.
For more information on the CIP Networks Library and CIP technologies,
contact ODVA at http://www.odva.org/.
Preface
Additional Resources
Some of the information in this manual is covered in more detail in the CIP
specification (listed below). In case of discrepancies, the specification is the
authoritative source of information.
For additional information, refer to the following manuals.
Resource
Author
DF1 Protocol and Command Set Reference Manual, 1770-6.5.16
Rockwell Automation
Logix5000 Controllers Common Procedures Programming

Manual, 1756-PM001
Rockwell Automation
Integration with ControlLogix Programmable Automation

Controllers Using EtherNet/IP,
http://www.rockwellautomation.com/enabled/guides.html
Rockwell Automation
Logix5000 Controllers Design Considerations Reference Manual

(Chapter 3, Guidelines for Data Types), 1756-RM094
Rockwell Automation
The Common Industrial Protocol, Pub 122(1)
ODVA
The Common Industrial Protocol (CIP) and the Family of CIP

Networks, Pub 123(1)
ODVA
EtherNet/IP Quick Start for Vendors Handbook, Pub 213(1)
ODVA
CIP Networks Library (Specifications) - subscription required,

Volumes 1 and 2
ODVA
(1)
To locate publications on the ODVA website, use the Search function and type 'pub ###', where ### is the
publication number.
You can view or download Rockwell Automation publications at

http://www.rockwellautomation.com/literature/. To order paper copies of
technical documentation, contact your local Rockwell Automation distributor
or sales representative.
You can view or download ODVA publications at http://www.odva.org/.
Preface
Glossary
This document uses the following acronyms and terms.

Term
Definition
CIP
Common Industrial Protocol.
Data Type
Reporting Value
Used to indicate the data type of parameters used in Tag services.

These reporting values are defined in the Data Type Reporting
chapter of Appendix B of the CIP Networks Library, Volume 1. The
Data Type Reporting Values for atomic data types are given, and the
values used for structures are calculated, in the specification.
PCCC
Programmable Controller Communication Command.
PLC-2
An older, chassis-based, modular programmable controller.
PLC-5
A chassis-based, modular programmable controller.
SLC
A small, chassis-based, modular programmable controller.
STS/EXT STS
Status of the message transmission.
tag
Character name of data.
UDT
User-defined data type.
Chapter
CIP Services
Introduction
Communicating with the Logix5000 controller requires using CIP explicit

messaging, which is described in great detail in the CIP Specification. This
section highlights the subset of the CIP explicit messaging constructs that are
pertinent for understanding the service explanations that follow. This is not
meant to replace the need to understand CIP explicit messaging, which can be
found by reading the materials referenced in Additional Resources on page 7.
CIP Services Overview
Before you use CIP services, review the following introductory information.
Topic
Page
CIP Data Types
10
Logix5000 Data
11
Data Type Reporting Value
12
Segment Encoding
13
CIP Service Request/Response Format
14
Chapter 1
CIP Services
CIP Data Types

Data type information is very important in all aspects of CIP communication.
The type information is used for reading, writing, and, if necessary,
deciphering structures. The Logix5000 controller supports a large variety of
data types.
Atomic - a bit, byte, 16-bit word, or 32-bit word, each of which stores a
single value. (CIP refers to these as Elementary Data Types)
Structure - a grouping of different data types that functions as a single
unit and serves a specific purpose. Depending on the needs of your
application, you can create additional structures, which are referred to as
user-defined structures.
Array - a sequence of elements, each of which is the same data type.
You can define data in one, two, or three dimensions, as required
(one dimension is the most common).
You can use either atomic or structure data types.
Data in the controller is organized as tags. The tags come in two basic types:
atomic and structures. Atomic types can be arrayed or singular, and are very
easy to work with. Structure types provide a great deal of flexibility, but are
more challenging to access. The following table identifies the atomic data type
sizes.
Atomic Data Type Sizes
10
To store a
Use this data type
Bit
BOOL
Bit array
DWORD (32-bit boolean array)
8-bit integer
SINT
16-bit integer
INT
32-bit integer
DINT
32-bit float
REAL
64-bit integer
LINT
CIP Services
Chapter 1
Logix5000 Data
The Logix5000 controller stores data in tags, in contrast to a PLC-5 or SLC
controller, which stores data in data files. Logix5000 tags have these properties:
Name that identifies the data:
up to 40 characters in length.
does not include a file number.
Scope:
Controller (global), which you can access directly.
Program (local), which cannot be directly accessed, but can be copied
to a controller scope tag.
Data type, which defines the organization of the data.
See CIP Data Types on page 10 for more information.
Public versus Private - Tags created as Private cannot be accessed by
using the methods described here.
For more information about tags and data types, see Chapter 3 of the
Logix5000 Controllers Design Considerations Reference Manual, publication
1756-RM094.
11
Chapter 1
CIP Services
Data Type Reporting Value

Read Tag, Write Tag, Read Tag Fragmented, Write Tag Fragmented, and
Read Modify Write services require a Data Type Reporting code that identifies
the data type of the data supplied with the request/response. There are two
types of data, Elementary (atomic) and Constructed (structures).
The following shows the data format and Data Type Reporting Values
returned for all the atomic types supported in the Logix controller. Also shown
is the byte order (low byte first) when transmitted within a message packet. For
more information on Data Type Reporting and byte ordering, see Appendix C
of the CIP Networks Library, Volume 1.
CIP Data Type Reporting Values Used with Logix Controllers
Data
Type
Data
Reporting
Value
Reserved Byte Order
BOOL
0xc1
00
Value
SINT
0xc2
00
Value
INT
0xc3
00
Low
High
DINT
0xc4
00
Lowest
Low
High
Highest
REAL
0xca
00
Lowest
Low
High
Highest
DWORD 0xd3
00
Lowest
Low
High
Highest
LINT
00
Lowest
0xC5
Highest
Data Type Reporting Values for structured data types are described in Logix
Data Structures on page 31.
12
CIP Services
Chapter 1
Segment Encoding
The Request Path in a CIP explicit message contains addressing information
that indicates to which internal resource in the target node the service is
directed. This addressing information is organized by using segment encoding,
specifically Logical Segments and/or Symbolic Segments. Most of the services,
described later in this chapter, use Symbolic Segments, but several others use
Logical Segments. For more detailed information about segments, see the CIP
Networks Library, Volume 1, Appendix C. The following is a summary of the
segments important to the context of this manual.
Logical Segments
These tables explain the Logical Segments.
Element ID Logical Segment Encoding Used to Access Arrays and Structures in Logix Controllers
Segment Type
Value
Byte Order Representation of Element ID Value (low byte first)

0
n+1
8-bit Element ID
0x28
Value
N/a
N/a
N/a
N/a
16-bit Element ID
0x29
00
Low
High
N/a
N/a
32-bit Element ID
0x2A
00
Lowest
Low
High
Highest
Class ID Logical Segment Encoding Used to Address Object Classes in Logix Controllers
Segment Type
Value
Byte Order Representation of Class ID Value (low byte first)

0
n+1
8-bit Class ID
0x20
Value
N/a
N/a
N/a
N/a
16-bit Class ID
0x21
00
Low
High
N/a
N/a
32-bit Class ID
0x22
00
Lowest
Low
High
Highest
Instance ID Logical Segment Encoding Used to Address Instances of an Object in Logix Controllers
Segment Type
Value
Byte Order Representation of Instance ID Value (low byte first)

0
n+1
8-bit Instance ID
0x24
Value
N/a
N/a
N/a
N/a
16-bit Instance ID
0x25
00
Low
High
N/a
N/a
32-bit Instance ID
0x26
00
Lowest
Low
High
Highest
Attribute ID Logical Segment Encoding Used to Address Object Attributes in Logix Controllers
Segment Type
Value
Byte Order Representation of Attribute ID Value (low byte first)

0
n+1
8-bit Attribute ID
0x30
Value
N/a
N/a
N/a
N/a
16-bit Attribute ID
0x31
00
Low
High
N/a
N/a
32-bit Attribute ID
0x32
00
Lowest
Low
High
Highest
13
Chapter 1
CIP Services
Symbolic Segments
CIP also defines a way to reference items by their symbolic name. The segment
used is the ANSI Extended Symbol Segment defined in the CIP Networks
Library, Volume 1, Appendix C.
The Read/Write tags services use these segments in the request path to
indicate which target tag to operate on. When addressing an arrayed tag, the
Logical Segment for Element ID is also used with the Symbolic Segment.
ANSI Extended Symbolic Segment Encoding Used to Address Tags in Logix Controllers
Segment Type
ANSI Extended
Symbolic
(1)
Value
0x91
Byte Order Representation (low byte first)

0
N+1
Length
1st char
Nth Char
(1)
Optional pad byte (00) when length of string (length) is odd.
CIP Service Request/Response Format

All CIP services follow the Message Router Request/Response format defined
in the CIP Networks Library, Volume 1, Chapter 2. Refer to the CIP Networks
Library for a complete description.
All requests take the following form.
14
Message Field
Description
Request Service
Indicates to the object referenced in the request path what task is to

be performed. Services can be openly defined (see CIP Volume 1,
Appendix A) or object-class specific, as most of the services here
are.
Request Path Size
A byte value that indicates the number of 16-bit words in the

Request Path.
Request Path
A variable sized field that consists of one or more segments. The

path refers to the item in the controller that the service operates on.
It can contain Logical and/or Symbolic segments. See Segment
Encoding on page 13 for more information.
Request Data
The service-specific data to be delivered to the object referenced in

the Request Path. Some services have no service-specific data, so
this field is not present in the message frame.
CIP Services
Chapter 1
This same form is used for ControlNet and EtherNet/IP communication,

both of which are CIP-based networks. Requests received via the serial port
use a different protocol, which is discussed in Chapter 3.
This service format is used for CIP explicit messages and can be delivered to
the controller as connected or unconnected messages. These are sometimes
referred to as 'Transport Class 3' and 'UCMM', respectively. The mechanisms
for doing this are CIP network specific. For example, for EtherNet/IP access,
see the CIP Networks Library, Volume 1, Chapter 3 and the EtherNet/IP
Adaptation of CIP, Volume 2 for more details. For information about using
the EtherNet/IP network to communicate with the controller see
http://www.rockwellautomation.com/enabled/guides.html.
The examples used throughout this document show only the explicit message
protocol elements and not the network specific details. The exception to this is
the information in Chapter 3, which shows more details of unconnected
versus connected explicit messages, and of the PCCC and DF1 layers.
All responses take the following general form.
Message Field
Description
Reply Service
The request service with the MSB set to 1.
00
Reserved.
General Status
An 8-bit value indicating success or error status. Appendix B of the

CIP Networks Library, Volume 1 has a list of the general status
codes. The object class specified in the request path defines any
extended status codes for each service defined for that class.
Extended Status
Size
An 8-bit value that indicates how many 16-bit values follow in the
additional status field. For status=0 (success) this will be 0.
Extended Status
The array of 16-bit values that further describe the general status
code. Only present when the size field is > 0.
Response Data
The data returned by the specific service request. Some services

have no service-specific reply data, so this field is not present in the
message frame.
15
Chapter 1
CIP Services
Services Supported
by Logix5000 Controllers
The following sections describe the inherent mode of communication and

addressing of the Logix5000 controller. The following vendor-specific services
operate on tags in the controller using symbolic addressing:
Read Tag Service (0x4c)

Read Tag Fragmented Service (0x52)
Write Tag Service (0x4d)
Write Tag Fragmented Service (0x53)
Read Modify Write (RMW) Tag Service (0x4e)
The Multiple Service Packet Service (0x0a) may also be used to combine
multiple requests in one message frame.
Previous Names of Tag Services
Service
In the previous version of this

manual, the service was called
In the Logix5000 software,

the service was called
Read Tag Service
CIP Read Data
CIP Data Table Read
Read Tag
Fragmented Service
Read Data Fragmented Format
N/A
Write Tag Service
CIP Write Data
CIP Data Table Write
Write Tag
Fragmented Service
Write Data Fragmented Format
N/A
Multiple Service
Packet Service
N/A
Multi-Request Service
The Request Data and Response Data shown in the examples below is shown
in the required order. Any deviation from the order shown will likely result in
an error.
This document assumes the following:
The client application knows the name of the tag or tags with which it
wants to interact.
For atomic tags, RSLogix 5000 software is used to determine the data
type, which determines the Data Type Reporting Value used in the Tag
Services.
For UDTs, the data order and type of the members in the UDT
corresponds to the order and type shown in RSLogix 5000 Tag Monitor.
This limited subset of UDTs is explained in Logix Data Structures on
page 31.
It is beyond the scope of this document to describe how to search for tags that
exist in the controller, and to programmatically determine the structure and
byte ordering of any kind of structure in the controller.
16
CIP Services
Chapter 1
Read Tag Service

The Read Tag Service reads the data associated with the tag specified in the
path.
Any data that fits into the reply packet is returned, even if it does not all
fit.
If all the data does not fit into the packet, the error 0x06 is returned
along with the data.
When reading a two or three dimensional array of data, all dimensions must be
specified.
17
Chapter 1
CIP Services
Example
Read a single tag named 'rate'. The tag has a data type of DINT and a value
of 534.
Request Format
Message Request Field
Bytes (in hex)
Description
Request Service
4C
Read Tag Service (Request)
Request Path Size
03
Request Path is 4 words (8 bytes) long
Request Path
91 04 72 61 74 65
ANSI Ext. Symbolic Segment for 'rate'
Request Data
01 00
Number of elements to read (1)
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Read Tag Service (Reply)
Reserved
00
General Status
00
Success
Extended Status Size
00
No extended status
Response Data
C4 00
DINT Data Type Reporting Value
16 02 00 00
0000216 = 534 decimal
Response Format
Read Tag Service Error Codes

Read Tag Service may return the following errors.
Error Code (Hex)
Extended Error (Hex)
Description of Error
0x04
0x0000
A syntax error was detected decoding the Request Path.
0x05
0x0000
Request Path destination unknown: Probably instance number is not

present.
0x06
N/A
Insufficient Packet Space: Not enough room in the response buffer for all
the data.
0x13
N/A
Insufficient Request Data: Data too short for expected parameters.
0x26
N/A
The Request Path Size received was shorter or longer than expected.
0xFF
0x2105
General Error: Access beyond end of the object.
18
CIP Services
Chapter 1
Read Tag Fragmented Service

The Read Tag Fragmented Service allows a client application to read a tag
whose data will not fit into a single packet (approximately 500 bytes). The
client must issue a series of requests to the controller to retrieve all of the data
using this service. The Service, Path, and Number of Elements fields remain
the same for each request. The client must change the Offset with each
request, by the number of bytes transferred in the response to the previous
request.
Example
Reading the tag 'TotalCount' that has 1750 SINTs would consist of the
following four service requests with service data as shown in the tables below.
First Fragment - Request Format
Bytes
Description
Request Service
52
Read Tag Fragmented Service (Request)
Request Path Size
06
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
ANSI Ext. Symbolic Segment for 'TotalCount'
Request Data
D6 06
00 00 00 00
Start at this element (0) and return as much will fit
First Fragment - Response Format

Message Reply Field
Bytes
Description
Reply Service
D2
Read Tag Fragmented Service (Reply)
Reserved
00
General Status
06
Reply Data Too Large
00
No extended status
Response Data
C2 00
SINT Data Type Reporting Value
nn nn nnnn
Element 0489
19
Chapter 1
CIP Services
Second Fragment - Request Format

Bytes
Description
Request Service
52
Request Path Size
06
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
Request Data
D6 06
EA 01 00 00
Second Fragment - Response Format

Message Reply Field
Bytes
Description
Reply Service
D2
Reserved
00
General Status
06
00
No extended status
Response Data
C2 00
nn nn nnnn
Element 490979
Third Fragment - Request Format

Bytes
Description
Request Service
52
Request Path Size
06
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
Request Data
D6 06
D4 03 00 00
Third Fragment - Response Format

Message Reply Field
Bytes
Description
Reply Service
D2
Reserved
00
General Status
06
00
No extended status
Response Data
C2 00
nn nn nnnn
Element 9801469
20
CIP Services
Chapter 1
Fourth Fragment - Request Format

Bytes
Description
Request Service
52
Request Path Size
06
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
Request Data
D6 06
BE 05 00 00
Fourth Fragment - Response Format

Message Reply Field
Bytes
Description
Reply Service
D2
Reserved
00
General Status
00
Success
00
No extended status
Response Data
C2 00
nn nn nnnn
Element 14701749
Each response except the last one carries the Status of 06, 'Reply Data Too
Large' to indicate that more data is present than is in this particular frame. The
last response carries the Status of 0 indicating that the data read did not exceed
the message size limit, which indicates that the entire sequence of bytes has
been read.
Read Tag Fragmented Service Error Codes

The Read Tag Fragmented Service may return the following errors.
Error Code (Hex)
0x04
0x0000
0x05
0x0000
Request Path destination unknown: probably instance number is not present.
0x06
N/A
Insufficient Packet Space: Not enough room in the response buffer for all the
data.
0x13
N/A
0x26
N/A
0xFF
0x2104
General Error: Offset is beyond end of the requested tag.
0xFF
0x2105
General Error: Offset plus Number of Elements extends beyond the end of the
requested tag.
21
Chapter 1
CIP Services
Write Tag Service

The Write Tag Service writes the data associated with the tag specified in the
path. The data type must match exactly for the write to occur; the controller
will validate the data type matches before executing the service.
When writing a two or three dimensional array of data, all dimensions must be
specified.
Example
Write the value of 14 to a DINT tag named 'CartonSize'.
Request Format
Bytes (in hex)
Description
Request Service
4D
Write Tag Service (Request)
Request Path Size
06
Request Path
91 0A 43 61 72 74 6F 6E 53 69 7A 65
ANSI Ext. Symbolic Segment for 'CartonSize'
Request Data
C4 00
01 00
Number of elements to write (1)
0E 00 00 00
Data 0000000E=14 decimal
Message Reply Field
Bytes (in hex)
Description
Reply Service
CD
Write Tag Service (Reply)
Reserved
00
General Status
00
Success
00
No extended status
Response Format
22
CIP Services
Chapter 1
Write Tag Service Error Codes

Write Tag Service may return the following errors.
Error Code (Hex)
0x04
0x0000
0x05
0x0000
Request Path destination unknown: Probably instance number is not present.
0x10
0x2101
Device state conflict: keyswitch position: The requestor is attempting to change

force information in HARD RUN mode.
0x10
0x2802
Device state conflict: Safety Status: The controller is in a state in which Safety
Memory cannot be modified.
0x13
N/A
0x26
N/A
0xFF
0x2105
requested tag.
0xFF
0x2107
General Error: Data type used in request does not match target tags data type.
23
Chapter 1
CIP Services
Write Tag Fragmented Service

The Write Tag Fragmented Service allows a client application to write to a tag
in the controller whose data will not fit into a single packet (approximately 500
bytes). The client must issue a series of requests to the controller to write all of
the data using this service. The Request Service, Request Pat Size, Request
Path, and Number of Elements fields remain the same for each request. The
Offset field changes with each request by the number of bytes it transferred in
the previous request.
Example
Writing 1750 SINTS to the tag 'TotalCount' would consist of the following
four service requests with service data as shown in the tables below.
First Fragment - Request Format
Bytes
Description
Request Service
53
Write Tag Fragmented Service (Request)
Request Path Size
06
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
Request Data
C2 00
D6 06
Total number of elements to write (1750)
00 00 00 00
Offset
nn, nn, nn
Element Data (0475)
First Fragment - Response Format

Message Reply Field
Bytes
Description
Reply Service
D3
Write Tag Fragmented Service (Reply)
Reserved
00
General Status
00
Success
00
No extended status
24
CIP Services
Chapter 1
Second Fragment - Request Format

Bytes
Description
Request Service
53
Request Path Size
06
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
ANSI Ext. Symbolic Segment for 'TotalCount
Request Data
C2 00
D6 06
DC 01 00 00
Offset
nn, nn, nn
Element Data (476951)
Second Fragment - Response Format

Message Reply Field
Bytes
Description
Reply Service
D3
Reserved
00
General Status
00
Success
00
No extended status
Third Fragment - Request Format

Bytes
Description
Request Service
53
Request Path Size
06
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
Request Data
C2 00
D6 06
B8 03 00 00
Offset
nn, nn, nn
Element Data (9521427)
Third Fragment - Response Format

Message Reply Field
Bytes
Description
Reply Service
D3
Reserved
00
General Status
00
Success
00
No extended status
25
Chapter 1
CIP Services
Fourth Fragment - Request Format

Bytes
Description
Request Service
53
Request Path Size
06
Request Path
91 0A 54 6F 74 61 6C 43 6F 75 6E 74
Request Data
C2 00
D6 06
94 05 00 00
Offset
nn, nn, nn
Element data (14281749)
Fourth Fragment - Response Format

Message Reply Field
Bytes
Description
Reply Service
D3
Reserved
00
General Status
00
Success
00
No extended status
The response to each request carries a Status value of 00, 'Success' status
indication, to indicate that the write operation was successful. No other
Response Data is returned for this service.
Write Tag Fragmented Service Error Codes

Write Tag Fragmented Service may return the following errors.
Error Code (Hex)
0x04
0x0000
0x05
0x0000
Request Path destination unknown: probably instance number is not present.
0x10
0x2101
Device state conflict: keyswitch position: The requestor is attempting to change

force information in HARD RUN mode.
0x10
0x2802
Device state conflict: Safety Status: The controller is in a state in which Safety
Memory cannot be modified.
0x13
N/A
0x26
N/A
0xFF
0x2104
General Error: Offset is beyond end of the requested tag.
0xFF
0x2105
requested tag.
0xFF
0x2107
General Error: Data type used in request does not match the target tags data type.
26
CIP Services
Chapter 1
Read Modify Write Tag Service

The Read Modify Write Tag Service provides a means to modify Tag data with
individual bit resolution. Within ControlLogix, the Tag data is read, the or
modification masks are applied, and finally the data is written back to the Tag.
It can be used to modify a single bit within a Tag without disturbing other
data. Its purpose is similar to the PLC-5 style 'Read Modify Write' PCCC
command described in Chapter 4.
Service Request Parameters

Name
Description of Response Data
Semantics of Values
Size of masks
Size in bytes of modify masks
Only 1,2,4,8,12 accepted
OR masks
Array of OR modify masks
'1' mask sets bit to '1'
AND masks
Array of AND modify masks
'0' mask resets bit to '0'
The size of masks must be the same or smaller than the size of the data type
being accessed. For complete 'data integrity' (for example, to avoid the
possibility of a mix of old and new data when modifying dynamic data), the
size of the mask should match the size of the data type.
27
Chapter 1
CIP Services
Example
Set bit 2 and reset bit 5 of the DINT named 'ControlWord'.
Request Format
Bytes (in hex)
Description
Request Service
4E
Read Modify Write Tag Service (Request)
Request Path Size
07
Request Path
91 0B 43 6F 6E 7H 72 6F 6C 57 6F 72 64 00 ANSI Ext. Symbolic Segment for 'ControlWord'
Request Data
04 00
Size of Masks (shall be 4)
04 00 00 00
Array of OR modify masks
DF FF FF FF
Array of AND modify masks
Message Reply Field
Bytes (in hex)
Description
Reply Service
CE
Read Modify Write Tag Service (Reply)
Reserved
00
General Status
00
Success
00
No extended status
Response Format
Read Modify Write Tag Service Error Codes

Read Modify Write Tag Service may return the following errors.
Error Code (Hex)
0x03
N/A
Bad parameter, size > 12 or size greater than size of element.
0x04
0x0000
0x05
0x0000
Request Path destination unknown: Probably instance number is not

present.
0x10
0x2101
Device state conflict: keyswitch position: The requestor is attempting to

change force information in HARD RUN mode.
0x10
0x2802
Device state conflict: Safety Status: The controller is in a state in which

Safety Memory cannot be modified.
0x13
N/A
0x26
N/A
28
CIP Services
Chapter 1
Multiple Service Packet Service

The Multiple Service Packet Service carries more than one CIP request in a
single CIP explicit-message frame. Use this service to optimize CIP reads and
writes, by grouping service requests together for faster request processing.
Example
Request Format
Message Request Field Bytes (in hex)
Description
Request Service
0A
Multiple Service Packet Service (Request)
Request Path Size
02
Request Path
20 02 24 01
Logical Segment: CLass 0x02, Instance 01 (Message Router)
Request Data
02 00
Number of Services contained in this request
06 00
10 00
Offsets for each Service; from the start of the Request Data
4C
03 91 04 72 61 74 65
01 00
First Request: Read Tag Service

Tag name: 'parts'
Read 1 element
4C
07 91 0B 43 6F 6E 74 72
6F 6C 57 6F 72 64 00
01 00
Second Request: Read Tag Service

Tag name: 'ControlWord'
Read 1 element
The Multiple Service Packet Request Path contains the Message Router object
(Class 2, Instance 1). The Request Data field contains the Number of Services
followed by byte offsets to the start of each service, followed by each of the
CIP requests, each following the standard Message Router Request format.
29
Chapter 1
CIP Services
Response Format
Message Reply Field
Bytes (in hex)
Description
Reply Service
8A
Multiple Service Packet Service (Reply)
Reserved
00
General Status
00
Success
00
No extended status
Response Data
02 00
Number of Service Replies
06 00
10 00
Offsets for each Service Reply; from the start of the Response Data
CC 00 00 00
C4 00
2A 00 00 00
Read Tag Service Reply, Status: Success

Value: 0x0000002A (42 decimal)
CC 00 00 00
C4 00
DC 01 00 00
Read Tag Service Reply, Status: Success

Value: 0x000001DC (476 decimal)
The Multiple Service Packet response follows the same Message Router
Response format as all CIP services; therefore, the General Status, Ext Status
Size fields are as described previously. The Response Data field contains the
number of service replies followed by the byte offset to the start of each reply
followed by each of the CIP responses, each following the standard Message
Router Response format.
30
CIP Services
Logix Data Structures
Chapter 1
A structure is a compound data type that stores a group of possibly different

data types that function as a single unit and serve a specific purpose (for
example, a combination of values).
A structure contains one or more members.
Each member can be an:
atomic data type.
another structured data type.
a single dimension array of an atomic or structure data type.
For more information on data types, see Chapter 3 of the Logix5000
Controllers Design Considerations Reference Manual, publication
1756-RM094.
You can group most structures into arrays or use them in other structures. See
the Logix5000 Controllers Design Considerations Reference Manual,
publication 1756-RM094, for rules for creating structures, including what
types are not allowed.
The controller contains three basic types of structures:
Module-defined data types - created by adding modules to the I/O tree
Pre-defined data types - created by default in the controller (for
example, TON, CTU, and Motion)
User-defined data types - created by the user
The pre-defined and module-defined types, as well as Booleans, are difficult to
deal with for various reasons; therefore they are beyond the scope of this
document.
In RSLogix 5000 software, version 18 and later, controller scope tags can be
marked as Private, which means they cannot be accessed from outside the
controller. Therefore, a structure that contains tags marked as Private, cannot
be accessed.
31
Chapter 1
CIP Services
To simplify the task of accessing structured tags via a network, create UDTs
with members of these types only: atomic tags, arrays of atomic tags, other
UDTs of atomic tags, and arrays of UDTs of atomic tags. To include data
from a tag based on a pre-defined or module-defined structure in a UDT, use
ladder logic to copy the data from the member of the pre-defined or
module-defined tag to an atomic tag and include the atomic tag in the UDT.
Structures begin and end on 32-bit boundaries. A Logix5000 controller aligns
every data type along an 8-bit boundary for SINTs, a 16-bit boundary for
INTs, or a 32-bit boundary for DINTs and REALs. BOOLs also align on 8-bit
boundaries, but if they are placed next to each other in a user-defined
structure, they are mapped so that they share the same byte. Pad bits or bytes
are added where necessary to achieve this alignment according to these rules.
For more details, see the Guidelines for User-defined Structures section in
Chapter 3 of the Logix5000 Controllers Design Considerations Reference
Manual, publication 1756-RM094.
It is also important for the client application to understand the byte order of
the data in the structure, as it will be transmitted on the wire. If UDTs are
restricted to only atomic members or structures of atomic members and do
not include any module-defined or pre-defined data types, then the size and
byte order will be as shown in the Data Monitor view of the structure
definition in RSLogix 5000 software. However, the Data Monitor does not
show the pad bits or bytes included for the data alignment mentioned in the
paragraph above.
Writing to UDTs requires knowing the Data Type Encoding Value. This is a
calculated field that varies with the members and ordering of members in a
structure. Information about calculating this value for UDTs, can be found at
http://www.rockwellautomation.com/enabled/guides.html, in the
supplemental material located with this manual.
32
CIP Services
Chapter 1
Structures in the Logix system use Data Type Reporting Values for
constructed data types. These structures are referred to as Abbreviated
Encoding for Structure Data Information, or simply Abbreviated Types.
First byte indicates that a structure type follows.
Second byte indicates the size of the structure handle, which identifies
the structure for communication purposes.
A0
02
xx
yy
Where xx yy is the calculated structure handle. The Read Tag/Write Tag

services use a vendor-specific handle.
In Logix controllers, arrays report the data type of its members. An array
of atomic types reports the corresponding 2 byte code. An array of
structures report the corresponding 4 byte code.
In many situations, it is not necessary to calculate this value; for example, when
the UDT is stable (program development is done and the structure is not likely
to change). In this case, the simplest method of determining the Data Type
Encoding Value is to use the Read Tag Service to read the UDT. Once the
Data Type Encoding Value is obtained, it can be used later to write to the
UDT. In this case, you do not need the supplemental material mentioned
above.
IMPORTANT
Normally when the structure definition is modified, the Data

Type Reporting Value will change, and applications not aware
of the change, would error when accessing the data. However,
the Data Type Reporting Value is not unique to a data pattern,
so it is also possible that changes to the structure may not
result in a different Data Type Reporting Value. Also, it is
possible for two different structures to have the same Data
Type Reporting Value. So, while checking the Data Type
Reporting Value is helpful in detecting errors in accessing the
correct data, there are cases where certain errors would not be
detected.
See http://www.rockwellautomation.com/enabled/guides.html, for more

information on accessing structures.
33
Chapter 1
CIP Services
Notes:
34
Chapter
The following examples show Request Path strings for various data accesses
using native CIP service requests and addressing.
These examples show only a portion of a message frame for requests and
responses. References to atomic data types that are not dimensioned (not an
array) are fairly straightforward to construct. References to arrays, portions of
arrays or atomic members of structures are not as straightforward. This section
will use examples to show how various references are constructed.
Visit http://www.rockwellautomation.com/enabled/guides.html to download:
the traffic capture files that contain these services.
the controller project file used as the target in these examples.
35
Chapter 2
Access Atomic Tags and

Atomic Members of
Pre-defined Data Types
The following examples access tags that return atomic data types.
Example 1
Read a single integer tag named 'parts'. The tag has a data type of INT and a
value of 572.
Bytes (in hex)
Description
Request Service
4C
Request Path Size
04
Request Path
91 05 70 61 72 74 73 00
ANSI Ext. Symbolic Segment for 'parts'
Request Data
01 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
C3 00
INT Data Type Reporting Value
3C 02
023C = 572
Example 2
Write the value of 14.5 to the 6th element of an array of REALs named
'setpoints' (setpoints[5]).
Bytes (in hex)
Description
Request Service
4D
Write Tag Service (Request)
Request Path Size
07
Request Path
91 09 73 65 74 70 6F 69 6E 74 73 00 28 05
ANSI Ext. Symbolic Segment for 'setpoints' and

the Member segment for '5'
Request Data
CA 00
REAL Data Type Reporting Value
01 00
00 00 68 41
Data 14.5
Message Reply Field
Bytes (in hex)
Description
Reply Service
CD
Write Tag Service (Reply)
Reserved
00
General Status
00
Success
00
No extended status
36
Chapter 2
Example 3
Read element [0,1,257] of a three dimensional DINT array named 'profile'.
The value of the tag is 572.
Bytes (in hex)
Description
Request Service
4C
Request Path Size
09
Request Path
91 07 70 72 6f 66 69 6c 65 00
28 00
28 01
29 00 01 01
ANSI Ext. Symbolic Segment for 'profile'

Member Segment for 0
Request Data
02 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
C3 00
F0 02 00 00
2C C7 00 00
0x000002F0 = 752 decimal

0x0000C72C=50988 decimal
Example 4
Read the accumulated value of a timer named 'dwell3' (dwell3.ACC).
Bytes (in hex)
Description
Request Service
4C
Request Path Size
07
Request Path
91 06 64 77 65 6C 6C 33
91 03 41 43 43 00
ANSI Ext. Symbolic Segment for 'dwell3',

ANSI Ext. Symbolic Segment for 'ACC'
Request Data
01 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
C4 00
25 02 00 00
0x00000252 = 549 decimal
37
Chapter 2
Example 5
Write a preset value of 50 to the .PRE member of the counter 'ErrorLimit'
(ErrorLimit.PRE).
Bytes (in hex)
Description
Request Service
4D
Request Path Size
09
Request Path
91 0a 45 72
72 6F 72 4C 69 60
69 74
91 03 50 52 45 00
ANSI Ext. Symbolic Segment for 'ErrorLimit'
Request Data
C4 00
01 00
32 00 00 00

0x00000032 = 50 decimal
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
38
ANSI Ext. Symbolic Segment for 'PRE'
Access User-defined
Structures
Chapter 2
This section shows examples of accessing simple structures to help illustrate

the message formats needed. The four structures below are defined and then
various members of the structures are accessed in the following examples.
Structure Name: STRUCT_A
Structure Name: STRUCT_B
Member
Data Type
Member
Data Type
limit4
Bit
pilot_on
Bit
limit7
Bit
hourlyCount
INT[12]
travel
DINT
rate
REAL
errors
DINT
wear
REAL
Structure Name: STRUCT_C
Structure Name: STRUCT_D
Member
Data Type
Member
Data Type
hours_full
Bit
myint
INT
today
STRUCT_B
myfloat
REAL
sampleTime
DINT
myarray
STRUCT_C[8]
shipped
DINT
mypid
REAL
For the controller project file and EtherNet/IP traffic capture files for all the
examples in this book, go to
http://www.rockwellautomation.com/enabled/guides.html.
39
Chapter 2
Example 1
Read the tag 'struct1' that is a tag of type STRUCT_A. This reads the entire
structure.
Bytes (in hex)
Description
Request Service
4C
Request Path Size
05
Request Path
91 07 73 74 72 75 63 74 31 00
ANSI Ext. Symbolic Segment for 'struct1'
Request Data
01 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
A0 02 2C 0A
Abbreviated Type for STRUCT_A
03 00 00 00
55 00 00 00
AA 00 00 00
33 33 2B 41
limit4 and limit7 members (bits 0 and 1 respectively) (BOOL) = 1,

travel member (DINT) = 0x55 (85 decimal),
errors member (DINT) = 0xAA (170 decimal),
wear member (REAL) = 10.7 decimal
Example 2
Read the tag 'struct1.wear'.
Bytes (in hex)
Description
Request Service
4C
Request Path Size
08
Request Path
91 07 73 74 72 75 63 74 31 00
91 04 77 65 61 72
ANSI Ext. Symbolic Segment for 'struct1',

ANSI Ext. Symbolic Segment for 'wear'
Request Data
01 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
CA 00
33 33 2b 41
0x412B3333=10.7 decimal
40
Chapter 2
Example 3
Read the tag 'str1Array[8].travel', which is a one dimensional array of struct_A.
Bytes (in hex)
Description
Request Service
4C
Request Path Size
0B
Request Path
91 09 73 74 72 31 41 72 72 61 79 00
28 08
91 06 74 72 61 76 65 6c
ANSI Ext. Symbolic Segment for 'str1Array',

Member ID for element 8,
ANSI Ext. Symbolic Segment for 'travel'
Request Data
01 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
C4 00
0F 27 00 00
0x0000270F=9999 decimal
Example 4
Read two elements of the tag 'struct2.hourlyCount[4]', which is a structure of
type struct_B.
Bytes (in hex)
Description
Request Service
4C
Request Path Size
0D
Request Path
91 07 73 74 72 75 63 74 32 00
91 0B 68 6f 75 72 6c 79 43 6F 75 6E 74 00
28 04

ANSI Ext. Symbolic Segment for 'hourlyCount',
Member Segment for element 4
Request Data
02 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
C3 00
05 00
06 00
0x0005=5 decimal
0x0006=6 decimal
41
Chapter 2
Example 5
Read the tag 'struct3.today.rate', which is a structure of type Struct_C.
Bytes (in hex)
Description
Request Service
4C
Request Path Size
0C
Request Path
91 07 73 74 72 75 63 74 33 00
91 05 74 6F 64 61 79 00
91 04 72 61 74 65

ANSI Ext. Symbolic Segment for 'today',
ANSI Ext. Symbolic Segment for 'rate'
Request Data
01 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
CA 00
00 00 80 41
0x41800000=16.0 decimal
42
Chapter 2
Example 6
Read the tag 'myDstruct4[0].myarray[1].today.hourlyCount[3]' in the controller,
which is a one dimensional array of type Struct_0.
Bytes (in hex)
Description
Request Service
4C
Request Path Size
19
Request Path
91 0A 6D 79 44 73 74 72 75 63 74 34
28 00
91 07 6D 79 61 72 72 61 79 00
28 01
91 05 74 6F 64 61 79 00
91 0B 68 6F 75 72 6C 79 43 6F 75 6E 74 00
28 03
ANSI Ext. Symbolic Segment for 'myDstruct4',

Element ID for element 0
ANSI Ext. Symbolic Segment for 'myarray'
ANSI Ext. Symbolic Segment for 'today'
ANSI Ext. Symbolic Segment for 'hourlyCount'
Request Data
01 00
Message Reply Field
Bytes (in hex)
Description
Reply Service
CC
Reserved
00
General Status
00
Success
00
No extended status
Response Data
C3 00
D0 5C
0x5CD0=23760 decimal
43
Chapter 2
Notes:
44
Chapter
CIP Over the Controller Serial Port
Introduction
The information in this chapter helps you to communicate with ControlLogix

controllers using CIP over the serial port. For more information about DFI,
refer to the DF1 Protocol and Command Set Reference Manual, publication
1770-6.5.16. For more information about CIP services used with Logix5000
controllers, see CIP Services on page 9.
The controller's serial port supports the DF1 protocol and PCCC commands.
CIP messages can also be delivered by encapsulating CIP explicit messages
inside of the PCCC commands 0x0A and 0x0B. All of the CIP services
described in Chapter 1 can be sent by using this method.
PCCC has an inherent format limit of 244 bytes of application data. If an
application tries to send a message larger than 244 bytes, an error is returned.
The PCCC commands described here were designed to support a PCCC
fragmentation protocol to allow the transmission of larger CIP messages (up
to 510 bytes). For more information, see Fragmentation Protocol on page 49.
Unconnected Messaging
(UCMM) via PCCC
PCCC Command Code 0B provides CIP unconnected explicit-message

capability over the controller's serial port. This can be used for
infrequent requests to the controller (for example, to read or write
ControlLogix tags) or to establish an explicit message connection with the
controller (see Connected Explicit Messages via PCCC on page 47 for
connected communication).
45
Chapter 3
The contents of this PCCC message is a CIP explicit-message service

request/response, such as those described earlier.
PCCC Command 0B Request Structure
Name
Type
Description of Request Parameter
CMD
USINT
Command = 0x0B
STS
USINT
Status (0 in request)
TNSW
UINT
Used to match response with request
FNC
USINT
Fragmentation protocol function
Extra
USINT
Additional information for fragmentation

protocol
Request Service
USINT
CIP Service Code
Request Path Size
USINT
Number of 16-bit words in the Request Path
Request Path
EPATH
Logical and/or Symbolic Segments
Service Request Data
Semantics of Values
See the DF1 Protocol and Command Set Reference

Manual, publication 1770-6.5.16
See CIP Services on page 9.
Service data as defined by the service. Size

and type varies
Similarly, the CIP service response is returned in a PCCC command

reply, as shown in the following table.
PCCC Command 0B Reply Structure
Name
Type
CMD
USINT
Response = 0x0B + 0x40
STS
USINT
Status (0 == Success)
TNSW
UINT
Used to match response with request
FNC
USINT
Extra
USINT

protocol
Reply Service
USINT
CIP Service Code + 0x80
Reserved
USINT
00
General Status
USINT
ss
Extended Status Size USINT
nn
Extended Status
Only present if Size > 0
Service Response
Data
Service determines whether present or not, and

the size/ data type
46
Semantics of Values
See the DF1 Protocol and Command Set Reference
Manual, publication 1770-6.5.16
See Fragmentation Protocol on page 49
See CIP Services on page 9
Connected Explicit
Messages via PCCC
Chapter 3
PCCC Command Code 0A provides CIP explicit-message connection

behavior. The services described in CIP Services on page 9 are used within
these commands. For example, the only difference between connected explicit
messages via PCCC and an EtherNet/IP explicit message connection is the
wrapper that the CIP service is carried in. EtherNet/IP network uses Ethernet
and TCP/IP technology and this uses DF1 and PCCC.
TIP
We assume that you are familiar with CIP and the information
related to CIP that is discussed here. Therefore, the details of the
CIP portions of the frame will not be fully described here.
References to where more detailed information can be found are
provided below. If you are not familiar with CIP, a tutorial CD
ROM is available for purchase at
http://www.rockwellautomation.com/enabled/cipetraining.html.
The following table shows the fields used and where more
information can be found about specific fields of the command
structure.
PCCC Command 0A Structure
Name
Type
CMD
USINT
Command = 0x0A
STS(1)
USINT
TNSW
UINT
Transaction sequence number
FNC
USINT
Extra
USINT

protocol
See Fragmentation Protocol on page 49
CID(2)
UINT
Connection ID
Determined in the Forward_Open

request/reply. One unique ID for requests
and another for replies. Refer to the CIP
Specification
Trans. Header **
UINT
Transport class 3 Sequence Count
Increments with each new data request,

echoed in response. Refer to Chapter 3 of
the CIP Specification
Data
CIP Explicit Message
(1)
Only STS is supported; there is no EXT STS for this command.
(2)
These appear only in the First_req., First_response, and Only messages, if fragmentation is used.
Semantics of Values
See the DF1 Protocol and Command Set
Reference Manual, publication 1770-6.5.16
The CIP explicit message connection must be established before the 0A

command can be used. This is accomplished by sending the 0B command
(described earlier) to the controller with the CIP Forward_Open service
request. The successful Forward_Open response will provide the information
for the fields shown below. The Forward_Open service is described in Chapter
3 of the CIP Specification and in the aforementioned CIP tutorial CD.
47
Chapter 3
The 0A command supports only Transport Class 3 connections to the

Message Router object. No other transport classes are supported. The
contents of the data field are CIP services that follow the CIP Service
Request/Response Format on page 14.
Like all CIP connections, there is an RPI value associated with the
connection that establishes the rate at which messages must be sent. If
they are not sent at this rate, timeouts can occur. The RPI timer should
be reset whenever a message is sent. If the timer ever reaches the RPI
value, the connection should retransmit the last sent message and
keep the same sequence count. Upon detecting the same sequence
count, the target will not reprocess the whole message; it just resends
the same response already sent (it looks to the responder like a retry
due to a lost response). The connection timeout should be short
enough that recovery from noise or a temporary disconnect is
relatively quick. It is better to scale the timeout to something
reasonable for noise recovery (20 seconds or so) and then do RPI rate
productions rather than allow connections to repeatedly time out.
The PCCC status (STS) in the PCCC response indicates the success or
failure of the PCCC system to deliver the data across the PCCC link. It
does not indicate the success or failure of the CIP service in the reply.
The status for that will be present in the CIP service response, within
the data field. See the CIP Services on page 9 for details.
Connections are usually kept open for very long periods of time.
However, it may be necessary for the client to close the connection
from time to time. In that case, the client application must close the
connection using the 0B command with a CIP Forward_Close service
request in it. It is not acceptable to allow connections to timeout
naturally and clean themselves up.
The following is an example of the fields for a CIP explicit message
connection using a Class 3 Transport encapsulated in PCCC sent
unfragmented, using DF1 Full Duplex on RS-232.
Brief Example of CIP in PCCC on DF1
Name
Type
DLE
USINT
ASCII escape character
STX
USINT
Start of message
DST
USINT
Address of destination
SRC
USINT
Address of source
CMD
USINT
Command = 0Ahex
STS
USINT
TNSW
UINT
Transaction sequence number
48
Semantics of Values
Reference Manual, publication
1770-6.5.16

1770-6.5.16
Chapter 3
Brief Example of CIP in PCCC on DF1

Name
Type
Semantics of Values
FNC
USINT
Fragmentation Protocol
00hex ('Only' function)
Extra
USINT

protocol
00hex ('Only' has no Extra)
CID
UINT
O-T Connection ID
Transport Header
UINT
Transport class 3 Sequence Count
Request Service
USINT
CIP Service Code
Request Path Size
USINT
Number of 16-bit words in the Request Path
Request Path
EPATH
Logical and/or Symbolic Segments
Service Data
See CIP Specification

Service data
DLE
USINT
ASCII escape character
ETX
USINT
End of message
BCC or CRC
USINT or UINT
Block Check Character
Cyclic Redundancy
Check
See DF1 Publication

1770-6.5.16
The fragmentation protocol allows messages up to 510 bytes to be

sent over PCCC/DF1, which has an inherent limit of 240 bytes. It allows each
fragment to be identified as it is transferred, with each fragment being
acknowledged (Ack or Nak) before the next fragment is sent, and provides the
ability for the client device to abort the fragmentation sequence if necessary.
This fragmentation protocol is used only with the 0A and 0B PCCC
commands.
For more information on the PCCC fragmentation protocol, go to
http://www.rockwellautomation.com/enabled/guides.html. Look for
supplemental information on the Logix Data Access Manual.
49
Chapter 3
Notes:
50
Chapter
PCCC Commands
PCCC commands are carried within DF1 packets to the serial port of the
Logix5000 controller. This option for accessing data table mappings inside the
Logix5000 controller is provided for backwards compatibility with our legacy
controllers that do not understand the native language of a Logix5000
controller, CIP. Other applications that worked with our legacy controllers
over serial port could, with proper mapping of Logix5000 tags to data tables,
be used to access information in the Logix5000 controller. For details on data
table mapping, see the Logix5000 Controllers Design Considerations
Reference Manual, publication 1756-RM094.
This is not the preferred method of interacting with Logix5000 controllers, but
is serviceable for many applications, especially where the legacy
communications product is not able to be modified, and where the Logix5000
customer is willing to do the extra configuration of data table mappings in the
Logix5000 controller. Likewise, remote applications that depend on serial
communication over a modem or serial radio link can also use this method.
For more information on PCCC commands, see the DF1 Protocol and
Command Set Reference Manual, publication 1770-6.5.16.
PLC-2 Communication
Commands
Use the PLC-2 commands to access one tag (only one tag) in a Logix5000
controller. In addition to sending the command, you must also map the
message to an INT (16 bit integer) tag in the Logix5000 controller.
Logix5000 controllers support the following PLC-2 commands:
Unprotected Read
Protected Write
Unprotected Write
Protected Bit Write
Unprotected Bit Write
Further details about these commands can be found in the DF1 Protocol and
Command Set Reference Manual, publication 1770-6.5.16.
These commands can arrive at the controller in the following ways:
Encapsulated inside a ControlNet message
Encapsulated inside a EtherNet/IP message
Via the RS-232 serial port
51
Chapter 4
PCCC Commands
Unprotected Read
This command provides the read capability for the PLC-2 commands.
Request Format
CMD
STS
TNS
TNS
address
offset
size
Where:
CMD is an 8-bit command code.
STS is an 8-bit status code.
TNS is a 16-bit unique transaction identifier.
address offset is a 2-byte field that indicates byte offset from the start
of a file or tag.
size must be an even number of bytes.
See the DF1 Protocol and Command Set Reference Manual, publication
1770-6.5.16, for more information about these fields.
Reply Format
CMD
STS
TNS
TNS
data
Where data is up to 244 bytes.
Protected Write
This command provides a protected write capability for the PLC-2 commands.
Request Format
CMD
STS
TNS
TNS
address
offset
data
Reply Format
CMD
52
STS
TNS
TNS
PCCC Commands
Chapter 4
Unprotected Write
This command provides a basic write capability for the PLC-2 commands
Request Format
CMD
STS
TNS
TNS
address
offset
data
Reply Format
CMD
STS
TNS
TNS
Protected Bit Write

This command provides a protected bit write capability for the PLC-2
commands.
Request Format
repeatable up to 61 times
CMD
02
STS
TNS
TNS
PLC-2
address
set mask
reset mask
Where:
PLC-2 address is the typical 2 byte offset.
set mask is 1 byte.
reset mask is 1 byte.
Reply Format
CMD
42
STS
TNS
TNS
53
Chapter 4
PCCC Commands
Unprotected Bit Write

This command provides a bit write capability for the PLC-2 commands.
Request Format
repeatable up to 61 times
CMD
05
STS
TNS
TNS
PLC-2
address
set mask
reset mask
Where:
PLC-2 address is the typical 2 byte offset.
set mask is 1 byte.
reset mask is 1 byte.
Reply Format
CMD
45
54
STS
TNS
TNS
PCCC Commands
PLC-5 Communication
Commands
Chapter 4
Each PLC-5 command requires a system address in one of the following

forms:
Logical binary or logical ASCII, which addresses data by 'file', and
'element'.
The first level of the logical binary must always be 0. This is required
to access controller-scoped tags.
The second level is the 'file' number. This is also the level following
the letters in the logical ASCII form.
The next 1, 2, or 3 levels correspond to the array dimension indices
as follows: data[1][2][3].
Any subsequent levels of logical address access parts of the complex
types. Refer to CIP Data Types on page 10.
Refer to Map an Address on page 51.
Symbolic, which addresses data directly by a tag name.
The symbol string starts with a NULL character and ends with a
NULL character.
In the simplest case, the symbol string consists of just the tag name.
To address an array, delimit the array indices with square brackets.
The following examples depict symbolic addresses.
EXAMPLE
Symbolic addresses
tag_name
tag_name[x]
tag_name[x,y,z]
tag_name[x][y][z]
Logix5000 controllers support the following PLC-5 commands:
Read Modify Write

Read Modify Write N
Typed Read
Typed Write
Word Range Read
Word Range Write
Bit Write
55
Chapter 4
PCCC Commands
IMPORTANT
For the typed read and typed write commands, you can access
only the following data types:
SINT
INT
DINT
REAL
Read Modify Write

The PLC-5 system address field specifies the word that is to be modified. Each
PLC-5 system address is followed by an AND mask field and an OR mask
field (2 bytes each, low byte first). You can use more than one of these sets of
fields to specify more than one word to modify.
For each three field sequence (address, AND mask, OR mask), perform the
following procedure.
1. Copy the specified word.
2. Reset the bits specified in the AND mask.
3. Set the bits specified in the OR mask.
4. Write the word back.
Request Format
CMD
0F
STS
TNS
TNS
FNC
26
Repeatable up to 243 bytes
PLC-5
system
address
AND
mask
OR
mask
Where:
AND mask specifies which bits in the word to reset (0).
OR mask specifies which bits in the word to set (1).
Reply Format
CMD
4F
56
STS
TNS
TNS
EXT
STS
PCCC Commands
Chapter 4
Read Modify Write N

The PLC-5 system address specifies which word will be modified. A length
field follows each address. Valid lengths are 2 bytes and 4 bytes. The AND
mask and the OR mask follow the length field, respectively. These 4 fields can
be repeated up to a length of 243 bytes.
For each four field sequence (address, mask length, AND mask, OR mask),
perform the following procedure.
1. Copy the specified word.
2. Reset the bits specified in the AND mask.
3. Set the bits specified in the OR mask.
4. Write the word back.
Request Format
Repeatable up to 243 bytes
CMD
0F
STS
TNS
TNS
FNC
79
no. of
sets
PLC-5
system
address
mask
length
AND
mask
OR
mask
Where:
AND mask specifies which bits in the word to reset (0).
OR mask specifies which bits in the word to set (1).
Reply Format
Repeatable for each set, high word if necessary
EXT
STS
Reply
57
Chapter 4
PCCC Commands
Typed Read
The typed read command reads a block of data from the controller starting at
the PLC-5 system address plus the packet offset.
Request Format
CMD
0F
STS
TNS
TNS
FNC
68
packet
offset
total
transaction
PLC-5
system
address
size
Where size is the number of elements to read.
Reply Format
CMD
4F
STS
TNS
TNS
Where:
a indicates the type information or extended status if the command
errors.
b is the data bytes.
Typed Write
The typed write command writes a block of data to the controller starting at
the PLC-5 system address plus the packet offset.
Request Format
CMD
0F
STS
TNS
TNS
FNC
67
packet
offset
total
transaction
PLC-5
system
address
Where:
packet offset is in number of elements.
total transaction is in number of elements.
a indicates how many elements to write.
b is the data byte.
58
PCCC Commands
Chapter 4
Reply Format
Extended status exists only if there is an error.
CMD
4F
STS
TNS
TNS
EXT
STS
Word Range Read

The word range read command reads a block of words from the controller
starting at the PLC-5 system address plus the word offset.
Request Format
CMD
0F
STS
TNS
TNS
FNC
01
packet
offset
total
transaction
PLC-5
system
address
size
Where:
packet offset is in numbers of 16 bit words.
total transaction is in numbers of 16 bit words.
size is in number of bytes and must be even in number.
Reply Format
CMD
0F
STS
TNS
TNS
data
Where data is up to 244 bytes.
59
Chapter 4
PCCC Commands
Word Range Write

The word range write command will write a block of words from the
controller starting at the PLC-5 system address plus the word offset.
Request Format
CMD
0F
STS
TNS
TNS
FNC
00
packet
offset
total
trans-acti
on
PLC-5
system
address
data
Where:
packet offset is in numbers of 16 bit words.
total transaction is in numbers of 16 bit words.
Reply Format
CMD
4F
STS
TNS
TNS
EXT
STS
Bit Write
This command will set and reset bits in a single word specified by the PLC-5
logical address. It can change only a single word in any given command.
Request Format
CMD
0F
STS
TNS
TNS
FNC
02
PLC-5
system
address
set
mask
reset
mask
Reply Format
CMD
4F
60
STS
TNS
TNS
EXT
STS
PCCC Commands
SLC Communication
Commands
Chapter 4
The SLC commands use strictly a logical form of addressing

(for example, file/element/sub-element). Refer to Map an Address on
page 51.
SLC logical addressing has a limited number of logical address levels so there
are some special concerns.
In a
The element number is used as the
One-dimension array
Dimension index for addressing (data[elem])
Two-dimensional array
Index of the second dimension and the first dimension index

is always 0 (data[0][elem]
Three-dimensional array
Index of the third dimension and the first and second

dimension indices are both 0 (data[0][0][elem])
The following restrictions apply:

You can use only the SLC file types. For SLC type information, refer to
the DF1 Protocol and Command Set Reference Manual, publication
1770-6.5.16.
For the typed read and typed write commands, you can access only the
following data types:
SINT
INT
DINT
REAL
Logix5000 controllers support the following SLC commands:
SLC Protected Typed Logical Read with 3 Address Fields

SLC Protected Typed Logical Write with 3 Address Fields
61
Chapter 4
PCCC Commands

The service is supported for compatibility with SLC modules.
Request Format
CMD
0F
STS
TNS
TNS
FNC
A2
byte
size
file
number
file
type
element
number
sub- element
number
Reply Format
CMD
4F
STS
TNS
TNS
EXT
STS
data

This service is supported for compatibility with older modules.
Request Format
CMD
0F
STS
TNS
TNS
FNC
AA
byte
size
file
num
file
type
elem
num
sub-elem
num
data
Reply Format
CMD
4F
STS
TNS
TNS
EXT
STS

This read command provides a simpler version for reading data.
Request Format
CMD
0F
STS
TNS
TNS
FNC
A1
byte size
file number
file type
element
number
Reply Format
CMD
4F
62
STS
TNS
TNS
EXT
STS
data
PCCC Commands
Chapter 4

This write command provides a simpler version for writing data.
Request Format
CMD
0F
STS
TNS
TNS
FNC
A9
byte size
file num
file type
elem num
data
Reply Format
CMD
4F
STS
TNS
TNS
EXT
STS
Addressing Examples for PCCC Messages
To access
This entry is specified
Single integer tag named 'parts'
PCCC symbolic
'parts'
The sixth element of an array of REALs

named 'setpoints'
PCCC ASCII
$F8:6
PCCC symbolic
'setpoints[6]'
Single integer [2,5,257] of a three

dimensional array named 'profile'
PCCC ASCII
$N7:2:5:257
PCCC symbolic
'profile[2,5,257]'
Accumulated value of a timer named

'dwell3'
PCCC ASCII
$T4:0:2
One preset value [5,0] of a two dimensional

array of counters named 'counts'
PCCC ASCII
$C5:5:0:1
63
Chapter 4
PCCC Commands
Notes:
64
Rockwell Automation Support

Rockwell Automation provides technical information on the Web to assist you in using its products. At
http://www.rockwellautomation.com/support/, you can find technical manuals, a knowledge base of FAQs, technical and
application notes, sample code and links to software service packs, and a MySupport feature that you can customize to make the
best use of these tools.
For an additional level of technical phone support for installation, configuration, and troubleshooting, we offer TechConnect
support programs. For more information, contact your local distributor or Rockwell Automation representative, or visit
http://www.rockwellautomation.com/support/.
Installation Assistance
If you experience an anomoly within the first 24 hours of installation, review the information that is contained in this manual.
You can contact Customer Support for initial help in getting your product up and running.
United States or Canada
1.440.646.3434
Outside United States or

Canada
Use the Worldwide Locator at http://www.rockwellautomation.com/support/americas/phone_en.html,

or contact your local Rockwell Automation representative.
New Product Satisfaction Return

Rockwell Automation tests all of its products to ensure that they are fully operational when shipped from the manufacturing facility.
However, if your product is not functioning and needs to be returned, follow these procedures.
United States
Contact your distributor. You must provide a Customer Support case number (call the phone number
above to obtain one) to your distributor to complete the return process.
Outside United States
Please contact your local Rockwell Automation representative for the return procedure.
Documentation Feedback
Your comments will help us serve your documentation needs better. If you have any suggestions on how to improve this
document, complete this form, publication RA-DU002, available at http://www.rockwellautomation.com/literature/.
Publication 1756-PM020A-EN-P - October 2009 66

Supersedes Publication 1756-RM005B-EN-E - March 2006
Copyright 2009 Rockwell Automation, Inc. All rights reserved. Printed in the U.S.A.

LOGIX5000 Data Access

Uploaded by

Copyright:

Available Formats

LOGIX5000 Data Access

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

LOGIX5000 Data Access

Uploaded by

Copyright:

Available Formats

Logix5000 Data Access

Catalog Numbers 1756 ControlLogix, 1756 GuardLogix,

Important User Information

Access Atomic Tags and Atomic Members of

Publication 1756-PM020A-EN-P - October 2009

PLC-2 Communication Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Word Range Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Publication 1756-PM020A-EN-P - October 2009

5Publication 1756-PM020A-EN-P - October 2009

Who Should Use This

Before using this document, make sure you:

Publication 1756-PM020A-EN-P - October 2009

DF1 Protocol and Command Set Reference Manual, 1770-6.5.16

Logix5000 Controllers Common Procedures Programming

Integration with ControlLogix Programmable Automation

Logix5000 Controllers Design Considerations Reference Manual

The Common Industrial Protocol, Pub 122(1)

The Common Industrial Protocol (CIP) and the Family of CIP

EtherNet/IP Quick Start for Vendors Handbook, Pub 213(1)

CIP Networks Library (Specifications) - subscription required,

You can view or download Rockwell Automation publications at

Publication 1756-PM020A-EN-P - October 2009

This document uses the following acronyms and terms.

Common Industrial Protocol.

Used to indicate the data type of parameters used in Tag services.

Programmable Controller Communication Command.

An older, chassis-based, modular programmable controller.

A chassis-based, modular programmable controller.

A small, chassis-based, modular programmable controller.

Status of the message transmission.

Character name of data.

User-defined data type.

Publication 1756-PM020A-EN-P - October 2009

Communicating with the Logix5000 controller requires using CIP explicit

CIP Services Overview

9Publication 1756-PM020A-EN-P - October 2009

CIP Data Types

Data Type Reporting Value

CIP Service Request/Response Format

CIP Data Types

Use this data type

DWORD (32-bit boolean array)

Publication 1756-PM020A-EN-P - October 2009

Publication 1756-PM020A-EN-P - October 2009

Data Type Reporting Value

Reserved Byte Order

Publication 1756-PM020A-EN-P - October 2009

Byte Order Representation of Element ID Value (low byte first)

Byte Order Representation of Class ID Value (low byte first)

Byte Order Representation of Instance ID Value (low byte first)

Byte Order Representation of Attribute ID Value (low byte first)

Publication 1756-PM020A-EN-P - October 2009

Byte Order Representation (low byte first)

Optional pad byte (00) when length of string (length) is odd.

CIP Service Request/Response Format

Indicates to the object referenced in the request path what task is to

Request Path Size

A byte value that indicates the number of 16-bit words in the

A variable sized field that consists of one or more segments. The

The service-specific data to be delivered to the object referenced in