PLX3x UM001

PLX3x Series
Multi-Protocol Gateways
May 10, 2019
USER MANUAL
Your Feedback Please
We always want you to feel that you made the right decision to use our products. If you have suggestions, comments,
compliments or complaints about our products, documentation, or support, please write or call us.
How to Contact Us
ProSoft Technology, Inc.
+1 (661) 716-5100
+1 (661) 716-5101 (Fax)
www.prosoft-technology.com
[email protected]
PLX3x Series User Manual
May 10, 2019
ProSoft Technology®, is a registered copyright of ProSoft Technology, Inc. All other brand or product names are or
may be trademarks of, and are used to identify products and services of, their respective owners.
In an effort to conserve paper, ProSoft Technology no longer includes printed manuals with our product shipments.
User Manuals, Datasheets, Sample Ladder Files, and Configuration Files are provided at our website:
http://www.prosoft-technology.com
Content Disclaimer
This documentation is not intended as a substitute for and is not to be used for determining suitability or reliability of
these products for specific user applications. It is the duty of any such user or integrator to perform the appropriate
and complete risk analysis, evaluation and testing of the products with respect to the relevant specific application or
use thereof. Neither ProSoft Technology nor any of its affiliates or subsidiaries shall be responsible or liable for
misuse of the information contained herein. Information in this document including illustrations, specifications and
dimensions may contain technical inaccuracies or typographical errors. ProSoft Technology makes no warranty or
representation as to its accuracy and assumes no liability for and reserves the right to correct such inaccuracies or
errors at any time without notice. If you have any suggestions for improvements or amendments or have found errors
in this publication, please notify us.
No part of this document may be reproduced in any form or by any means, electronic or mechanical, including
photocopying, without express written permission of ProSoft Technology. All pertinent state, regional, and local safety
regulations must be observed when installing and using this product. For reasons of safety and to help ensure
compliance with documented system data, only the manufacturer should perform repairs to components. When
devices are used for applications with technical safety requirements, the relevant instructions must be followed.
Failure to use ProSoft Technology software or approved software with our hardware products may result in injury,
harm, or improper operating results. Failure to observe this information can result in injury or equipment damage.
Copyright © 2019 ProSoft Technology, Inc. All Rights Reserved.
Printed documentation is available for purchase. Contact ProSoft Technology for pricing and availability.
North America: +1 (661) 716-5100
Asia Pacific: +603.7724.2080
Europe, Middle East, Africa: +33 (0) 5.3436.87.20
Latin America: +1.281.298.9109
Important Installation Instructions
Power, Input, and Output (I/O) wiring must be in accordance with Class I, Division 2 wiring methods, Article 501-4 (b)
of the National Electrical Code, NFPA 70 for installation in the U.S., or as specified in Section 18-1J2 of the Canadian
Electrical Code for installations in Canada, and in accordance with the authority having jurisdiction. The following
warnings must be heeded:
WARNING - EXPLOSION HAZARD - SUBSTITUTION OF COMPONENTS MAY IMPAIR SUITABILITY FOR CLASS
I, DIV. 2;
WARNING - EXPLOSION HAZARD - WHEN IN HAZARDOUS LOCATIONS, TURN OFF POWER BEFORE
REPLACING OR WIRING MODULES
WARNING - EXPLOSION HAZARD - DO NOT DISCONNECT EQUIPMENT UNLESS POWER HAS BEEN
SWITCHED OFF OR THE AREA IS KNOWN TO BE NON-HAZARDOUS.
Class 2 Power
Agency Approvals and Certifications

Please visit our website: www.prosoft-technology.com
For professional users in the European Union

If you wish to discard electrical and electronic equipment (EEE), please contact your dealer or supplier
for further information.
Warning – Cancer and Reproductive Harm – www.P65Warnings.ca.gov

PLX3x Series ♦ Multi-Protocol Gateways Contents
User Manual
Contents
Your Feedback Please ........................................................................................................................ 2
How to Contact Us .............................................................................................................................. 2
Content Disclaimer .............................................................................................................................. 2
Important Installation Instructions ....................................................................................................... 3
Agency Approvals and Certifications .................................................................................................. 3
1 Start Here 9
1.1 Overview.................................................................................................................... 9
1.2 System Requirements ............................................................................................. 10
1.3 Package Contents ................................................................................................... 10
1.4 Mounting the Gateway on a DIN-rail ....................................................................... 11
1.5 Jumper Settings ...................................................................................................... 12
1.6 SD Card ................................................................................................................... 13
1.7 Connecting Power to the Unit ................................................................................. 13
1.8 Installing ProSoft Configuration Builder Software ................................................... 14
2 Using ProSoft Configuration Builder 15

2.1 Connecting the PC to the Gateway ......................................................................... 15
2.2 Setting a Temporary IP Address in the Gateway .................................................... 15
2.3 Setting Up the Project ............................................................................................. 19
2.4 Disabling Gateway Ports ......................................................................................... 20
2.5 Configuring Gateway Parameters ........................................................................... 23
2.5.1 Renaming PCB Objects .......................................................................................... 23
2.5.2 Printing a Configuration File .................................................................................... 23
2.6 Configuring the Ethernet Port .................................................................................. 23
2.7 Mapping Data in Module Memory ........................................................................... 24
2.7.1 From Address .......................................................................................................... 26
2.7.2 To Address .............................................................................................................. 26
2.7.3 Register Count ........................................................................................................ 26
2.7.4 Swap Code .............................................................................................................. 26
2.7.5 Delay Preset ............................................................................................................ 26
2.8 Downloading the Project to the Gateway ................................................................ 27
2.9 Uploading the Project from the Gateway ................................................................ 29
3 Diagnostics and Troubleshooting 31

3.1 LED Indicators ......................................................................................................... 31
3.1.1 Main Gateway LEDs ................................................................................................ 32
3.1.2 Ethernet Port LEDs ................................................................................................. 33
3.1.3 Serial Port LEDs (for Gateways with Serial Ports) .................................................. 33
3.2 Using Diagnostics in ProSoft Configuration Builder ................................................ 33
3.2.1 Diagnostics Menu .................................................................................................... 36
3.2.2 Capturing a Diagnostic Session to a Log File ......................................................... 37
3.2.3 Using the Data Analyzer (Serial Protocols Only) .................................................... 38
3.2.4 Warm Boot / Cold Boot ............................................................................................ 39
3.3 Gateway Status Data in Upper Memory.................................................................. 40
3.3.1 General Gateway Status Data in Upper Memory .................................................... 40
ProSoft Technology, Inc. Page 5 of 215

Contents PLX3x Series ♦ Multi-Protocol Gateways
User Manual
3.3.2 Protocol-Specific Status Data in Upper Memory .................................................... 41
4 Hardware Information 43
4.1 Hardware Specifications ......................................................................................... 43
4.1.1 Serial Port Specifications ........................................................................................ 44
4.2 Serial Port Cables (for Gateways with Serial Ports) ............................................... 44
4.2.1 DB9 to RJ45 Adaptor (Cable 14) ............................................................................ 45
4.2.2 Serial Port Specifications ........................................................................................ 45
4.2.3 RS-232 - Null Modem (DTE without Hardware Handshaking) ............................... 46
4.2.4 RS-232 - DTE to DCE Modem Connection ............................................................ 46
4.2.5 RS-422 Interface Connections ................................................................................ 47
4.2.6 RS-485 Interface Connection ................................................................................. 47
5 EIP Protocol 49
5.1 EIP Functional Overview ........................................................................................ 49
5.1.1 EtherNet/IP General Specifications ........................................................................ 50
5.1.2 EIP Internal Database ............................................................................................. 51
5.2 EIP Configuration .................................................................................................... 53
5.2.1 Configuring EIP Class 3 Server .............................................................................. 53
5.2.2 Configuring EIP Class 1 Connection ...................................................................... 56
5.2.3 Configuring EIP Class 3 Client[x]/UClient Connection ........................................... 60
5.3 Network Diagnostics ............................................................................................... 70
5.3.1 EIP PCB Diagnostics .............................................................................................. 70
5.3.2 EIP Status Data in Upper Memory.......................................................................... 71
5.3.3 EIP Error Codes ...................................................................................................... 73
5.4 EIP Reference......................................................................................................... 76
5.4.1 SLC and MicroLogix Specifics ................................................................................ 76
5.4.2 PLC5 Processor Specifics ...................................................................................... 80
5.4.3 ControlLogix and CompactLogix Processor Specifics ............................................ 84
5.4.4 EIP Command Entry Form ...................................................................................... 93
6 MBTCP Protocol 95
6.1 MBTCP Functional Overview.................................................................................. 95
6.1.1 MBTCP General Specifications .............................................................................. 96
6.1.2 MBTCP Internal Database ...................................................................................... 97
6.2 MBTCP Configuration ........................................................................................... 101
6.2.1 Configuring MBTCP Servers ................................................................................ 101
6.2.2 Pass Through Feature .......................................................................................... 103
6.2.3 Configuring MBTCP Client [x] ............................................................................... 104
6.2.4 Configuring MBTCP Client [x] Commands ........................................................... 106
6.3 Network Diagnostics ............................................................................................. 108
6.3.1 MBTCP PCB Diagnostics ..................................................................................... 109
6.3.2 MBTCP Status Data in Upper Memory ................................................................. 109
6.3.3 MBTCP Error Codes ............................................................................................. 112
6.4 MBTCP Reference ................................................................................................ 113
6.4.1 About the Modbus Protocol .................................................................................. 113
Page 6 of 215 ProSoft Technology, Inc.

PLX3x Series ♦ Multi-Protocol Gateways Contents
User Manual
7 MBS Protocol 116

7.1 MBS Functional Overview ..................................................................................... 116
7.1.1 Modbus Serial Specifications ................................................................................ 117
7.1.2 Modbus Master/Slave Port Specifications ............................................................. 117
7.1.3 MBS Internal Database ......................................................................................... 118
7.2 MBS Configuration ................................................................................................ 120
7.2.1 Configuring MBS Port [x] ....................................................................................... 120
7.2.2 MBS Port [x] Commands ....................................................................................... 124
7.3 MBS Diagnostics ................................................................................................... 128
7.3.1 MBS PCB Diagnostics........................................................................................... 128
7.3.2 MBS Status Data in Upper Memory ...................................................................... 128
7.3.3 MBS Error Codes .................................................................................................. 133
7.4 MBS Reference ..................................................................................................... 134
8 ASCII Protocol 135

8.1 ASCII Functional Overview ................................................................................... 135
8.1.1 General Specifications .......................................................................................... 136
8.1.2 ASCII Data Flow .................................................................................................... 136
8.1.3 ASCII Internal Database........................................................................................ 139
8.1.4 ASCII Modes of Operation .................................................................................... 140
8.2 ASCII Configuration ............................................................................................... 142
8.2.1 ASCII Port [x] ......................................................................................................... 142
8.2.2 Configuring a Port for Receive-Only Mode ........................................................... 145
8.2.3 Configuring a Port for Transmit-Only Mode .......................................................... 145
8.2.4 Configuring a Port for Transmit-Receive Mode ..................................................... 145
8.2.5 Termination of Received Data ............................................................................... 145
8.3 ASCII Diagnostics ................................................................................................. 147
8.3.1 ASCII PCB Diagnostics ......................................................................................... 147
8.3.2 ASCII Status Data in Upper Memory .................................................................... 148
9 SIE Protocol 153

9.1 SIE Functional Overview ....................................................................................... 153
9.1.1 SIE General Specifications.................................................................................... 154
9.1.2 SIE Gateway Internal Database ............................................................................ 154
9.2 SIE Configuration .................................................................................................. 157
9.2.1 Configuring SIE Client [x] Connection ................................................................... 157
9.2.2 Configuring SIE Client x Commands ..................................................................... 158
9.3 SIE Diagnostics ..................................................................................................... 170
9.3.1 SIE PCB Diagnostics ............................................................................................. 170
9.3.2 SIE Status Data in Upper Memory ........................................................................ 171
9.3.3 SIE Error Codes .................................................................................................... 172
9.4 SIE Reference ....................................................................................................... 174
9.4.1 SIE CPU315-2 DP ................................................................................................. 174
9.4.2 SIE CPU1212C ..................................................................................................... 176
9.4.3 SIE CPU224XP ..................................................................................................... 178
10 PND Protocol 181

10.1 PND Functional Overview ..................................................................................... 181
10.1.1 PND General Specifications .................................................................................. 181

Contents PLX3x Series ♦ Multi-Protocol Gateways
User Manual
10.1.2 PND Internal Database ......................................................................................... 182

10.2 PND Configuration ................................................................................................ 183
10.2.1 Configuring PIE Connection ................................................................................. 186
10.2.2 Configuring PND Module Map .............................................................................. 187
10.3 Step 7 Configuration ............................................................................................. 188
10.3.1 Installing a GSD File ............................................................................................. 190
10.3.2 Configuring the PLX3x Gateway in Step 7 ........................................................... 192
10.3.3 Monitoring Data Values ........................................................................................ 201
10.3.4 Creating a Variable Table to Display Floating Point Input Values ........................ 203
10.4 PND Diagnostics ................................................................................................... 205
10.4.1 PND PCB Diagnostics .......................................................................................... 205
10.4.2 PND Status Data in Upper Memory ...................................................................... 205
10.4.3 Input/Output Error Message Status Codes ........................................................... 206
10.4.4 Configuration Error Codes .................................................................................... 206
10.5 PND Performance ................................................................................................. 207
11 Support, Service & Warranty 209

11.1 Contacting Technical Support............................................................................... 209
11.2 Warranty Information ............................................................................................ 211
Index 213

PLX3x Series ♦ Multi-Protocol Gateways Start Here
User Manual
1 Start Here
In This Chapter
 Overview ................................................................................................. 9
 System Requirements ........................................................................... 10
 Package Contents ................................................................................. 10
 Mounting the Gateway on a DIN-rail ..................................................... 11
 Jumper Settings .................................................................................... 12
 SD Card................................................................................................. 12
 Connecting Power to the Unit ................................................................ 13
 Installing ProSoft Configuration Builder Software .................................. 14
To get the most benefit from this User Manual, you should have the following
skills:
 PLC or PAC configuration software: Launch the program and use it to
configure the processor if required
 Microsoft Windows®: Install and launch programs, execute menu
commands, navigate dialog boxes, and enter data
 Hardware installation and wiring: Install the module, and safely connect
devices to a power source and to the PLX3x gateway port(s)
1.1 Overview
This document explains the features of the PLX3x gateway. It guides you through
configuration, showing how to map data between a device or network, through
the gateway, to a PLC or PAC. The ProSoft Configuration Builder software
creates files to import into the PLC or PAC programming software, integrating the
gateway into your system. You can also map data between areas in the
gateway's internal database. This allows you to copy data to different addresses
within the gateway database in order to create easier data requests and control.
The PLX3x gateways are stand-alone DIN-rail mounted units that provide one
Ethernet port for communications, remote configuration, and diagnostics. Your
specific gateway may include additional ports depending on the supported
protocols. The module has an SD Card slot (SD card optional) that allows you to
store configuration files that you can use for recovery, transferring the
configuration to another gateway, or general configuration backup.

Start Here PLX3x Series ♦ Multi-Protocol Gateways
User Manual
1.2 System Requirements

The ProSoft Configuration Builder configuration software for the PLX3x gateway
requires the following minimum hardware and software components:
 Pentium® II 450 MHz minimum. Pentium III 733 MHz (or better)
recommended
 128 Mbytes of RAM minimum, 256 Mbytes of RAM recommended
 100 Mbytes of free hard disk space (or more based on application
requirements)
 256-color VGA graphics adapter, 800 x 600 minimum resolution (True Color
1024  768 recommended)
Supported operating systems:

 Microsoft Windows 7 (32 bit) (64bit not tested)
 Microsoft Windows Vista (not tested)
 Microsoft Windows XP Professional with Service Pack 1 or 2
 Microsoft Windows 2000 Professional with Service Pack 1, 2, or 3 (not
tested)
 Microsoft Windows Server 2003 (not tested)
1.3 Package Contents

The following components are included with your PLX3x gateway, and are all
required for installation and configuration. The quantity of cables provided
depends on the specific protocol combination for your gateway.
Important: Before beginning the installation, please verify that all of the following items are
present.
Gateway with Ethernet Port

Qty. Part Name Part Number Part Description
1 Mini screwdriver HRD250 Tool for wiring and securing the power connector
1 Power connector J180 PLX3x gateway power connector
Gateway with Two Ethernet Ports

1 Power connector J180 PLX3x gateway power connector

User Manual
Gateway with Ethernet Port and Single Serial Port

1 DB9 to Screw 1454-9F DB9 to screw terminal adapter
Terminal Adaptor
1 RJ45-DB9M Serial CABLE14 RJ45 to DB9 male serial adapter cable
Adapter Cable
1 Power Connector J180 PLX3x gateway power connector
Gateway with Ethernet Port and Four Serial Ports

4 DB9 to Screw 1454-9F DB9 to screw terminal adapter
Terminal Adaptor
4 RJ45-DB9M Serial CABLE14 RJ45 to DB9 male serial adapter cable
Adapter Cable
1 Power Connector J180 PLX3x gateway power connector
1.4 Mounting the Gateway on a DIN-rail
To mount the PLX3x gateway on a DIN-rail, follow these steps.

1 Position the gateway on the DIN-rail B at a slight angle.
2 Hook the lip on the rear of the adapter onto the top of the DIN-rail, and rotate
the adapter onto the rail.
3 Press the adapter down onto the DIN-rail until flush. The locking tab snaps
into position and lock the module to the DIN-rail.
4 If the adapter does not lock in place, use a screwdriver or similar device to
move the locking tab down while pressing the adapter flush onto the DIN-rail
and release the locking tab to lock the adapter in place. If necessary, push up
on the locking tab to lock.

User Manual
1.5 Jumper Settings

There are three pairs of jumper pins located on the back of the module.
 MODE 1 - The two pins should be jumpered during normal operation.
 MODE 2 - Default IP Jumper: This is the middle jumper. The default IP

address of the gateway is 192.168.0.250. Set this jumper to put the
gateway's IP address back to the default.
 MODE 3 – If set, this jumper provides a level of security resulting in the

following behaviors:
o This jumper disables ProSoft Configuration Builder (PCB) upload

and download functions. If an upload or download request is made
through PCB, the error message “Error: This module has been
secured. Jumper 3 has been pinned” is displayed. This feature
is supported on PCB version 4.4.15 and above.
o If a previous version of PCB is installed and Jumper Mode 3 is set,

the configuration cannot be uploaded/downloaded to the unit and
PCB reports the following error: “Cannot connect to the module
– Check IP address and connection: 405”.
o This jumper also disables access to the PLX3x web page, making
it impossible to upgrade the firmware.
o This jumper position is recognized even if changed after module

initialization.
o Applies to all modules with firmware version 1.04.

User Manual
1.6 SD Card
You can order a PLX3x gateway with an optional SD card (Part Number SDI-1G).
In the event of a module failure, you can move the SD card from one module to
the next and resume operation.
In general, if the SD card is present when you power up or reboot the module,
the module uses the configuration on the SC card.
With an SD Card
 PCB downloads the configuration to the SD Card in the module.
 The module does not transfer the configuration data from the SD card to
internal memory. If you remove the SD card and reboot to the module, the
module loads the configuration data from the module’s memory. If there is no
configuration data in the module’s memory, the module uses the factory
default configuration.
Without an SD Card
 PCB downloads the configuration to the module’s internal memory.
 If you insert a blank SD Card into the module after the module has been
configured, the module does not use the configuration on the SD card unless
you reboot the module. If you want to copy the configuration to the SD card,
you must download the configuration while the SD card is in the module.
1.7 Connecting Power to the Unit
WARNING: Be sure not to reverse polarity when applying power to the gateway. This causes
permanent damage to the gateway’s internal power distribution circuits.

User Manual
1.8 Installing ProSoft Configuration Builder Software

You must install the ProSoft Configuration Builder (PCB) software to configure
the gateway. You can always get the newest version of ProSoft Configuration
Builder from the ProSoft Technology website
(http://www.prosoft-technology.com). The filename contains the version of PCB.
For example, PCB_4.4.3.4.0245.exe.
To install ProSoft Configuration Builder from the ProSoft Technology website

1 Open your web browser and navigate to www.prosoft-technology.com.
2 Search for 'PCB' or 'ProSoft Configuration Builder'.
3 Click on the ProSoft Configuration Builder search result link.
4 From the Downloads link, download the latest version of ProSoft
Configuration Builder.
5 Choose SAVE or SAVE FILE, if prompted.
6 Save the file to your Windows Desktop, so that you can find it easily when
you have finished downloading.
7 When the download is complete, locate and open the file, and then follow the
instructions on your screen to install the program.
Note: To use the ProSoft Configuration Builder under the Windows 7 OS, you must be sure to
install it using the Run as Administrator option. To find this option, right-click the Setup.exe
program icon, and then click RUN AS ADMINISTRATOR on the context menu. You must install using
this option even if you are already logged in as an Administrator on your network or personal
computer (PC). Using the Run as Administrator option allows the installation program to create
folders and files on your PC with proper permissions and security.
If you do not use the Run as Administrator option, the ProSoft Configuration Builder may appear to
install correctly, but you will receive multiple file access errors whenever the ProSoft Configuration
Builder is running, especially when changing configuration screens. If this happens, you must
completely uninstall the ProSoft Configuration Builder and then re-install using the Run as
Administrator option to eliminate the errors.

PLX3x Series ♦ Multi-Protocol Gateways Using ProSoft Configuration Builder
User Manual
2 Using ProSoft Configuration Builder
ProSoft Configuration Builder (PCB) provides a quick and easy way to manage
gateway configuration files customized to meet your application needs. PCB is
not only a powerful solution for new configuration files, but also allows you to
import information from previously installed (known working) configurations to
new projects.
2.1 Connecting the PC to the Gateway

With the module securely mounted, connect one end of the Ethernet cable to the
ETH 1 Port, and the other end to an Ethernet hub or switch accessible from the
same network as the PC. Or, connect directly from the Ethernet Port on the PC
to the ETH 1 Port on the module.
2.2 Setting a Temporary IP Address in the Gateway
Important: ProSoft Discovery Service (PDS) locates the gateway through UDP broadcast
messages. PDS is an application that is built into PCB. These messages may be blocked by
routers or layer 3 switches. In that case, PDS is unable to locate the gateways.
To use PDS, arrange the Ethernet connection so that there is no router or layer 3 switch between
the computer and the gateway OR reconfigure the router or layer 3 switch to allow the routing of
the UDP broadcast messages.

Using ProSoft Configuration Builder PLX3x Series ♦ Multi-Protocol Gateways
User Manual
1 To open PDS, right-click on the gateway icon in PCB and click on

DIAGNOSTICS.
2 In the Diagnostics dialog box, click on the CONNECTION SETUP icon.

User Manual
3 In the Connection Setup dialog box, click the BROWSE DEVICE(S) button under
the ProSoft Discovery Service (PDS) heading.
4 In the ProSoft Discovery Service dialog box, click on the BROWSE FOR
PROSOFT MODULES icon to search for ProSoft Technology modules on the
network.

User Manual
5 Right-click module, and then select ASSIGN TEMPORARY IP.
6 The module’s default IP address is 192.168.0.250.
7 Enter an unused IP within your subnet, and then click OK.

8 See Configuring the Ethernet Port (page 23) for the steps to set the
permanent IP address in the gateway.

User Manual
2.3 Setting Up the Project

To begin, start ProSoft Configuration Builder (PCB). If you have used other
Windows configuration tools before, you will find the screen layout familiar. The
ProSoft Configuration Builder (PCB) window consists of a tree view on the left,
an information pane, and a configuration pane on the right side of the window.
When you first start PCB, the tree view consists of folders for Default Project and
Default Location, with a Default Module in the Default Location folder. The
following illustration shows the PCB window with a new project.

User Manual
To add the gateway to the project

1 Right-click DEFAULT MODULE in the tree view, and then choose CHOOSE
MODULE TYPE. This opens the Choose Module Type dialog box.
2 In the Product Line Filter area of the dialog box, select the appropriate
product type radio button.
3 In the STEP 1: Select Module Type dropdown list, select the model number
that matches your gateway.
4 For some gateways, you can disable one or more ports on the gateway if you
do not need them. See Disabling Gateway Ports (page 20).
5 Click OK to save your settings and return to the PCB Main window.
2.4 Disabling Gateway Ports

For some gateways, ProSoft Configuration Builder (PCB) gives you the option to
disable one or more ports if you do not need them. Disabling ports can simplify
the number of configuration options, making it easier to set up the gateway.
It is easiest to disable ports when you add the gateway to the project in PCB;
however, you can enable and disable ports after you have added it to the project.
Both methods are described in this topic.
Note: Disabling ports does not affect the performance of the gateway and is not required.

User Manual
To disable ports on the gateway when you add it to the project

The best time to disable one or more ports on a gateway is when you add the
gateway to the project in PCB. See Setting Up the Project (page 19) for the steps
to add a gateway. You can disable ports in the Choose Module Type dialog box
after you select the module you want to add to the project. The following image
gives an example.
There are two ports disabled. Please note the following:

 Ports that you can disable have UNCHECK IF NOT USED in the ACTION
REQUIRED column.
 Click the port name to disable the port. When you disable a port, a red circle
replaces the green checkmark (MBS Port 3 in this example).
 If there are multiple ports of the same type, only the last one has the
UnCheck if not Used message (MBS Port 2). You can disable and enable
ports only in reverse order. In this example, MBS Port 4 was disabled before
MBS Port 3.
 If you disable multiple ports of the same type, a yellow triangle replaces the
red circle for the port(s) that you disabled first (MBS Port 4).
 Finally, if you want to enable a disabled port in this dialog box, click the port
name again. Remember that you can enable ports only in order. In this
example, you must enable MBS Port 3 before you can enable MBS Port 4.

User Manual
When you click OK, PCB inserts the gateway into the tree view with the disabled
configuration options hidden.
Note that MBS Port 3 and MBS Port 4 do not appear in the configuration options
for the gateway.
To disable or enable ports on the gateway after you add it to the project
1 Right-click the gateway (PLX31-EIP-MBS4 in this example) in the tree view,
and then choose CHOOSE MODULE TYPE. This opens the Choose Module
Type dialog box, with the correct MODULE TYPE.
Warning: Note that all of the ports are enabled by default, and that the port state in the Choose
Module Type dialog box DOES NOT MATCH THE ACTUAL STATE OF THE PORTS. If you want
any disabled ports to remain disabled, you must disable them again in this dialog box so that the
red circle or yellow triangle appears next to the port name.
2 Click the port name to change its status from enabled to disabled, or from
disabled to enabled. The same rules noted above still apply. For example,
you can disable MBS Port 3 only if MBS Port 4 is already disabled.
3 When you click OK, PCB updates the gateway in the tree view, showing the
configuration options for the enabled ports, and hiding the disabled ports.

User Manual
2.5 Configuring Gateway Parameters

1 Click the [+] sign next to the module icon to expand gateway information.
2 Click the [+] sign next to any icon to view gateway information and
configuration options.
3 Double-click any icon to open an Edit dialog box.
4 To edit a parameter, select the parameter in the left pane and make your
changes in the right pane.
5 Click OK to save your changes.
2.5.1 Renaming PCB Objects

You can rename objects such as the Default Project and Default Location folders
in the tree view. You can also rename the MODULE icon to customize the project.
1 Right-click the object you want to rename and then choose RENAME.
2 Type the new name for the object and press Enter.
2.5.2 Printing a Configuration File

1 In the main PCB window, right-click the PLX3X GATEWAY icon and then
choose VIEW CONFIGURATION.
2 In the View Configuration dialog box, click the FILE menu and click PRINT.
3 In the Print dialog box, choose the printer to use from the drop-down list,
select the printing options, and click OK.
2.6 Configuring the Ethernet Port

This section shows how to set the Ethernet port parameters for the PLX3x
gateway.
To configure the Ethernet port in PCB

1 In the ProSoft Configuration Builder tree view, double-click the Ethernet
Configuration icon.

User Manual
2 Click any parameter in the Edit - WATTCP dialog box to change the value. If
your gateway has two Ethernet ports (PLX32) there are separate
configuration options for each port.
Parameter Description
IP Address Unique IP address assigned to the module
Netmask Subnet mask of module
Gateway Gateway (if used)
Note: Each Ethernet port must be on a different Ethernet subnet.
To determine the protocol for an Ethernet port in PCB (PLX32 only)

1 In ProSoft Configuration Builder, click the [+] next to the gateway, then click
the [+] next to Module.
2 Double-click the second Module icon.

3 In the Edit - Module dialog box, click the port to see the protocol for that port.
You cannot change the protocol assigned to a port.
2.7 Mapping Data in Module Memory

Use the DATA MAP section in the ProSoft Configuration Builder to copy data
between areas in the gateway's internal database. This allows you to copy data
to different addresses within the gateway database in order to create simpler
data requests and control. You can use this feature for the following tasks.
 Copy a maximum of 100 registers per Data Map command, and you can
configure a maximum of 200 separate copy commands.
 Copy data from the error or status tables in upper memory to internal
database registers in the user data area.
 Rearrange the byte and/or word order during the copy process. For example,
by rearranging byte or word order, you can convert floating-point values to
the correct format for a different protocol.
 Use the Data Map to condense widely dispersed data into one contiguous
data block, making it easier to access.

User Manual
1 In the ProSoft Configuration Builder, expand the module tree by clicking the
[+] next to the module name.
2 Click the [+] next to COMMONNET, and then double-click DATA MAP.
3 In the Edit - Data Map dialog box, click ADD ROW.
4 Click EDIT ROW to edit the parameters for the mapping.
5 To change the value of a parameter, click the parameter and enter a new
value. Click OK when finished.
6 Repeat the steps above to add more memory mappings.

User Manual
2.7.1 From Address

0 to highest Status Data address
Specifies the beginning internal database register address for the copy operation.
This address can be any valid address in the user data area or the status data
area of the gateway.
2.7.2 To Address
0 to 3999
Specifies the beginning destination register address for the copy operation. This
address must always be within the user data area. Make sure you specify a
destination address that does not overwrite data that is stored in memory by one
of the communication protocols running on the gateway.
2.7.3 Register Count

1 to 100
Specifies the number of registers to copy.
2.7.4 Swap Code

NO CHANGE, WORD SWAP, WORD AND BYTE SWAP, BYTE SWAP
You may need to swap the order of the bytes in the registers during the copy
process in order to change the alignment of bytes between different protocols.
Use this parameter when dealing with floating-point or other multi-register values,
because there is no standard for storage of these data types in slave devices.
Swap Code Description
No Swap No change is made in the byte ordering (1234 = 1234)
Word Swap The words are swapped (1234 = 3412)
Word and Byte The words are swapped, then the bytes in each word are swapped (1234 =
Swap 4321)
Bytes The bytes in each word are swapped (1234 = 2143)
2.7.5 Delay Preset

This parameter sets an interval for each Data Map copy operation. The value for
the Delay Preset is not a fixed amount of time. It is the number of firmware scans
that must transpire between copy operations.
The firmware scan cycle can take a variable amount of time, depending on the
level of activity of the protocol drivers running on the gateway and the level of
activity on the gateway's communication ports. Each firmware scan can take from
one to several milliseconds to complete. Therefore, Data Map copy operations
cannot be expected to happen at regular intervals.

User Manual
If multiple copy operations (several rows in the Data map section) happen too
frequently or all happen in the same update interval, they could delay the process
scan of the gateway protocols, which could result in slow data updates or missed
data on communication ports. To avoid these potential problems, set the Delay
Preset to different values for each row in the Data Map section and set them to
higher, rather than lower, numbers.
For example, Delay Preset values below 1000 could cause a noticeable delay in
data updates through the communication ports. Do not set all Delay Presets to
the same value. Instead, use different values for each row in the Data Map such
as 1000, 1001, and 1002 or any other different Delay Preset values you like. This
prevents the copies from happening concurrently and prevents possible process
scan delays.
2.8 Downloading the Project to the Gateway
Note: For instructions on connecting to the module with your PC, see Connecting the PC to the
Gateway (page 15).
In order for the module to use the settings you configured, you must download
(copy) the updated Project file from your PC to the module.
Note: If jumper 3 of the module is set, this function is not available.
1 In the tree view in ProSoft Configuration Builder, right-click the PLX3X
GATEWAY icon and then choose DOWNLOAD FROM PC TO DEVICE. This opens
the Download dialog box.
2 In the Download dialog box, in the Select Connection Type dropdown box,
use the default ETHERNET option.
Note: If you connected to the module using a temporary IP address, the
Ethernet address field contains that temporary IP address. ProSoft
Configuration Builder uses this temporary IP address to connect to the
module.

User Manual
3 Click TEST CONNECTION to verify that the IP address allows access to the
module.
4 If the connection succeeds, click DOWNLOAD to transfer the Ethernet
configuration to the module.
If the Test Connection procedure fails, you will see an error message. To correct
the error, follow these steps.
1 Click OK to dismiss the error message.
2 In the Download dialog box, click BROWSE DEVICE(S) to open ProSoft
Discovery Service.
3 Right-click the module and then choose SELECT FOR PCB.

4 Close ProSoft Discovery Service.
5 Click DOWNLOAD to transfer the configuration to the module.

User Manual
2.9 Uploading the Project from the Gateway
Note: For instructions on connecting to the module with your PC, see Connecting the PC to the
Gateway (page 15).
You can upload the project settings from the PLX3x gateway into the current
project in ProSoft Configuration Builder on your PC.
1 In the tree view in ProSoft Configuration Builder, right-click the PLX3X
GATEWAY icon and then choose UPLOAD FROM DEVICE TO PC. This opens the
Upload dialog box.
2 In the Upload dialog box, in the Select Connection Type dropdown box, use
the default ETHERNET setting.
Note: If you connected to the module using a temporary IP address, the
Ethernet address field contains that temporary IP address. ProSoft
Configuration Builder uses this temporary IP address to connect to the
module.
3 Click TEST CONNECTION to verify that the IP address allows access to the
module.
4 If the connection succeeds, click UPLOAD to transfer the Ethernet
configuration to the PC.

User Manual
If the Test Connection procedure fails, you will see an error message. To correct
the error, follow these steps.
1 Click OK to dismiss the error message.
2 In the Upload dialog box, click BROWSE DEVICE(S) to open ProSoft Discovery
Service.
3 Right-click the module and then choose SELECT FOR PCB.

4 Close ProSoft Discovery Service.
5 Click DOWNLOAD to transfer the configuration to the module.

PLX3x Series ♦ Multi-Protocol Gateways Diagnostics and Troubleshooting
User Manual
3 Diagnostics and Troubleshooting
In This Chapter
 LED Indicators ....................................................................................... 31
 Using Diagnostics in ProSoft Configuration Builder ............................... 33
 Gateway Status Data in Upper Memory ................................................ 40
You can troubleshoot the module using several methods:

 Monitor the LED indicators on the gateway.
 Use the Diagnostics functions in ProSoft Configuration Builder (PCB).
 Examine the data in the status data area (upper memory) of the gateway
internal memory.
3.1 LED Indicators

The first and quickest is to scan the LEDs on the gateway to determine the
existence and possible cause of a problem. The LEDs provide valuable
information such as:
 The state of each port
 System configuration errors
 Application errors
 Fault indications

Diagnostics and Troubleshooting PLX3x Series ♦ Multi-Protocol Gateways
User Manual
3.1.1 Main Gateway LEDs

This table describes the gateway front panel LEDs.
LED State Description

PWR Off Power is not connected to the power terminals or source is
(Power) insufficient to properly power the gateway (208 mA at 24 VDC is
required).
Solid Green Power is connected to the power terminals.
FLT Off Normal operation.
(Fault)
Solid Red A critical error has occurred. Program executable has failed or
has been user-terminated and is no longer running. Press the
Reset button or cycle power to clear the error.
CFG Off Normal operation.
(Configura
Solid Amber The unit is in configuration mode. Either a configuration error
tion)
exists, or the configuration file is being downloaded or read. After
power-up, the gateway reads the configuration, and the unit
implements the configuration values and initializes the hardware.
This occurs during power cycle or after you press the Reset
button.
ERR Off Normal operation.
(Error) FlashingAmber An error condition has been detected and is occurring on one of
the application ports. Check configuration and troubleshoot for
communication errors.
Solid Amber This error flag is cleared at the start of each command attempt
(master/client) or on each receipt of data (slave/adapter/server). If
this condition exists, it indicates a large number of errors are
occurring in the application (due to bad configuration) or on one or
more ports (network communication failures).
NS Off No power or no IP address
(Network
Solid Red Duplicate IP address
Status) for
EIP Solid Green Connected
protocol Flashing Red Connection timeout
only
Flashing Green IP address obtained; no established connections
Alternating Red Self-test
and Green Flash
MS Off No power
(Module
Solid Red Major fault
Status) for
EIP Solid Green Device operational
protocol Flashing Red Minor fault
only
Flashing Green Standby
Alternating Red Self-test
and Green Flash

User Manual
3.1.2 Ethernet Port LEDs

This table describes the gateway Ethernet port LEDs.

LINK/ACT Off No physical network connection is detected. No Ethernet
communication is possible. Check wiring and cables.
Solid Green Physical network connection detected. This LED must be
ON solid for Ethernet communication to be possible.
100 Mbit Off No activity on the port.
Flashing Amber The Ethernet port is actively transmitting or receiving data.
3.1.3 Serial Port LEDs (for Gateways with Serial Ports)

This table describes gateway serial port LEDs.

RX Off No activity on the port.
Flashing Green The port is actively receiving data.
TX Off No activity on the port.
Flashing Amber The port is actively transmitting data.
3.2 Using Diagnostics in ProSoft Configuration Builder

ProSoft Configuration Builder (PCB) has many useful tools to help you with
diagnostics and troubleshooting. You can use PCB to connect to your gateway
and retrieve current status values, configuration data and other valuable
information.
Tip: You can have a ProSoft Configuration Builder Diagnostics window open for more than one
gateway at a time.

User Manual
To connect to the gateway’s communication port.

1 In PCB, right-click the gateway name and choose DIAGNOSTICS.
This opens the Diagnostics window.
Note: The image above is for a specific version of the PLX3x gateway. The contents of the
Diagnostics window for your module depends on the protocols supported by the gateway.
See Diagnostics Menu (page 36) for more information. If there is no response
from the gateway, as in the example above, follow these steps:

User Manual
2 From the toolbar, click the SETUP CONNECTION button.
3 In the Connection Setup dialog box, select ETHERNET from the SELECT
CONNECTION TYPE list.
4 Type in the gateway’s IP address in the ETHERNET field.
5 Click CONNECT.
6 Verify that the Ethernet is connected properly between your computer’s
communication port and the gateway.
7 If you are still not able to establish a connection, contact ProSoft Technology
Technical Support for assistance.

User Manual
3.2.1 Diagnostics Menu

The Diagnostics menu is arranged as a tree structure in the left side of the
Diagnostics window. The available menu commands depend on the protocols
supported in your PLX3x gateway.
Caution: Some of the commands from this menu are designed for advanced debugging and
system testing only, and can cause the gateway to stop communicating, potentially resulting in
data loss or other communication failures. Use these commands only if you fully understand their
potential effects, or if you are specifically directed to do so by ProSoft Technology Technical
Support engineers.
The following menu commands are common to all PLX3x gateways:

Menu Submenu Description
Command Command
Module Version Displays the gateway’s current software version and other
important values. You may be asked to provide this information
when calling for technical support.
Data Map Displays the gateway’s Data Map configuration.
Database ASCII Displays the contents of the gateway’s database in ASCII
View character format.*
Decimal Displays the contents of the gateway’s database in decimal
number format.*
Hex Displays the contents of the gateway’s database in hexadecimal
number format.*
Float Displays the contents of the gateway’s database in floating-point
number format.*
*Use the scroll bar on the right edge of the window to navigate through the
database. Each page displays 100 words of data. The total number of pages
available depends on your gateway’s configuration.

User Manual
3.2.2 Capturing a Diagnostic Session to a Log File

You can capture anything you do in a Diagnostics session to a log file. This
feature can be useful for troubleshooting and record-keeping purposes, and for
communication with ProSoft Technology’s Technical Support team.
To capture session data to a log file

1 Open a Diagnostics window. See Using Diagnostics in ProSoft Configuration
Builder (page 33).
2 To log a Diagnostics session to a text file, from the toolbar, click the LOG FILE
button. Click the button again to stop the capture.
3 To view the log file, from the toolbar, click the VIEW LOG FILE button. The log
file opens as a text file, which you can rename and save to a different
location.
4 To email the log file to ProSoft Technology’s Technical Support team, from
the toolbar, click the EMAIL LOG FILE button. This only works if you have
installed Microsoft Outlook on your PC.)
5 If you capture multiple sequential sessions, PCB appends the new data to the
end of the previously captured data. If you want to clear the previous data
from the log file, you must click the CLEAR DATA button each time before you
start capturing data.

User Manual
3.2.3 Using the Data Analyzer (Serial Protocols Only)

The Data Analyzer is an extremely valuable troubleshooting tool available in
ProSoft Configuration Builder. It allows you to "see" the data packets entering
and leaving the serial ports on the gateway. You can also capture this data to a
log file.
Note: The PCB Data Analyzer is for serial ports only. To analyze data traffic on an Ethernet port,
ProSoft Technology recommends using a network protocol analyzer available on the Internet, such
as Wireshark.
To use the Data Analyzer

1 Open a Diagnostics window. See Using Diagnostics in ProSoft Configuration
Builder (page 33).
2 From the toolbar, click the SETUP DATA ANALYZER button.
3 In the Data Analyzer Setup dialog box, specify the time tick interval, the serial
port number, and whether the data packet contents should be displayed in
hexadecimal number or ASCII character format. Click OK.
Note: The time tick is a symbol (_TT_) displayed on the Data Analyzer screen that allows you to
estimate time intervals during a Data Analyzer session. The time tick prints at the time interval you
choose in the Data Analyzer Setup dialog box. For example, if you select 10 mS Ticks, it prints
_TT_ every 10 milliseconds.
4 If you wish to capture the Data Analyzer session to a log file, from the toolbar,
click the LOG FILE button.

User Manual
5 From the toolbar, click the START DATA ANALYZER button to start the Data
Analyzer. Click the button again to stop it.
The example below is part of a capture of standard Modbus data packets,

displayed in hexadecimal number format.
 Data LEAVING the serial port is enclosed in angle brackets <>.
 Data ENTERING the port is enclosed in square brackets [ ].
 Each set of brackets holds one word (2 bytes) of data.
For Modbus protocol users: To interpret the data packets, refer to the Modbus Protocol
Specification. See About the Modbus Protocol (page 113) or visit www.modbus.org.
3.2.4 Warm Boot / Cold Boot

Warm and Cold booting the PLX3x gateway can be done by clicking MODULE >
GENERAL > WARM BOOT or COLD BOOT.

User Manual
3.3 Gateway Status Data in Upper Memory

The gateway writes useful module status data in dedicated upper memory
locations in its internal database. The location of this status data area depends
on the protocols supported by your gateway. You can use the Data Map function
in Prosoft Configuration Builder to map this data into the user data area of the
gateway’s database (registers 0 through 3999). Remote devices, such as HMIs
or processors can then access the status data. See Mapping Data in Module
Memory (page 24).
3.3.1 General Gateway Status Data in Upper Memory

The following table describes the contents of the gateway’s general status data
area.
Register Address Description

4000 through 4001 Program Cycle Counter
4002 through 4004 Product Code (ASCII)
4005 through 4009 Product Revision (ASCII)
4010 through 4014 Operating System Revision (ASCII)
4015 through 4019 OS Run Number (ASCII)

User Manual
3.3.2 Protocol-Specific Status Data in Upper Memory

The PLX3x gateway also has upper memory locations for protocol-specific status
data. The location of the status data area for the gateway protocol drivers
depend on the protocols. For more information, see:
 EIP Status Data in Upper Memory (page 71)
 MBTCP Status Data in Upper Memory (page 109)
 MBS Status Data in Upper Memory (page 128)
 ASCII Status Data in Upper Memory (page 148)
 SIE Status Data in Upper Memory (page 171)
 PND Status Data in Upper Memory (page 205)

PLX3x Series ♦ Multi-Protocol Gateways
User Manual

PLX3x Series ♦ Multi-Protocol Gateways Hardware Information
User Manual
4 Hardware Information
In This Chapter
 EIP Functional Overview ....................................................................... 43
 Serial Port Cables (for Gateways with Serial Ports) .............................. 44
4.1 Hardware Specifications

Specification Description
Power Supply 24 VDC nominal
10 VDC to 36 VDC allowed
Positive, Negative, GND Terminals
Current Load 208 mA normal @ 24 VDC normal
300 mA maximum @ 36 VDC maximum
Operating Temperature -25°C to 70°C (-13°F to 158°F)
Storage Temperature -40°C to 80°C (-40°F to 176°F)
Relative Humidity 5% to 95% RH with no condensation
Dimensions 5.38 x 1.99 x 4.38 in
(H x W x D) 13.67 x 5.05 x 11.13 cm
LED Indicators  Configuration (CFG) and Error (ERR) Communication Status
(On all gateways)  Power (PWR) and Hardware Fault (FLT)
 Network Status (NS) EtherNet/IP™ Class I or Class III Connection Status
(EtherNet/IP Only)
 Module Status (MS) Module Configuration Status (EtherNet/IP Only)
 Ethernet Communication Port Link/Activity and 100 mbit
 Serial Communication Port Receive (RX) and Transmit (TX)
Ethernet Port(s) 10/100 Mbit full-duplex RJ45 Connector Electrical Isolation 1500 Vrms at 50 Hz
to 60 Hz for 60 seconds, applied as specified in section 5.3.2 of IEC 60950:
1991
Ethernet Broadcast Storm Resiliency = less than or equal to 5000 [ARP]
frames-per-second and less than or equal to 5 minutes duration
Serial Port Isolation 2500 Vrms port signal isolation per UL 1577
serial port communication signal uses RF (Radio Frequency) modulation signal
as isolation media, IC chip model is Silicon Labs Si844x
(Si8440,Si8441,Si8442).
Shipped With Each 2.5 mm screwdriver
Unit J180 Power Connector
(1 to 4) RJ45-DB9M Serial Adapter Cable (serial protocol only)
(1 to 4) DB9 to Screw Terminal Adapter (serial protocol only)

Hardware Information PLX3x Series ♦ Multi-Protocol Gateways
User Manual
4.1.1 Serial Port Specifications
Type Specifications
Serial Port Isolation 2500 Vrms port signal isolation per UL 1577
serial port communication signal uses RF (Radio Frequency)
modulation signal as isolation media, IC chip model is Silicon
Labs Si844x (Si8440,Si8441,Si8442).
Serial Port Protection RS-485/422 port interface lines TVS diode protected at +/- 27V
standoff voltage.
RS-232 port interface lines fault protected to +/- 36V power on,
+/- 40V power off.
4.2 Serial Port Cables (for Gateways with Serial Ports)

This section contains information on the cable and pinout assignments for the
PLX3x gateway's serial ports (RS-232/422/485). The PLX3x gateway may come
with one or four serial ports, depending on the configuration purchased.
Note:
The PLX31-EIP-MBS4 gateway contains four serial communication ports.
The PLX31-EIP-MBS gateway contains one serial communication port.
Each physical serial port has a RJ45 jack connector. A six-inch RJ45 to DB9
Male adapter cable is provided for each serial port. The DB9 Male adapter cable
provides connections for RS-232, wired as Data Terminal Equipment (DTE), RS-
422 and RS-485.

User Manual
4.2.1 DB9 to RJ45 Adaptor (Cable 14)
4.2.2 Serial Port Specifications

This type of connection is used when the device connected to the gateway
requires hardware handshaking (control and monitoring of modem signal lines).
To enable hardware handshaking, set the port configuration to use RTS/CTS
handshaking. (For MBS protocol, set the Use CTS Line parameter to Yes. For
ASCII protocol, set the Handshaking parameter to Yes).

Hardware Information PLX3x Series ♦ Multi-Protocol Gateways
User Manual
4.2.3 RS-232 - Null Modem (DTE without Hardware Handshaking)

This type of connection can be used to connect the gateway to a computer or
field device communication port.
Note: If the port is configured to use RTS/CTS handshaking, then a jumper is required between the
RTS and the CTS line on the gateway connection.
4.2.4 RS-232 - DTE to DCE Modem Connection

This type of connection is required between the gateway and a modem or other
communication device.
For most modem applications, RTS/CTS handshaking should be enabled in the

port configuration.

User Manual
4.2.5 RS-422 Interface Connections

The following illustration applies when the RS-422 interface is selected.
4.2.6 RS-485 Interface Connection

The following illustration applies when the RS-485 interface is selected.
NOTE: This type of connection is commonly called a RS-485 half-duplex, 2-wire connection. If you
have RS-485 4-wire, full-duplex devices, they can be connected to the gateway's serial ports by
wiring together the TxD+ and RxD+ from the two pins of the full-duplex device to Pin 1 on the
gateway and wiring together the TxD- and RxD- from the two pins of the full-duplex device to Pin 8
on the gateway. As an alternative, you could try setting the gateway to use the RS-422 interface
and connect the full-duplex device according to the RS-422 wiring diagram. For additional
assistance, please contact ProSoft Technical Support.

User Manual

PLX3x Series ♦ Multi-Protocol Gateways EIP Protocol
User Manual
5 EIP Protocol
In This Chapter
 EIP Functional Overview ....................................................................... 49
 EIP Configuration .................................................................................. 53
 Network Diagnostics .............................................................................. 70
 EIP Reference ....................................................................................... 76
5.1 EIP Functional Overview

You can use the PLX3x gateway EIP gateway to interface many different
protocols into the Rockwell Automation family of processors, or other software-
based solutions.
The following illustration shows the functionality of the EtherNet/IP protocol.

EIP Protocol PLX3x Series ♦ Multi-Protocol Gateways
User Manual
5.1.1 EtherNet/IP General Specifications
The EIP driver supports the following connections:

Class Connection Type Number of Connections
Class 1 I/O Depends on the gateway model:
PLX3x-EIP-MBTCP - 2 connections
PLX3x-EIP-MBS - 2 connections
PLX3x-EIP-MBS4 - 8 connections
PLX3x-EIP-ASCII - 1 connection
PLX3x-EIP-ASCII4 - 4 connections
PLX3x-EIP-SIE - 2 connections
PLX3x-EIP-PND - 8 connections
Class 3 Connected Client 2
Unconnected Client 1
Server 5
Supported PLC Types PLC2, PLC5, SLC, CLX, CMPLX, MICROLX

Supported Message Types PCCC and CIP
I/O connection sizes in/out 496/496 bytes
Max RPI time 5 ms per connection
CIP Services Supported 0x4C - CIP Data Table Read
0x4D - CIP Data Table Write
CIP Generic
Command List Supports up to 100 commands per client. Each command is
configurable for command type, IP address, register to/from
address, and word/bit count.
Command Sets PLC-2/PLC-3/PLC5 Basic Command Set
PLC5 Binary Command Set
PLC5 ASCII Command Set
SLC500 Command Set

User Manual
5.1.2 EIP Internal Database

The internal database is central to the functionality of the PLX3x gateway. The
gateway shares this database between all the communications ports on the
gateway and uses it as a conduit to pass information from one protocol to
another device on one network to one or more devices on another network. This
permits data from devices on one communication port to be accessed and
controlled by devices on another communication port.
In addition to data from the client and server, you can map status and error
information generated by the gateway into the user data area of the internal
database. The internal database is divided into two areas:
 Upper memory for the module status data area. This is where the module
writes internal status data for the protocols supported by the module.
 Lower memory for the user data area. This is where incoming data from
external devices is stored and accessed.
Either protocol in the PLX3x gateway can write data to and read data from the
user data area.
 If the module is acting as a client/master, you create commands to read data
from external client/server devices and store the data in a specific location in
the user data area.
 If the module is acting as a server/slave, the external client/master devices
write data to a specific location in the user data area.

User Manual
Note: If you want to access module status data in the upper memory, you can use the data
mapping feature in the gateway to copy data from the module status data area to the user data
area. See Mapping Data in Module Memory (page 24). Otherwise, you can use the diagnostic
functions in ProSoft Configuration Builder to view module status data. For more information on the
module status data, see Network Diagnostics (page 70).
EIP Client Access to Database

The client functionality exchanges data between the 's internal database and
data tables established in one or more processors or other server based devices.
The command list that you define in ProSoft Configuration Builder specifies what
data is to be transferred between the gateway and each of the servers on the
network. No ladder logic is required in the processor (server) for client
functionality, except to assure that sufficient data memory exists.
The following illustration describes the flow of data between the Ethernet clients
and the internal database.
Multiple Server Access to EIP Database

Server support in the gateway allows client applications (such as HMI software
and processors) to read from and write to the gateway’s database. The server
driver is able to support multiple concurrent connections from several clients.
When configured as a server, the user data area of the internal database in the
gateway is the source for read requests and the destination for write requests
from remote clients. Access to the database is controlled by the command type
received in the incoming message from the client.

User Manual
The gateway must be correctly configured and connected to the network before
any attempt is made to use it. Use a network verification program, such as
ProSoft Discovery Service or the command prompt PING instruction, to verify
that the gateway can be seen on the network. Use ProSoft Configuration Builder
to confirm proper configuration of the gateway and to transfer the configuration
files to and from the gateway.
5.2 EIP Configuration
5.2.1 Configuring EIP Class 3 Server

Use the EIP Class 3 Server connection in ProSoft Configuration Builder when the
gateway is acting as a server (slave) device responding to message instructions
initiated from a client (master) device such as an HMI, DCS, PLC, or PAC.
To set the server file size in PCB

the [+] next to EIP Class 3 Server.
2 Double-click the second EIP Class 3 Server to display the Edit - EIP Class 3
Server dialog box.
3 Select the SERVER FILE SIZE (100 or 1000).
o For a value of 100, the registers are from N10:0 to N10:99.
o For a value of 1000, the valid registers are from N10:0 to N10:999.
Accessing the Gateway’s Internal Memory

The following table refers to the user data area in the module's memory:
Data Type Tag Name Length of Each Element in Array Range for 4000
CIP Message Element Database
BOOL BOOLData[ ] 1 0 to 63999
Bit Array BITAData[ ] 4 0 to 1999
SINT SINTData[ ] 1 0 to 7999
INT INT_Data[ ] 2 0 to 3999
DINT DINTData[ ] 4 0 to 1999
REAL REALData[ ] 4 0 to 1999

User Manual
MSG Instruction Type - CIP

The following table defines the relationship of the user data area in the gateway’s
internal database to the addresses required in the MSG CIP instructions:
Data- CIP CIP Boolean CIP Bit Array CIP Byte CIP DINT CIP Real
base Integer
Address
0 Int_data BoolData[0] BitAData[0] SIntData[0] DIntData[0] RealData

[0] [0]
999 Int_data BoolData[15984] SIntData[1998]
[999]
[1000] [500]
[1999]
[2000] [1000]
[2999]
[3000] [1500]
3999 Int_data
[3999] BoolData[63999] SIntData[9998]
MSG Instruction Type - PCCC

The following table defines the relationship of the user data area in the gateway’s
internal database to the addresses required in the MSG PCCC instructions:
Database Address File size 100 Database Address File size 100
0 N10:0 0 N10:0
999 N19:99 999 N19:99
1000 N20:0 1000 N20:0
1999 N29:99 1999 N29:99
2000 N30:0 2000 N30:0

User Manual
EtherNet/IP Explicit Messaging Server Command Support

The PLX3x gateway supports several command sets.
Basic Command Set Functions

Command Function Definition Supported in Server
0x00 N/A Protected Write X
0x01 N/A Unprotected Read X
0x02 N/A Protected Bit Write X
0x05 N/A Unprotected Bit Write X
0x08 N/A Unprotected Write X
PLC-5 Command Set Functions

0x0F 0x00 Word Range Write (Binary Address) X
0x0F 0x01 Word Range Read (Binary Address) X
0x0F Typed Range Read (Binary Address) X
0x0F Typed Range Write (Binary Address) X
0x0F 0x26 Read-Modify-Write (Binary Address)
0x0F 0x00 Word Range Write (ASCII Address) X

0x0F 0x01 Word Range Read (ASCII Address) X
0x0F 0x26 Read-Modify-Write (ASCII Address)
SLC-500 Command Set Functions

0x0F 0xA1 Protected Typed Logical Read With Two X
Address Fields
0x0F 0xA2 Protected Typed Logical Read With Three X
Address Fields
0x0F 0xA9 Protected Typed Logical Write With Two X
Address Fields
0x0F 0xAA Protected Typed Logical Write With Three X
Address Fields
0x0F 0xAB Protected Typed Logical Write With Mask (Three Address Fields)

User Manual
5.2.2 Configuring EIP Class 1 Connection

Use the EIP Class 1 Connection in ProSoft Configuration Builder when the
gateway acts as an EIP adapter transferring data to and from a PLC (the EIP
scanner) using a direct I/O connection. Direct I/O connections can transfer large
amounts of data quickly.
The PLX3x EIP gateway can handle up to eight I/O connections (depending on
the model), each with 248 words of input data and 248 words of output data.
Adding the Gateway to RSLogix5000 v.20

1 Start Rockwell Automation RSLinx and browse to the PLX3x gateway.
2 Right-click the gateway and then choose UPLOAD EDS FROM DEVICE.
Note: RSLogix5000 may need to be restarted in order to complete the EDS installation.
3 After you restart RSLogix 5000, open the desired RSLogix 5000 project.
4 In the Controller Organizer, right-click the EtherNet/IP bridge in the I/O tree
and choose NEW MODULE.
5 In the Select Module Type dialog box, in the Enter search text box, type
PLX3.

User Manual
6 Click your PLX3x gateway, and then click CREATE. This opens the New
Module dialog box.
7 In the New Module dialog box, enter a name for the gateway, then enter the
IP address of the PLX3x gateway.
8 To add I/O connections click CHANGE.

User Manual
9 In the Module Definition dialog box, enter the I/O connections.
10 You can add up to eight I/O connections (depending on the PLX3x module).
The I/O connections have a fixed size of 496 bytes of input data and 496
bytes of output data. When finished click OK.
11 In the Module Properties dialog box, click the CONNECTION tab to configure
each I/O connection with its own RPI time. When finished, click OK. The new
gateway appears in the Controller Organizer under the EtherNet/IP bridge.
Adding the Gateway to RSLogix5000 v.16 through v.19
Note: Class 1 connections are not supported in RSLogix v.15 and older
1 Start Rockwell Automation RSLogix 5000.

2 In the Controller Organizer, right-click the EtherNet/IP bridge in the I/O tree
and choose NEW MODULE.
3 In the Select Module Type dialog box, click FIND. Search for Generic
EtherNet Bridge, click Generic Ethernet Bridge, and then click CREATE.
4 In the New Module dialog box, enter a name for the gateway, then enter the
IP address of the PLX3x gateway. This creates the communication path from
the processor to the PLX3x gateway.

User Manual
5 Add a new module under the Generic EtherNet Bridge and add a CIP
Connection (CIP-MODULE). Here is where you specify the parameters for
the I/O connection. The input and output sizes need to match the input and
output sizes configured in PCB. The ADDRESS field value represents the
connection number in PCB. By default all of the connections have 248 Input
words, 248 Output words, and 0 Configuration words. Set the Comm format
to Data type INT, and set the Assembly instances to be "1" for input, "2" for
output, and "4" for configuration.
6 Add and configure a CIP Connection for each I/O connection.
Configuring EIP Class 1 Connections in PCB

After you have created the PLX3x module in RSLogix 5000, you must configure
the connections in the module.
To configure Class 1 connections in PCB

the [+] next to EIP Class 1 Connection [x]. The value of [x] depends on the
number of ports on your PLX3x gateway (1 to 4).
2 Double-click the EIP Class 1 Connection [x] to display the Edit - EIP Class 1
Connection [x] dialog box.
3 In the dialog box, click a parameter and then enter a value for the parameter.
There are four configurable parameters for each I/O connection in ProSoft
Parameter Value Range Description

Input Data Address 0 to 3999 Specifies the starting address within the gateway’s
virtual database for data transferred from the gateway
to the PLC.
Input Size 0 to 248 Specifies the number of Integers being transferred to
the PLC's input image (248 integers max).
Output Data Address 0 to 3999 Specifies the starting address within the gateway’s
virtual database for data transferred from the PLC to
the gateway.
Output Size 0 to 248 Specifies the number of integers being transferred to
the PLC's output image (248 integers max).

User Manual
5.2.3 Configuring EIP Class 3 Client[x]/UClient Connection

The PLX3x gateway supports two connected clients and one unconnected client
(most devices use connected clients; be sure refer to the user manual for the
target device for verification).
 Use the EIP Class 3 Client [x] connections when the gateway is acting as a
client/master initiating message instructions to the server/slave devices. The
PLX3x EIP protocol supports three connected client connections. Typical
applications include SCADA systems, and SLC communication.
 Use the EIP Class 3 UClient connection when the gateway is acting as a
client/master initiating message instructions to the server/slave devices. The
PLX3x EIP protocol supports one unconnected client connection.
Unconnected messaging is a type of EtherNet/IP explicit messaging that uses
TCP/IP implementation. Certain devices, such as the AB Power Monitor 3000
series B, support unconnected messaging. Check your device documentation
for further information about its EtherNet/IP implementation.
Class 3 Client[x]/UClient
To configure Class 3 Client/UClient [x] connections

the [+] next to EIP Class 3 Client [x] or EIP Class 3 UClient [x].
2 Double-click the second EIP Class 3 Client [x] to display the Edit - EIP Class
3 Client [x] dialog box.
3 In the dialog box, click any parameter to change its value.

User Manual
The following table specifies the configuration for the EIP client (master) device
on the network port:
Parameter Value Description
Minimum 0 to 65535 Specifies the number of milliseconds to wait between the initial issuances of
Command milliseconds a command. This parameter can be used to delay all commands sent to
Delay servers to avoid "flooding" commands on the network. This parameter does
not affect retries of a command as they will be issued when failure is
recognized.
Response 0 to 65535 Specifies the amount of time in milliseconds that a Client will wait before re-
Timeout milliseconds transmitting a command if no response is received from the addressed
server. The value to use depends on the type of communication network
used, and the expected response time of the slowest device connected to
the network.
Retry Count 0 to 10 Specifies the number of times a command will be retried if it fails.
Class 3 Client[x]/UClient Commands

There is a separate command list for each of the different message types
supported by the protocol. Each list is processed from top to bottom, one after
the other, until all specified commands are completed, and then the polling
process begins again.
This section defines the EtherNet/IP commands to be issued from the gateway to
server devices on the network. You can use these commands for data collection
and control of devices on the TCP/IP network. In order to interface the virtual
database with Rockwell Automation Programmable Automation Controllers
(PACs), Programmable Logic Controllers (PLCs), or other EtherNet/IP server
devices, you must construct a command list, using the command list parameters
for each message type.
To add Class 3 Client/UClient [x] commands

the [+] next to EIP Class 3 Client [x] or EIP Class 3 UClient [x].
2 Double-click the desired command type to display the Edit - EIP Class 3
Client [x] Commands or Edit - EIP Class 3 UClient [x] Commands dialog box.
3 Click ADD ROW to add a new command.
4 Click EDIT ROW or double-click the row to display the Edit dialog box where
you configure the command.

User Manual
Class 3 Client/UClient [x] Commands SLC500 2 Address Fields

Enable Enable Specifies if the command should be executed and under what conditions.
Disable ENABLE - The Command is executed each scan of the command list
Conditional DISABLE - The command is disabled and will not be executed
Write CONDITIONAL WRITE - The Command executes only if the internal data
associated with the command changes
Internal 0 to 3999 Specifies the database address in the module’s internal database to be
Address associated with the command. If the command is a read function, the data
received in the response message is placed at the specified location. If the
command is a write function data used in the command is sourced from
specified data area.
Poll Interval 0 to 65535 Specifies the minimum interval to execute continuous commands. The
parameter is entered in 1/10 of a second. If a value of 100 is entered for a
command, the command executes no more frequently than every 10
seconds.
Reg Count 0 to 125 Specifies the number of data points to be read from or written to the target
device. For REAL datatype, the max count is 62.
Swap Code None Specifies if the data from the server is to be ordered differently than it was
Word swap received. This parameter is typically used when dealing with floating-point
Word and Byte or other multi-register values.
swap NONE - No change is made (abcd)
Byte swap WORD SWAP - The words are swapped (cdab)
WORD AND BYTE SWAP - The words and bytes are swapped (dcba)
BYTE SWAP - The bytes are swapped (badc)
IP Address xxx.xxx.xxx.xxx Specifies the IP address of the target device to be addressed.
Slot -1 Specifies the slot number for the device. Use a value of -1 when interfacing
to an SLC 5/05. These devices do not have a slot parameter. When
addressing a processor in a ControlLogix or CompactLogix rack, the slot
number corresponds to the slot in the rack containing the controller being
addressed.
Func Code 501 Specifies the function code to be used in the command.
509 501 - Protected Typed Read
509 - Protected Typed Write
File Type Binary Specifies the file type to be associated with the command.
Counter
Timer
Control
Integer
Float
ASCII
String
Status
File Number -1 Specifies the PLC-5 file number to be associated with the command. If a
value of -1 is entered for the parameter, the field will not be used in the
command, and the default file will be used.
Element Specifies the element in the file where the command will start.
Number
Comment Optional 32 character comment for the command.

User Manual
Class 3 Client[x]/UClient Commands SLC500 3 Address Fields

This command is typically used when accessing data in a Timer or Counter. I.e.
T.1.1.2 is the address of the accumulator in Timer 1.

Enable Enable Specifies if the command should be executed and under what
Disable conditions.
Conditional Write ENABLE - The Command is executed each scan of the command list
DISABLE - The command is disabled and will not be executed
CONDITIONAL WRITE - The Command executes only if the internal data
Internal 0 to 3999 Specifies the database address in the module’s internal database to
Address be associated with the command. If the command is a read function,
the data received in the response message is placed at the specified
location. If the command is a write function data used in the command
is sourced from specified data area.
Poll Interval 0 to 65535 Specifies the minimum interval to execute continuous commands. The
parameter is entered in 1/10 of a second. If a value of 100 is entered
for a command, the command executes no more frequently than every
10 seconds.
Reg Count 0 to 125 Specifies the number of data points to be read from or written to the
target device. For REAL datatype, the max count is 62.
Swap Code None Specifies if the data from the server is to be ordered differently than it
Word swap was received. This parameter is typically used when dealing with
Word and Byte swap floating-point or other multi-register values.
Byte swap NONE - No change is made (abcd)
WORD SWAP - The words are swapped (cdab)
Byte swap - The bytes are swapped (badc)
IP Address xxx.xxx.xxx.xxx Specifies the IP address of the target device to be addressed by this
command.
Slot -1 Specifies the slot number for the device. Use a value of -1 when
interfacing to an SLC 5/05. These devices do not have a slot
parameter. When addressing a processor in a ControlLogix or
CompactLogix, the slot number corresponds to the slot in the rack
containing the controller being addressed.
510 502 - Protected Typed Read
511 510 - Protected Typed Write
511 - Protected Typed Write w/Mask

User Manual

File Type Binary Specifies the file type to be associated with the command.
Counter
Timer
Control
Integer
Float
ASCII
String
Status
File Number -1 Specifies the SLC 500 file number to be associated with the
command. If a value of -1 is entered for the parameter, the field will not
be used in the command, and the default file will be used.
Number
Sub Specifies the sub-element to be used with the command. Refer to the
Element AB documentation for a list of valid sub-element codes.
Class 3 Client[x]/UClient Commands PLC5 Binary

Disable conditions.
Address associated with the command. If the command is a read function, the
data received in the response message is placed at the specified
Poll 0 to 65535 Specifies the minimum interval to execute continuous commands. The
Interval parameter is entered in 1/10 of a second. If a value of 100 is entered for
a command, the command executes no more frequently than every 10
seconds.
Swap None Specifies if the data from the server is to be ordered differently than it
Code Word swap was received. This parameter is typically used when dealing with
command.

User Manual

interfacing to a PLC5 These devices do not have a slot parameter.
When addressing a processor in a ControlLogix or CompactLogix, the
slot number corresponds to the slot in the rack containing the controller
being addressed.
101 100 - Word Range Write
102 101 - Word Range Read
102 - Read-Modify-Write
File -1 Specifies the PLC5 file number to be associated with the command. If a
Number value of -1 is entered for the parameter, the field will not be used in the
command, and the default file will be used.
Number
Sub Specifies the sub-element to be used with the command. Refer to the
Element AB documentation for a list of valid sub-element codes.
Class 3 Client[x]/UClient Commands PLC5 ASCII

Disable conditions.
seconds.
IP Address xxx.xxx.xxx.xxx Specifies IP address of the target device to be addressed by this
command.

User Manual

being addressed.
151 150 - Word Range Write
152 151 - Word Range Read
152 - Read-Modify-Write
File String Specifies the PLC-5 Address as a string. For example N10:300
Class 3 Client[x]/UClient Commands Controller Tag Access

Disable conditions.
seconds.
command.
being addressed.
333 332 - CIP Data Table Read
333 - CIP Data Table Write

User Manual
Data Type Bool Specifies the data type of the target controller tag name.
SINT
INT
DINT
REAL
DWORD
Tag Name Specifies the controller tag in the target PLC.
Offset 0 to 3999 Specifies the offset database where the value corresponds to the Tag
Name parameter
Class 3 Client[x]/UClient Commands CIP Generic

Enable Disabled Specifies the condition to execute the command.
Enabled DISABLED - The command is disabled and will not be executed.
Conditional Write ENABLED - The command is executed on each scan of the command
list if the Poll Interval is set to zero. If the Poll Interval is non-zero, the
command is executed when the interval timer expires.
CONDITIONAL WRITE - The command executes only if the internal data
value(s) to be sent has changed.
location. If the command is a write function, data used in the command
Interval parameter is entered in 1/10 of a second. For example, if a value of
'100' is entered for a command, the command executes no more
frequently than every 10 seconds.
command.
Slot -1 Use ‘-1’ to target a connected device.
Use > -1 to target a device in a specific slot number within the rack.
Func Code CIP Generic Used to read/write the attributes of any object by using an explicit
address
Service 00 to FF (Hex) An integer identification value which denotes a particular Object
Code Instance and/or Object class function. For more information refer to

User Manual
ODVA CIP specification.

Class 00 to FFFF (Hex) An integer identification value assigned to each Object Class accessible
from the network. For more information, refer to ODVA CIP
specification.
Instance Application- An integer identification value assigned to an Object Instance that
dependent identifies it among all Instances of the same Class. For more
information, refer to ODVA CIP specification.
Attribute 00 to FFFF (Hex) An integer identification value assigned to a Class and/or Instance
Attribute. For more information, refer to ODVA CIP specification.
Comment This field can be used to give a 32 character comment to the command.
The ":" and "#" characters are reserved characters. It is strongly
recommended not be use in the comment section.
Note: Due to the behavior of Connected Clients, please note the following:
- You cannot configure multiple commands with different Class objects to the same device.
- You cannot configure multiple commands with different Class objects to different devices.
- You can configure multiple commands using the Get_Attribute_Single of the same Class and
address different Attributes.
- If you have commands in any of the other command types (i.e. Controller Tag Access) and
configure a CIP Generic command to the same device, it will not work due to the Connected Client
having an active connection to a device. However, you can use both Controller Tag Access and
CIP Generic if the target devices are different.
- To avoid any or all these scenarios, it is recommended to use the Unconnected Client if you wish
to send commands to different devices, since these connections are reset/closed after each
command is executed.

User Manual
Class 3 Client[x]/UClient Commands Basic

Disable conditions.
Conditional Write ENABLE - The command is executed each scan of the command list
CONDITIONAL WRITE - The command executes only if the internal data
is sourced from the specified data area.
seconds.
command.
Slot -1 Use a value of -1 when interfacing to an SLC 5/05. These devices do
not have a slot parameter. When addressing a processor in a
ControlLogix or CompactLogix, the slot number corresponds to the slot
in the rack containing the controller being addressed.
2 1 - Protected Write
3 2 - Unprotected Read
4 3 - Protected Bit Write
5 4 - Unprotected Bit Write
5 - Unprotected Write
Word Specifies the word address where to start the operation.
Address

User Manual
5.3 Network Diagnostics
5.3.1 EIP PCB Diagnostics

The best way to troubleshoot the EIP driver is to use ProSoft Configuration
Builder to access the diagnostic capabilities of the gateway through the Ethernet
debug port.
The following table summarizes the status information available in PCB for the
EIP driver:
Connection Type Submenu Item Description
EIP Class 1 Config Configuration settings for Class 1 Connections.
Status Status of the Class 1 Connections. Displays any
configuration error, as well as the number of Class 1
Connections.
EIP Class 3 Server Config Configuration settings for Class 3 Server Connections.
Comm Status Status information for each Class 3 Server Connection.
Displays port numbers, IP addresses, socket status, and
read and write counts.
EIP Class 3 Config Configuration settings for Class 3 Client/UClient
Client/UClient [x] Connections.
Comm Status Status information for Class 3 Client/UClient [x]
commands. Displays a summary of all the errors
resulting from Class 3 Client/UClient [x] commands.
Commands Configuration for the Class 3 Client/UClient [x] command
list.
Cmd Errors Current error codes for each command on the Class 3
(Decimal) Client/UClient [x] command list in decimal number
format. A zero means there is currently no error for the
command.
Cmd Errors Current error codes for each command on the Class 3
(Hex) Client/UClient [x] command list in hexadecimal number
format. A zero means there is currently no error for the
command.
For specific information on error codes, see EIP Error Codes (page 73).

User Manual
5.3.2 EIP Status Data in Upper Memory

The EIP driver has an associated status data area located in the PLX3x
gateway’s upper memory. The Data Map functionality of the PLX3x gateway can
be used to map this data into the normal user data range of the PLX3x gateway’s
database.
Note that all the status values are initialized to zero (0) at power-up, cold boot
and during warm boot.
EIP Client Status Data

The following table lists the addresses in upper memory the PLX3x gateway
stores general error and status data for each EIP connected and unconnected
client:
EIP Client Address Range
Connected Client 0 7900 through 8009
Unconnected Client 0 12800 through 12909
The content of each client’s status data area is structured in the same way. The
following table describes the content of each register in the status data area:
Offset Description
0 Number of Command Requests
1 Number of Command Responses
2 Number of Command Errors
3 Number of Requests
4 Number of Responses
5 Number of Errors Sent
6 Number of Errors Received
7 Reserved
8 Current Error Code
9 Last Error Code
EIP Client Command List Error Data

The PLX3x gateway stores a status/error code in upper memory for each
command in each EIP client’s command list. The following table lists the
addresses in upper memory where the gateway stores the command list error
data for each EIP client:
EIP Client Address Range
Unconnected Client 0 12810 through 12909

User Manual
The first word in each client’s command list error data area contains the
status/error code for the first command in the client’s command list. Each
successive word in the command error list is associated with the next command
in the list. Therefore, the size of the command list error data area depends on the
number of commands defined.
The structure of the command list error data area (which is the same for all
clients) is displayed in the following table:
Offset Description
0 Command #1 Error Code
. .
. .
. .
EIP Server Status Data

The following table lists the addresses in upper memory where the PLX3x
gateway stores status data for each EIP server:
EIP Server Address Range
0 8900 through 8915
1 8916 through 8931
2 8932 through 8947
3 8948 through 8963
4 8964 through 8979
The content of each server’s status data area is structured the same. The
Offset Description
0 through 1 Connection State
2 through 3 Open Connection Count
4 through 5 Socket Read Count
6 through 7 Socket Write Count
8 through 15 Peer IP

User Manual
5.3.3 EIP Error Codes

The gateway stores error codes returned from the command list process in the
command list error memory region. A word is allocated for each command in the
memory area. The error codes are formatted in the word as follows: The least-
significant byte of the word contains the extended status code and the most-
significant byte contains the status code.
Use the error codes returned for each command in the list to determine the
success or failure of the command. If the command fails, use the error code to
determine the cause of failure.
Warning: The gateway-specific error codes (not EtherNet/IP/PCCC compliant) are returned from
the gateway and never returned from an attached EtherNet/IP/PCCC slave device. These are error
codes that are part of the EtherNet/IP/PCCC protocol or are extended codes unique to the PLX3x
gateway. The most common errors for the EtherNet/IP/PCCC protocol are shown below.
Local STS Error Codes

Code (Int) Code (Hex) Description
0 0x0000 Success, no error
256 0x0100 DST node is out of buffer space
512 0x0200 Cannot guarantee delivery (Link Layer)
768 0x0300 Duplicate token holder detected
1024 0x0400 Local port is disconnected
1280 0x0500 Application layer timed out waiting for response
1536 0x0600 Duplicate node detected
1792 0x0700 Station is offline
2048 0x0800 Hardware fault
Remote STS Error Codes

0 0x0000 Success, no error
4096 0x1000 Illegal command or format
8192 0x2000 Host has a problem and will not communicate
12288 0x3000 Remote node host is missing, disconnected or shut down
16384 0x4000 Host could not complete function due to hardware fault
20480 0x5000 Addressing problem or memory protect rungs
24576 0x6000 Function not allowed due to command protection selection
26872 0x7000 Processor is in Program mode
-32768 0x8000 Compatibility mode file missing or communication zone problem
-28672 0x9000 Remote node cannot buffer command
-24576 0xA000 Wait ACK (1775-KA buffer full)
-20480 0xB000 Remote node problem due to download

User Manual

-16384 0xC000 Wait ACK (1775-KA buffer full)
-12288 0xD000 Not used
-8192 0xE000 Not used
0xF0nn Error code in the EXT STS byte (nn contains EXT error code)
EXT STS Error Codes

-4096 0xF000 Not used
-4095 0xF001 A field has an illegal value
-4094 0xF002 Fewer levels specified in address than minimum for any address
-4093 0xF003 More levels specified in address than system supports
-4092 0xF004 Symbol not found
-4091 0xF005 Symbol is of improper format
-4090 0xF006 Address does not point to something usable
-4089 0xF007 File is wrong size
-4088 0xF008 Cannot complete request
-4087 0xF009 Data or file is too large
-4086 0xF00A Transaction size plus word address is too large
-4085 0xF00B Access denied, improper privilege
-4084 0xF00C Condition cannot be generated - resource is not available
-4083 0xF00D Condition already exists - resource is already available
-4082 0xF00E Command cannot be executed
-4081 0xF00F Histogram overflow
-4080 0xF010 No access
-4079 0xF011 Illegal data type
-4078 0xF012 Invalid parameter or invalid data
-4077 0xF013 Address reference exists to deleted area
-4076 0xF014 Command execution failure for unknown reason
-4075 0xF015 Data conversion error
-4074 0xF016 Scanner not able to communicate with 1771 rack adapter
-4073 0xF017 Type mismatch
-4072 0xF018 1171 Gateway response was not valid
-4071 0xF019 Duplicate label
-4070 0xF01A File is open; another node owns it
-4069 0xF01B Another node is the program owner
-4068 0xF01C Reserved
-4067 0xF01D Reserved
-4066 0xF01E Data table element protection violation
-4065 0xF01F Temporary internal problem

User Manual
EIP Error Codes

-1 0xFFFF CTS modem control line not set before transmit
-2 0xFFFE Timeout while transmitting message
-8 0xFFF8 Data size too large
-10 0xFFF6 Timeout waiting for DLE-ACK after request
-11 0xFFF5 Timeout waiting for response after request
-12 0xFFF4 Reply data does not match requested byte count
-15 000F Write protection enabled
-20 0xFFEC DLE-NAK received after request
-21 0xFFEB DLE-NAK sent after response
-200 0xFF38 DLE-NAK received after request
TCP/IP Interface Error Codes

Error (Int) Error (Hex) Description
-33 0xFFDF Failed to connect to target
-34 0xFFDE Failed to register session with target (timeout)
-35 0xFFDD Failed forward open response timeout
-36 0xFFDC PCCC/Tag command response timeout
-37 0xFFDB No TCP/IP connection error
Common Response Error Codes

-40 0xFFD8 Invalid response length
-41 0xFFD7 CPF item count not correct
-42 0xFFD6 CPF address field error
-43 0xFFD5 CPF packet tag invalid
-44 0xFFD4 CPF bad command code
-45 0xFFD3 CPF status error reported
-46 0xFFD2 CPF incorrect connection ID value returned
-47 0xFFD1 Context field not matched
-48 0xFFD0 Incorrect session handle returned
-49 0xFFCF CPF not correct message number
Register Session Response Error Codes

-50 0xFFCE Message length received not valid
-51 0xFFCD Status error reported
-52 0xFFCC Invalid version

User Manual
Forward Open Response Error Codes

-55 0xFFC9 Message length received not valid
-56 0xFFC8 Status error reported
PCCC Response Error Codes

-61 0xFFC3 Message length received not valid
-62 0xFFC2 Status error reported
-63 0xFFC1 CPF bad command code
-64 0xFFC0 TNS in PCCC message not matched
-65 0xFFBF Vendor ID in PCCC message not matched
-66 0xFFBE Serial number in PCCC message not matched
5.4 EIP Reference
5.4.1 SLC and MicroLogix Specifics
Messaging from a SLC 5/05

The PLX3x gateway can receive messages from a SLC 5/05 containing an
Ethernet interface. The gateway supports both read and write commands.
SLC5/05 Write Commands

Write commands transfer data from the SLC processor to the gateway. The
following diagram shows an example rung to execute a write command.
1 Set the READ/WRITE parameter to WRITE. The gateway supports a TARGET

DEVICE parameter value of 500CPU or PLC5.

User Manual
2 In the MSG object, click SETUP SCREEN in the MSG object to complete the
configuration of the MSG instruction. This displays the following dialog box.
3 Set the TARGET DEVICE DATA TABLE ADDRESS to a valid file element (such as,
N11:0) for SLC and PLC5 messages.
4 Set the MULTIHOP option to YES.
5 Complete the MULTIHOP tab portion of the dialog box shown in the following
image.
6 Set the TO ADDRESS value to the gateway’s Ethernet IP address.

7 Press the INS key to add the second line for ControlLogix Backplane and set
the slot number to zero.

User Manual
SLC5/05 Read Commands

Read commands transfer data to the SLC processor from the gateway. The
following diagram shows an example rung to execute a read command.
1 Set the READ/WRITE parameter to READ. The gateway supports a TARGET

DEVICE parameter value of 500CPU or PLC5.
3 Set the TARGET DEVICE DATA TABLE ADDRESS to a valid file element (such
as, N11:0) for SLC and PLC5 messages.

User Manual
5 Fill in the MULTIHOP tab portion of the dialog box as shown in the following
image.

SLC File Types

This information is specific to the SLC and MicroLogix family or processors used
with the PCCC command set. The SLC and MicroLogix processor commands
support a file type field entered as a single character to denote the data table to
use in the command. The following table defines the relationship of the file types
accepted by the gateway and the SLC file types.
File Type Description

S Status
B Bit
T Timer
C Counter
R Control
N Integer
F Floating-point
Z String
A ASCII
The File Type Command Code is the ASCII character code value of the File Type
letter. This is the value to enter for the FILE TYPE parameter of the PCCC
Command configurations in the data tables in the ladder logic.
Additionally, the SLC specific functions (502, 510 and 511) support a sub-
element field. This field selects a sub-element field in a complex data table. For
example, to obtain the current accumulated value for a counter or timer, set the
sub-element field to 2.

User Manual
5.4.2 PLC5 Processor Specifics
Messaging from a PLC5

The gateway can receive messages from a PLC5 containing an Ethernet
interface. The gateway supports both read and write commands.
PLC5 Write Commands

Write commands transfer data from the PLC5 processor to the gateway. The
following diagram shows an example rung to execute a write command.
2 Select the COMMUNICATION COMMAND to execute from the following list of

supported commands.
o PLC5 Type Write
o PLC2 Unprotected Write
o PLC5 Typed Write to PLC
o PLC Typed Logical Write

User Manual
as,N11:0) for SLC and PLC5 messages. For the PLC2 Unprotected Write
message, set the address to the database index (such as, 1000) for the
command.
5 Complete MULTIHOP tab portion of the dialog box as shown in the following
image.

PLC5 Read Commands

Read commands transfer data to the PLC5 processor from the gateway. The
following diagram shows an example rung that executes a read command.

User Manual
2 Select the COMMUNICATION COMMAND to execute from the following list of

supported commands.
o PLC5 Type Read
o PLC2 Unprotected Read
o PLC5 Typed Read to PLC
o PLC Typed Logical Read
as, N11:0) for SLC and PLC5 messages. For the PLC2 Unprotected Read
message, set the address to the database index (such as, 1000) for the
command.
5 Complete the MULTIHOP tab portion of the dialog box as shown in the
following image.


User Manual
PLC-5 Sub-Element Fields

This section contains information specific to the PLC-5 processor when using the
PCCC command set. The commands specific to the PLC-5 processor contain a
sub-element code field. This field selects a sub-element field in a complex data
table. For example, to obtain the current accumulated value for a counter or
timer, set the sub-element field to 2. The following tables show the sub-element
codes for PLC-5 complex data tables.
Timer / Counter
Code Description
0 Control
1 Preset
2 Accumulated
Control
Code Description
0 Control
1 Length
2 Position
PD
All PD values are floating point values, they are two words long.
Code Description
0 Control
2 SP
4 Kp
6 Ki
8 Kd
26 PV
BT
Code Description
0 Control
1 RLEN
2 DLEN
3 Data file #
4 Element #
5 Rack/Grp/Slot

User Manual
MG
Code Description
0 Control
1 Error
2 RLEN
3 DLEN
5.4.3 ControlLogix and CompactLogix Processor Specifics
Messaging from a ControlLogix or CompactLogix Processor

Use the MSG instruction to exchange data between a Control/CompactLogix
processor and the gateway. There are two basic methods of data transfer
supported by the gateway when using the MSG instruction: encapsulated PCCC
messages and CIP Data Table messages. You can use either method.
Encapsulated PCCC Messages

This section contains information specific to the Control/CompactLogix processor
when using the PCCC command set. The current implementation of the PCCC
command set does not use functions that can directly access the Controller Tag
Database. In order to access this database, you must use the table-mapping
feature in RSLogix 5000. RSLogix 5000 permits assigning Controller Tag Arrays
to virtual PLC 5 data tables. The PLX3x gateway using the PLC 5 command set
defined in this document can then access this controller data.
PLC5 and SLC5/05 processors containing an Ethernet interface use the
encapsulated PCCC message method. The gateway simulates these devices
and accepts both read and write commands.
Encapsulated PCCC Write Message

Write commands transfer data from the processor to the gateway. The gateway
supports the following encapsulated PCCC commands:
 PLC2 Unprotected Write
 PLC5 Typed Write
 PLC5 Word Range Write
 PLC Typed Write

User Manual
The following diagram shows an example rung that executes a write command.
1 In the Message Configuration dialog box, define the data set to be transferred
from the processor to the gateway as shown in the following image.
2 Complete the dialog box for the data area to be transferred.

o For PLC5 and SLC messages, set the DESTINATION ELEMENT to an
element in a data file (such as, N10:0).
o For the PLC2 Unprotected Write message, set the DESTINATION ELEMENT
to the address in the gateway’s internal database. This cannot be set to a
value less than ten. This is not a limitation of the gateway but of the
RSLogix software.
o For a PLC2 Unprotected Write or Read function, enter the database
address in octal format.

User Manual
3 Click the COMMUNICATION tab and complete the communication information

as shown in the following image.
4 Make sure you select CIP as the COMMUNICATION METHOD. The PATH
specifies the message route from the processor to the EIP gateway. Path
elements are separated by commas. In the example path shown:
o The first element is "Enet", which is the user-defined name given to the
1756-ENET gateway in the chassis (you can substitute the slot number of
the ENET gateway for the name)
o The second element, "2", represents the Ethernet port on the 1756-ENET
gateway.
o The last element of the path, "192.168.0.75" is the IP address of the
gateway, which is the target for the message.
More complex paths are possible if routing to other networks using multiple 1756-
ENET gateways and racks. Refer to the ProSoft Technology Technical Support
Knowledgebase for more information on Ethernet routing and path definitions
(www.prosoft-technology.com/support).

User Manual
Encapsulated PCCC Read Message

Read commands transfer data from the gateway to a processor. The gateway
supports the encapsulated PCCC commands:
 PLC2 Unprotected Read
 PLC5 Typed Read
 PLC5 Word Range Read
 PLC Typed Read
The following diagram shows an example rung that executes a read command.
2 Complete the dialog box for the data area to be transferred.

o For PLC5 and SLC messages, set the SOURCE ELEMENT to an element in
a data file (such as, N10:0).
o For the PLC2 Unprotected Read message, set the SOURCE ELEMENT to
the address in the gateway’s internal database. This cannot be set to a
value less than ten. This is not a limitation of the gateway but of the
RSLogix software.

User Manual
3 Click the COMMUNICATION tab and complete the communication information

as shown in the following image.
gateway.
gateway, and the target for the message.

User Manual
CIP Data Table Operations

You can use CIP messages to transfer data between the ControlLogix or
CompactLogix processor and the gateway. Tag names define the elements to be
transferred. The gateway supports both read and write operations.
CIP Data Table Write

CIP data table write messages transfer data from the processor to the gateway.
The following diagram shows an example rung that executes a write command.
2 Complete the dialog box for the data area to be transferred. CIP Data Table
messages require a tag database element for both the source and
destination.
o The SOURCE TAG is a tag defined in the Controller Tag database.
o The DESTINATION ELEMENT is the tag element in the gateway.
o The gateway simulates a tag database as an array of elements defined by
the maximum register size for the gateway with the tag name INT_DATA
(with the maximum value of int_data[3999]).

User Manual
3 In the previous example, the first element in the database is the starting
location for the write operation of ten elements. Click the COMMUNICATION tab
and complete the communication information as shown in the following
image.
gateway.

User Manual
CIP Data Table Read

CIP data table read messages transfer data to the processor from the gateway.
The following diagram shows an example rung that executes a read command.
2 Complete the dialog box for the data area to be transferred. CIP Data Table
messages require a tag database element for both the source and
destination.
o The DESTINATION TAG is a tag defined in the Controller Tag database.
o The SOURCE ELEMENT is the tag element in the gateway.
o The gateway simulates a tag database as an array of elements defined by
the maximum register size for the gateway (user configuration parameter
"Maximum Register" in the [Gateway] section) with the tag name
INT_DATA.

User Manual
3 In the previous example, the first element in the database is the starting
location for the read operation of ten elements. Click the COMMUNICATION tab
and complete the communication information as shown in the following
image.
gateway.

User Manual
5.4.4 EIP Command Entry Form

Use the following form to design the application’s command list.
Gateway Information Data Device Information Data

Column # 1 2 3 4 5 6 7 8 9 10 11 12
Function Enable Internal Poll Count Swap IP Slot Function Function Parameters
Code Code Address Interval Code Address Number Code
Time
IP Address = IP address of processor to reach

Slot Number = -1 for PLC5 & SLC, processor slot number of ControlLogix

User Manual

PLX3x Series ♦ Multi-Protocol Gateways MBTCP Protocol
User Manual
6 MBTCP Protocol
In This Chapter
 MBTCP Functional Overview ................................................................ 95
 MBTCP Configuration ......................................................................... 101
 Network Diagnostics ............................................................................ 108
 MBTCP Reference .............................................................................. 113
6.1 MBTCP Functional Overview

You can use the PLX3x gateway Modbus TCP/IP (MBTCP) protocol to interface
many different protocols into the Schneider Electric Quantum family of
processors as well other devices supporting the protocol. The MBTCP protocol
supports both client and server connections.
The gateway supports a client connection on the TCP/IP network to interface
with processors (and other server based devices) using a command list of up to
100 entries that you specify. The gateway stores the write commands for remote
processors in the gateway's lower memory. This is also where the gateway
stores data from read commands from other devices. See MBTCP Internal
Database (page 97) for more information.
Data in the lower memory of the gateway’s internal database is accessible for
read and write operations by any node on the network supporting the MBAP
(Service Port 502) or MBTCP (Service Ports 2000/2001) TCP/IP protocols. The
MBAP protocol (Port 502) is a standard implementation defined by Schneider
Electric and used on their Quantum processor. This open protocol is a modified
version of the Modbus serial protocol. The MBTCP protocol is an embedded
Modbus protocol message in a TCP/IP packet. The gateway supports up to five
active server connections on Service Ports 502, five additional active server
connections on Service Port 2000, and one active client connection.
The following illustration shows the functionality of the Modbus TCP/IP protocol.

MBTCP Protocol PLX3x Series ♦ Multi-Protocol Gateways
User Manual
6.1.1 MBTCP General Specifications

The Modbus TCP/IP protocol allows multiple independent, concurrent Ethernet
connections. The connections may be all clients, all servers, or a combination of
both client and server connections.
 10/100 MB Ethernet Communication port
 Supports Enron version of Modbus protocol for floating-point data
transactions
 Configurable parameters for the client including a minimum response delay of
0 to 65535 ms and floating-point support
 Supports five independent server connections for Service Port 502
 Supports five independent server connections for Service Port 2000
 All data mapping begins at Modbus register 400001, protocol base 0.
 Error codes, network error counters, and port status data available in user
data memory
Modbus TCP/IP Client

 Actively reads data from and writes data to Modbus TCP/IP devices using
MBAP
 Up to 10 client connections with multiple commands to talk to multiple servers
Modbus TCP/IP Server

 The server driver accepts incoming connections on Service Port 502 for
clients using Modbus TCP/IP MBAP messages and connections on Service
Port 2000 (or other Service Ports) for clients using Encapsulated Modbus
messages.
 Supports multiple independent server connections for any combination of
Service Port 502 (MBAP) and Service Port 2000 (Encapsulated)
 Up to 20 servers are supported

User Manual
Parameter Description
Modbus Commands 1: Read Coil Status 15: Force (Write) Multiple Coils
Supported 2: Read Input Status 16: Preset (Write) Multiple Holding Registers
(client and server) 3: Read Holding Registers 22: Mask Write Holding Register (Slave Only)
4: Read Input Registers 23: Read/Write Holding Registers (Slave
5: Force (Write) Single Coil Only)
6: Preset (Write) Single Holding
Register
Configurable  Gateway IP Address
Parameters:  PLC Read Start Register (%MW)
(client and server)  PLC Write Start Register (%MW)
 Number of MBAP and MBTCP servers
 Gateway Modbus Read Start Address
 Gateway Modbus Write Start Address
Configurable  Minimum Command Delay
Parameters:  Response Timeout
(client only)  Retry Count
 Command Error Pointer
Command List Up to 160 Modbus commands (one tag per command)
Status Data  Error codes reported individually for each command.
 High-level status data available from Modbus TCP/IP client (for example
PLC)
Command List Polling Each command can be individually enabled or disabled; write-only-on-data-
change is available
6.1.2 MBTCP Internal Database


User Manual
user data area.
the user data area.
module status data, see Network Diagnostics (page 108).

User Manual
Modbus TCP/IP Client Access to Database

The client functionality exchanges data between the PLX3x gateway's internal
database and data tables established in one or more Quantum processors or
other server based devices. The command list that you define in ProSoft
Configuration Builder specifies what data is to be transferred between the
gateway and each of the servers on the network. No ladder logic is required in
the processor (server) for client functionality, except to ensure that sufficient data
memory exists.
The following illustration describes the flow of data between the Ethernet clients
and the internal database.
Multiple Server Access to Database

The MBTCP gateway provides server functionality using reserved Service Port
502 for Modbus TCP/IP MBAP messages, as well as Service Ports 2000 and
2001 to support the TCP/IP Encapsulated Modbus version of the protocol used
by several HMI manufacturers. Server support in the gateway permits client
applications (for example: HMI software, Quantum processors, etc) to read from
and write to the gateway’s database. This section discusses the requirements for
attaching to the gateway using client applications.
The server driver supports multiple concurrent connections from several clients.
Up to five clients can simultaneously connect on Service Port 502 and five more
can simultaneously connect on Service Port 2000. The MBTCP protocol uses
Service Port 2001 to pass Encapsulated Modbus commands through from the
Ethernet port to the gateway’s serial port.

User Manual
When configured as a server, the gateway uses its internal database as the
source for read requests and the destination for write requests from remote
clients. Access to the database is controlled by the command type received in
the incoming message from the client. The following table specifies the
relationship of the gateway’s internal database to the addresses required in the
incoming Modbus TCP/IP requests.
Database Address Modbus Address

0 40001
1000 41001
2000 42001
3000 43001
3999 44000
The following virtual addresses are not part of the normal gateway user database
and are not valid addresses for standard data. However, these addresses may
be used for incoming commands that are requesting floating-point data.
To use addresses in this upper range requires that you configure the following
parameters in Prosoft Configuration Builder (PCB):
 Set the Float Flag in the MBTCP server configuration to YES
 Set the Float Start to a database address in the range below
 Set the Float Offset to a database address in the gateway user memory area
shown above.
Remember that, once this is done, all data above the Float Start address must be
floating-point data. See Configuring MBTCP Servers (page 101).

4000 44001
5000 45001
6000 46001
7000 47001
8000 48001
9000 49001
9999 50000
The gateway must be correctly configured and connected to the network before
any attempt is made to use it. Use a network verification program, such as
ProSoft Discovery Service or the command prompt PING instruction, to verify
that other devices can find the gateway on the network. Use ProSoft
Configuration Builder to confirm proper configuration of the gateway and to
transfer the configuration files to and from the gateway.

User Manual
Modbus Message Routing: Port 2001

When Modbus messages are sent to the PLX3x gateway over the TCP/IP
connection to port 2001, the messages are routed by the gateway directly out the
serial communication port (Port 0, if it is configured as a Modbus master). The
commands (whether a read or a write command) are immediately routed to the
slave devices on the serial port. Response messages from the slave devices are
routed by the gateway to the TCP/IP network to be received by the originating
host.
6.2 MBTCP Configuration
6.2.1 Configuring MBTCP Servers

This section contains database offset information used by the PLX3x gateway
MBTCP server when accessed by external clients. You can use these offsets to
segment the database by data type.
To configure the MBTCP Servers in PCB

the [+] next to MBTCP Servers.
2 Double-click the second MBTCP Servers to display the Edit - MBTCP

Servers dialog box.
Note that the Float Start and Float Offset parameters only appear if you set
Float Flag to Yes.

User Manual

Enron-Daniels Yes or No Specifies if the floating-point data access functionality is
active.
YES - Modbus functions 3, 6, and 16 interpret floating-point
values for registers as specified by Float Start and Float
Offset.
NO - The gateway does not use floating point functionality.
Output Offset 0 to 3999 This parameter applies if the port is configured as a slave.
Specifies the internal database address to use as the zero
address or starting point for binary output Coil data. Coil
data is read by Modbus Function Code 1 commands (Read
Coils) and written by Function Codes 5 (Force Single Coil)
or Function Code 15 (Force Multiple Coils). For example, if
you set this parameter to 50 and the gateway receives a
Function Code 1 command requesting Coil address 0
(virtual Modbus Coil address 00001 or 000001), the
gateway returns the value at register 50, bit 0 in the
gateway's database.
Bit Input Offset 0 to 3999 Specifies the offset address in the internal Modbus
database for network requests for Modbus function 2
commands. For example, if you set this value to 150, an
address request of 0 returns the value at register 150 in the
database.
Holding Register Offset 0 to 3999 Specifies the offset address in the internal Modbus
database for network requests for Modbus functions 3, 6, or
16 commands. For example, if you set this value to 50, an
database.
Word Input Offset 0 to 3999 Specifies the offset address in the internal Modbus
database for network requests for Modbus function 4
commands. For example, if you set the value to 150, an
database.
Connection Timeout 0 to 1200 Specifies the number of seconds the server waits to receive
new data. If the server does not receive any new data
during this time, it closes the connection.
MBAP TCP Port 501 Specifies the server port associated to MBAP transactions.
(Default) Most applications will refer to port 502.
MBAP Pass Through 2011 Specifies the server port associated with the pass through
TCP Port (Default) feature. All Modbus TCP/IP messages (with MBAP header)
received at this port will be converted to Modbus RTU and
transferred to the gateway’s serial port.
MBAP Pass Through 1 to 125 Specifies the Slave ID for the Modbus RTU message
Slave ID transferred through the serial port.
If this parameter is set to 0, then the Modbus RTU message
will have the slave ID matching the Unit Identifier value,
which is part of the MBAP header of the incoming Modbus
TCP/IP message.

User Manual
6.2.2 Pass Through Feature

The Pass Through feature enables the PLX3x gateway to pass incoming Modbus
TCP/IP MBAP messages to a remote Modbus RTU slave connected to the
(master) serial port. For this application, the PLX3x gateway’s database is not
updated with the Modbus TCP/IP command values since the messages are
converted and transferred directly between the Modbus TCP/IP and Modbus
RTU networks:
The Modbus serial port must be configured for master operation:
To configure the Pass Through feature, refer to the MBTCP Servers section to
configure the MBAP Pass Through parameters:

User Manual
6.2.3 Configuring MBTCP Client [x]

The MBTCPClient [x] section of the configuration specifies the parameters for the
client to be emulated on the gateway. The command list for the client is entered
in a separate section.
To configure the MBTCP Client [x] in PCB

the [+] next to MBTCP Client [x].
2 Double-click the second MBTCP Client [x] to display the Edit - MBTCP Client
[x] dialog box.
Float Flag to YES.

Minimum Command 0 to 65535 Specifies the number of milliseconds to wait between the initial

User Manual

Delay issuance of a commands. You can use this to delay all
commands sent to slaves to avoid "flooding" commands on the
network. This parameter does not affect retries of a command as
they will be issued when failure is recognized.
Response Timeout 0 to 65535 Specifies the time in milliseconds that a client waits before re-
transmitting a command if no response is received from the
addressed server. The value you use depends on the type of
communication network, and the expected response time of the
slowest device on the network.
Retry Count 0 to 10 Specifies the number of times the gateway retries a command if
it fails.
Float Flag Yes or No Specifies if the floating-point data access functionality is active.
(Enron-Daniels) YES - Modbus functions 3, 6, and 16 interpret floating-point
values for registers as specified by Float Start and Float Offset.
NO - The gateway does not use floating point functionality.
Float Start 0 to 32767 This parameter only appears if Float Flag is Yes.
Specifies the first register of floating-point data. The gateway
considers all requests with register values greater-than or equal
to this value as floating-point data requests. For example, if you
enter 7000, the gateway considers all requests for registers 7000
and above as floating-point data.
Float Offset 0 to 3998 This parameter only appears if Float Flag is Yes.
Specifies the starting register for floating-point data in the
gateway internal database. For example:
 If you set Float Offset to 3000 and set Float Start to 7000,
the gateway returns data as floating-point data for register
47001 (or 407001) actually comes from internal gateway
registers 3000 and 3001.
 If the requested address is 47002 (407002), the gateway
returns data from internal registers 3002 and 3003.
 If the requested address is 47101 (407101), the gateway
returns data from internal registers 3200 and 3201; and so
on.
Command Error Delay 0 to 300 Specifies the number of 100 millisecond intervals to turn off a
command in the error list after an error is recognized for the
command. If you set this to 0, there is no delay.
MBAP Port Override Yes or No Specifies whether to override the default port settings.
YES - The gateway uses MBAP format messages for all Server
Port values. The gateway does not use RTU through TCP.
NO - The gateway uses standard Server Port 502 with MBAP
format messages. All other Server Port values use encapsulated
Modbus message format (RTU through TCP).

User Manual
6.2.4 Configuring MBTCP Client [x] Commands

The MBTCP Client [x] Commands section defines the Modbus TCP/IP
commands to be issued from the gateway to server devices on the network. You
can use these commands for data collection and/or control of devices on the
TCP/IP network.
To configure the MBTCP Client [x] commands in PCB

the [+] next to MBTCP Client [x].
2 Double-click MBTCP Client [x] Commands to display the Edit - MBTCP Client
[x] Commands dialog box.
3 In the dialog box, click ADD ROW to add a command, then click EDIT ROW to
enter values for the command.
You must construct a command list in order to interface the PLX3x gateway with
Modbus TCP/IP server devices. The commands in the list specify the server
device to be addressed, the function to be performed (read or write), the data
area in the device to interface with and the registers in the internal database to
be associated with the device data. The client command list supports up to 16
commands per client. The gateway processes the command list from top
(command #0) to bottom.
The following table describes the command list configuration parameters:
Enable YES Specifies if the command is to be executed and under what conditions.
NO NO (0) - the command is disabled and is not executed in the normal
CONDITONAL polling sequence.
YES (1) - the command is executed upon each scan of the Command
List if the Poll Interval is set to zero (0). If the Poll Interval is set to a non-
zero value, the command is executed when the interval timer for that
command expires.
CONDITIONAL (2) - the command is executed only if the internal bit data
associated with the command changes. This parameter is valid for write
commands (FC 5, 6, 15 and 16).
Internal 0 to 3999 (for Specifies the database address in the gateway's internal database to
Address register-level use as the destination for data from a read command, or as the source
addressing) for data sent by a write command. The database address is interpreted
or as a bit address or a 16-bit register (word) address, depending on the
0 to 63999 (for Modbus Function Code used in the command.
bit-level  For Modbus functions 1, 2, 5, and 15, this parameter is interpreted
addressing) as a bit-level address.
 For Modbus functions 3, 4, 6, and 16, this parameter is interpreted
as a register-level address.
Poll Interval 0 to 65535 Specifies the minimum interval between executions of continuous

User Manual

commands. The value is in tenths of a second. If you enter a value of
100, the command executes no more frequently than once every 10
seconds.
Reg Count 1 to 125 (for Specifies the number of 16-bit registers or binary bits to be transferred
registers) by the command.
or  Modbus functions 5 and 6 ignore this field as they apply only to a
1 to 800 (for single data point.
coils)  For Modbus functions 1, 2, and 15, this parameter sets the number
of bits (inputs or coils) transferred by the command.
 For Modbus functions 3, 4, and 16, this parameter sets the number
of registers transferred by the command.
Swap Code No Change Specifies if and how the order of bytes in data received or sent is to be
Word Swap rearranged. Different manufacturers store and transmit multi-byte data in
Word and Byte different combinations. You can use this parameter when dealing with
Swap floating-point or other multi-byte values, as there is no standard method
of storing these data types. You can set this parameter to rearrange the
Byte Swap byte order of data received or sent into an order more useful or
convenient for other applications.
NO CHANGE (0) - No change is made in the byte ordering (1234 = 1234).
WORD SWAP (1) -The words are swapped (1234=3412).
WORD AND BYTE SWAP (2) - The words are swapped, then the bytes in
each word are swapped (1234=4321).
BYTE SWAP (3) - The bytes in each word are swapped (1234=2143).
These swap operations affect 4-byte (2-word) groups of data. Therefore,
data swapping using Swap Codes should be done only when using an
even number of words, such as 32-bit integer or floating-point data.
Node IP xxx.xxx.xxx.xxx IP address of the device being addressed by the command.
Address
Serv Port 502 or other Service Port on which communication will occur. Use a value of 502
supported port when addressing Modbus TCP/IP servers that are compatible with the
on server Schneider Electric MBAP specifications (this will be most devices). If the
server device supports another Service Port, enter the Service Port
value for this parameter.
Slave 1 to 255 (0 is a Specifies the node address of a remote Modbus Serial device through a
Address broadcast) Modbus Ethernet to Serial converter.
Note: Most Modbus devices only accept addresses in the range of 1 to
247, so check with the slave device manufacturer to see if the slave
device can use addresses 248 to 255.
If the value is set to zero, the command will be a broadcast message on
the network. The Modbus protocol permits broadcast commands for
write operations. Do not use node address 0 for read operations.
Modbus 1, 2, 3, 4, 5, 6, Specifies the Modbus Function Code to be executed by the command.
Function 15, or 16 These function codes are defined in the Modbus protocol. More
information on the protocol is available from www.modbus.org
(http://www.modbus.org) or see About the Modbus Protocol (page 113).
The following function codes are supported by the gateway.
1 - Read Coil Status
2 - Read Input Status
3 - Read Holding Registers
4 - Read Input Registers
5 - Force (Write) Single Coil

User Manual

6 - Preset (Write) Single Register
15 - Force Multiple Coils
16 - Preset Multiple Registers
MB Address Varies Specifies the starting Modbus register or bit address in the server to be
in Device used by the command. Refer to the documentation of each Modbus
server device for the register and bit address assignments valid for that
device.
The Modbus Function Code determines whether the address is a
register-level or bit-level OFFSET address into a given data type range.
The offset is the target data address in the server minus the base
address for that data type. Base addresses for the different data types
are:
 00001 or 000001 (0x0001) for bit-level Coil data (Function Codes 1,
5, and 15).
 10001 or 100001 (1x0001) for bit-level Input Status data (Function
Code 2)
 30001 or 300001 (3x0001) for Input Register data (Function Code 4)
 40001 or 400001 (4x0001) for Holding Register data (Function
Codes 3, 6, and 16).
 Address calculation examples:
 For bit-level Coil commands (FC 1, 5, or 15) to read or write a Coil
0X address 00001, specify a value of 0 (00001 - 00001 = 0).
 For Coil address 00115, specify 114
(00115 - 00001 = 114)
 For register read or write commands (FC 3, 6, or 16) 4X range, for
40001, specify a value of 0
(40001 - 40001 = 0).
 For 01101, 11101, 31101 or 41101, specify a value of 1100.
(01101 - 00001 = 1100)
(11101 -10001 = 1100)
(31101 - 30001 = 1100)
(41101 - 40001 = 1100)
Note: If the documentation for a particular Modbus server device lists
data addresses in hexadecimal (base16) notation, you must convert the
hexadecimal value to a decimal value for this parameter. In such cases,
it is not usually necessary to subtract 1 from the converted decimal
number, as this addressing scheme typically uses the exact offset
address expressed as a hexadecimal number.
6.3 Network Diagnostics

User Manual
6.3.1 MBTCP PCB Diagnostics

The best way to troubleshoot the MBTCP driver is to use ProSoft Configuration
debug port. For instructions on how to access the diagnostics, see Diagnostics
and Troubleshooting (page 31).
MBTCP driver:
MBTCP Server Config Configuration settings for Server Connections.
Comm Status Status of the Server Connections. Displays a summary of the
requests, responses, and errors.
MBTCP Client [x] Config Configuration settings for Client [x] Connections.
Comm Status Status information for Client [x] commands. Displays a
summary of all the errors resulting from Client [x] commands.
Modbus
Configuration for the Client [x] Modbus command list.
Commands
Modbus Cmd Current error codes for each command on the Client [x]
Errors (Decimal) command list in decimal number format. A zero means there is
currently no error for the command.
Modbus Cmd Current error codes for each command on the Client [x]
Errors (Hex) command list in hexadecimal number format. A zero means
there is currently no error for the command.
6.3.2 MBTCP Status Data in Upper Memory

The MBTCP driver has an associated status data area located in the PLX3x
gateway’s upper memory. The Data Map functionality of the PLX3x gateway can
be used to map this data into the normal user data range of the PLX3x gateway’s
database.
Note that all the status values are initialized to zero (0) at power-up, cold boot
and during warm boot.
MBTCP Server Status Data

gateway stores status data for MBTCP servers:
Server Port Address Range
2000 11000 through 11009
502 11010 through 11019
2001 11020 through 11029
The content of each server's status data area is structured the same. The

User Manual
Offset Description
0 Number of Command Requests
1 Number of Command Responses
2 Number of Command Errors
3 Number of Requests
4 Number of Responses
5 Number of Errors Sent
6 Number of Errors Received
7 Configuration Error Word
8 Current Error Code
9 Last Error Code
MBTCP Client Status Data

gateway stores status data for each MBTCP Client:
Client Address Range
0 15500 through 15509
1 15526 through 15535
2 15552 through 15561
. .
. .
8 15708 through 15717

9 15734 through 15743
The content of each Client’s status data area is structured the same. The
Offset Description
0 Command Request Count (total Client commands sent)
1 Command Response Count (total command responses received)
2 Command Error Count
3 Number of Request Packets
4 Number of Response Packets
5 Errors Sent
6 Errors Received
7 Reserved
8 Current Error
9 Last Error
 Offsets 8 and 9 contain information about the most recent communication

errors.

User Manual
 The Current Error (offset 8) has a non-zero value if the currently executing
client command experiences an error.
 The Last Error (offset 9) stores the most recent non-zero value error code
that was reported by the client the last time it experienced an error. Note that
this value is protected. This register holds the last error value until you clear
the memory by a restart, reset, cold-boot, or warm-boot operation. Therefore,
any value here may be from an error that occurred at any time since the
PLX3x gateway was last restarted.
MBTCP Client Command List Error Data

The PLX3x gateway stores a status/error code in upper memory for each
command in each MBTCP client’s command list. The following table lists the
addresses in upper memory where the PLX3x gateway stores the command list
error data for each MBTCP Client:
Client Address Range
0 15510 to 15525
1 15536 to 15551
2 15562 to 15577
. .
. .
8 15718 to 15733
9 15744 to 15759
The first word in each client’s command list error data area contains the
status/error code for the first command in the client’s Command List. Each
successive word in the Command Error List is associated with the next command
in the client Command List. Therefore, the number of valid error values depends
on on the number of commands defined.
The structure of the command list error data area (which is the same for all
Clients) is displayed in the following table:
Offset Description
. .
. .
A non-zero error code for a command indicates an error.

User Manual
6.3.3 MBTCP Error Codes
Standard Modbus Exception Code Errors

These error codes are generated or returned on both the Controller and slave
ports. These codes are the standard Modbus errors.
Code Description
1 Illegal Function
2 Illegal Data Address
3 Illegal Data Value
4 Failure in Associated Device
5 Acknowledge
6 Busy, Rejected Message
MBTCP Client Specific Errors

These error codes are specific to the MBTCP client.
Code Description
-33 Failed to connect to server specified in command
-35 Wrong message length in the response
-36 MBTCP command response timeout (same as -11)
-37 TCP/IP connection ended before session finished
MBTCP Communication Error Codes

The gateway detects these command-specific error codes during initial command
list loading at gateway power-up or reset and are stored in the Command Error
List memory region.
Code Description
-2 Timeout while transmitting message
-11 Timeout waiting for response after request (same as -36)
253 Incorrect slave/server address in response
254 Incorrect function code in response
255 Invalid CRC/LRC value in response

User Manual
MBTCP Command List Error Codes

The PLX3x gateway detects these command-specific error codes during initial
command list loading at PLX3x gateway power-up or reset and are stored in the
Command Error List memory region.
Code Description
-40 Too few parameters
-41 Invalid enable code
-42 Internal address > maximum address
-43 Invalid node address (<0 or >255)
-44 Count parameter set to 0
-45 Invalid function code
-46 Invalid swap code
6.4 MBTCP Reference
6.4.1 About the Modbus Protocol

Modbus is a widely-used protocol originally developed by Modicon in 1978. Since
that time, the protocol has been adopted as a standard throughout the
automation industry.
The original Modbus specification uses a serial connection to communicate
commands and data between master and server devices on a network. Later
enhancements to the protocol allow communication over Ethernet networks using
TCP/IP as a "wrapper" for the Modbus protocol. This protocol is known as
Modbus TCP/IP.
Modbus TCP/IP is a client/server protocol. The master establishes a connection
to the remote server. When the connection is established, the master sends the
Modbus TCP/IP commands to the server. The PLX3x gateway simulates up to 30
masters, and works both as a master and a server.
Aside from the benefits of Ethernet versus serial communications (including
performance, distance, and flexibility) for industrial networks, the Modbus TCP/IP
protocol allows for remote administration and control of devices over an Internet
connection. It is important to note that not all Internet protocols are implemented
in the module; for example, HTTP and SMTP protocols are not available.
Nevertheless, the efficiency, scalability, and low cost of a Modbus TCP/IP
network make this an ideal solution for industrial applications.
The PLX3x gateway acts as an input/output module between devices on a
Modbus TCP/IP network and the Rockwell Automation backplane and processor.
The module uses an internal database to pass data and commands between the
processor and the master and server devices on the Modbus TCP/IP network.

User Manual
Supported Function Codes

The format of each command in the list depends on the Modbus Function Code
being executed. The following table lists the Function Codes supported by the
PLX3x gateway.
Function Code Definition Supported as master Supported as server

1 Read Coil Status 0x X X
2 Read Input Status 1x X X
3 Read Holding Registers 4x X X
4 Read Input Registers 3x X X
5 Set Single Coil 0x X X
6 Single Register Write 4x X X
8 Diagnostics X
15 Multiple Coil Write 0x X X
16 Multiple Register Write 4x X X
17 Report Slave ID X
22 Mask Write 4X X
23 Read/Write X
Each command list record has the same general format. The first part of the
record contains the information relating to the communication module and the
second part contains information required to interface to the Modbus server
device.

User Manual

MBS Protocol PLX3x Series ♦ Multi-Protocol Gateways
User Manual
7 MBS Protocol
In This Chapter
 MBS Functional Overview ................................................................... 116
 MBS Configuration............................................................................... 120
 MBS Diagnostics ................................................................................. 128
 MBS Reference ................................................................................... 134
7.1 MBS Functional Overview

You can use the the PLX3x gateway Modbus Serial (MBS) protocol for both
master and slave connections. Each of the gateway serial port(s) is individually
configurable to communicate to separate networks.
 As a master, you can specify a command list of up to 100 entries. The
gateway stores the write command data in the gateway's lower memory. This
is also where the gateway stores data from read commands from other
devices. See MBS Internal Database (page 118) for more information.
 As a slave, data in the lower memory of the gateway's internal database is
accessible for read and write operations by a remote Modbus master.
The following illustration shows the functionality of the Modbus TCP/IP protocol:

PLX3x Series ♦ Multi-Protocol Gateways MBS Protocol
User Manual
7.1.1 Modbus Serial Specifications
Command List Up to 100 commands per Master port, each fully configurable for
Function Code, slave address, register to/from addressing and word/bit
count.
Supported Modbus 1: Read Coil Status
Function Codes 2: Read Input Status
3: Read Holding Registers
4: Read Input Registers
5: Force (Write) Single Coil
6: Preset (Write) Single Holding Register
15: Force (Write) Multiple Coils
16: Preset (Write) Multiple Holding Registers
Polling of Command Configurable polling of command list, including continuous and on
List change of data, and dynamically user or automatic enabled.
Status Data Error codes available on an individual command basis. In addition, a
slave status list is maintained per active Modbus Master port.
Node Address 1 to 247 (software selectable)
RS Interface RS232, RS422, and RS485
7.1.2 Modbus Master/Slave Port Specifications
Type Specifications
General Parameters
Internal Database Up to 4000 registers (words) available.
Communication Port 0: Baud Rate: 110 to 115K baud
parameters Port 1, 2, 3: Baud Rate: 110 to 115K baud
Stop Bits: 1 or 2
Data Size: 5 to 8 bits
Parity: None, Even, Odd RTS Timing delays: 0 to 65535 milliseconds
Modbus Modes RTU mode (binary) with CRC-16
ASCII mode with LRC error checking
Floating Point Data Floating point data movement supported, including configurable support
for Enron implementation

User Manual
Type Specifications
Modbus Function 1: Read Coil Status
Codes 2: Read Input Status
3: Read Holding Registers
4: Read Input Registers
5: Force (Write) Single Coil
6: Preset (Write) Single Register
15: Force(Write) Multiple Coils
16: Force (Write) Multiple Register
22: Mask Write Holding Register (Slave Only)
23: Read/Write Holding Registers (Slave Only)
Modbus Master
Command List Up to 100 command per Master port, each fully configurable for function,
slave address, register to/from addressing and word/bit count
Status Data Error codes available on an individual command basis. In addition, a
slave status list is maintained per active Modbus Master port.
Polling of command list Configurable polling of command list, including continuous and on change
of data
Modbus Slave
Node address 1 to 247 (software selectable)
Status Data Error codes, counters and port status available per configured slave port
starting at register 4400.
7.1.3 MBS Internal Database


User Manual
user data area.
the user data area.
module status data, see MBS Diagnostics (page 128).

User Manual
Modbus Port Access to Database

The multiple slave support in the PLX3x gateway permits remote master
applications (such as HMI software and Quantum processors) to read from, and
write to the gateway’s database.
When you configure the gateway as a slave, its internal database is the source
for read requests and the destination for write requests from remote masters.
Access to the database is controlled by the command type in the incoming
message from the remote master. The following table defines the relationship of
the gateway’s internal database to the addresses required in the incoming
Modbus requests.

0 40001 (five-digit addressing) or 400001 (six-digit addressing)
1000 41001 or 410001
2000 42001 or 420001
3000 43001 or 430001
3999 44000 or 440000
7.2 MBS Configuration
7.2.1 Configuring MBS Port [x]

The Modbus Port [x] sections of the PCB Tree Window, where x stands for 1, 2,
3 or 4, set the Modbus master and slave port communication parameters and
specify the protocol-specific settings.
To configure the MBS Port [x] in PCB

the [+] next to MBS Port [x].
2 Double-click the Modbus Port [x] to display the Edit - Modbus Port [x] dialog
box.

User Manual
Float Flag to YES.

User Manual
Configuration Parameters Common to Master and Slave

Enabled Yes or No Specifies if the port will be used.
NO - The gateway does not use the port.
YES - The gateway uses the port.
RS Interface RS-232 Specifies the electrical interface for the ports.
RS-485
RS-422
Type Master Specifies if the port emulates a master or slave device.
or MASTER - The gateway initiates Modbus commands to one or more Modbus
Slave devices
SLAVE - The gateway responds to Modbus commands initiated by a Modbus
master
Float Flag Yes or No This parameter only appears if Float Flag is Yes.
(Enron- Specifies if the gateway implements floating-point data access. If the float flag
Daniels) is set to Yes, Modbus functions 3, 6, and 16 interpret floating-point values for
registers as specified by the two following parameters (Float Start and Float
Offset).
Float Start 0 to 32767 This parameter only appears if Float Flag is Yes.
Specifies the first register of floating-point data. All requests with register
values greater than or equal to this value are considered floating-point data
requests. For example, if you enter a value of 7000, the gateway considers all
requests for registers 7000 and above will as floating-point data.
Float Offset 0 to 3998 This parameter only appears if Float Flag is Yes.
Specifies the start register for floating-point data in the internal database. For
example, if you enter a value of 3000 and set the Float Start parameter to
7000, data requests for register 7000 use the internal Modbus register 3000.
Protocol RTU or Specifies the Modbus protocol version for the port.
ASCII
Baud Rate Various Specifies the baud rate for the port.
Parity None Specifies the type of parity checking to use. Parity is a simple error checking
Odd algorithm used in serial communication. All devices communicating through
Even this port must use the same parity setting.
Data Bits 7 or 8 Specifies the number of data bits for each word for the protocol.
All devices on this port must use the same number of data bits.
Stop Bits 1 or 2 Specifies the number of stop bits that signal the end of a character in the data
stream. For most applications, use one stop bit. For slower devices that
require more time to re-synchronize, use two stop bits.
All devices on this port must use the same number of stop bits.
RTS On 0 to 65535 Specifies the number of milliseconds to delay data transmission after Ready
To Send (RTS) is asserted.
RTS Off 0 to 65535 Specifies the number of milliseconds to delay after the last byte of data is sent
before the RTS modem signal is set low.
Use CTS YES or NO Specifies if the Clear To Send (CTS) modem control line is used or not.
Line NO - The gateway does not monitors the CTS line.
YES - The gateway monitors the CTS line and it must be high before the
gateway sends data. Normally, this parameter is required when half-duplex
modems are used for communication (2-wire). This procedure is commonly
referred to as hardware handshaking.

User Manual
MBS Master Configuration Parameters

Response 0 to 65535 Specifies the command response timeout period in 1 millisecond increments.
Timeout This is the time that a port configured as a Master waits for a response from
the addressed slave before re-transmitting the command or skipping to the
next command in the Command List (see Retry Count). The value to specify
depends on the communication network and the expected response time
(plus or minus) of the slowest device on the network.
Retry Count 0 to 10 Specifies the number of times the gateway retries a command if it fails.
End of 0 to 65535 Specifies a time delay in milliseconds added to the 3.5 character time delay
Message used by the module to recognize the end of a message. Certain applications
Delay may require validation of Modbus messages with more than 3.5 character
time between consecutive bytes (for example, modem applications). A value
of 0 causes the gateway to use the default end of message delay.
Minimum 0 to 32767 Specifies the number of milliseconds the gateway waits between receiving
Command the end of a slave's response to the most recently transmitted command and
Delay the issuance of the next command. You can use this parameter to place a
delay after each command to avoid sending commands on the network faster
than the slaves can receive them. This parameter does not affect retries of a
command, as the gateway issues retries when a command failure is
recognized.
Error Delay 0 to 60000 Specifies the number of poll attempts to be skipped before trying to re-
Counter establish communications with a slave that has failed to respond to a
command within the time limit set by Response Timeout. After the slave fails
to respond, the master skips sending commands that would have been sent
to the slave until the number of skipped commands matches the value
entered in this parameter. This creates a sort of slow poll mode for slaves
that are experiencing communication problems.
Command -1, 0 to 3900 This parameter allows the execution of commands in the Command List to be
Control Reg controlled by setting a value of zero (0), one (1), two (2), or three (3) into a
100-register area of the gateway database, beginning at the address entered
in this parameter.
 If you specify an Enable code of zero (0) for all the commands in the list,
then no commands are executed.
 If you change the value in the first control register to one (1), the
gateway executes command zero continuously.
 If you set the value is the control register for a write command two (2),
the command is enabled for conditional writing, which causes the
gateway to execute the command whenever the values in the database
registers associated with the command change. Use the value of three
(3) only for bit-level write commands, FC 5 and 15. If you set the
parameter to three (3), the command is executed only if the internal bit
data associated with the command changes. It also clears the bit or bits
in the internal database after the write command is built.
 To use this feature, configure the commands as disabled (enable code =
0).
 This Command Control feature can be disabled by setting this parameter
to a value of 0 to -1.
For information on the Command List, see MBS Port [x] Commands (page
124).

User Manual
MBS Slave Configuration Parameters

Minimum 0 to 65535 Specifies the number of milliseconds the gateway waits before
Response Delay responding to a command received on the port from a remote Master.
This delay may be required to accommodate slower Master devices.
Internal Slave ID 0 to 247 Specifies the virtual Modbus slave address for the port. The gateway
processes any commands received on the slave port, addressed to this
address. Each slave device on the network must have a unique address.
Bit Input Offset 0 to 3998 Specifies the internal database address for the zero address or starting
point for binary Input Status data. Input Status data is read-only data,
requested by Modbus Function Code 2 commands (Read Input Status).
For example, if you set this parameter to 150 and a Function Code 2
command is received requesting Input Status address 0 (virtual Modbus
Address 10001 or 100001), the gateway returns the bit value at register
150, bit 0 in the gateway's database.
Word Input Offset 0 to 3998 Specifies the internal database address for the zero address or starting
point for Input Register (16-bit integer) data. Input Register data is read-
only data, requested by Modbus Function Code 4 commands (Read
Input Registers).
command is received requesting Input Register address 0 (virtual
Modbus address 30001 or 300001), the module returns the value at
register 500 in the gateway's database.
Output Offset 0 to 3998 Specifies the internal database address for the zero address or starting
point for binary output Coil data. Coil data is read by Modbus Function
Code 1 commands (Read Coils) and written by Function Codes 5 (Force
Single Coil) or Function Code 15 (Force Multiple Coils).
command is received requesting Coil address 0 (virtual Modbus Coil
address 00001 or 000001), the gateway returns the value at register 50,
bit 0 in the gateway's database.
Holding Register 0 to 3998 Specifies the internal database address to for the zero address or
Offset starting point for Holding Register (16-bit integer) data. Holding Register
data is read by Modbus Function Code 3 commands (Read Holding
Registers) and written by Function Code 6 (Preset Single Register) or
Function Code 16 (Preset Multiple Registers).
command is received requesting Holding Register address 0 (virtual
Modbus address 40001 or 400001), the gateway returns the value at
register 1000 in the gateway's database.
End of Message 0 to 65535 Specifies a time delay in milliseconds to be added to the 3.5 character
Delay time delay that the gateway uses to recognize the end of a message.
Certain applications may require validation of Modbus messages with
more than 3.5 character time between consecutive bytes (for example,
modem applications). A value of 0 causes the gateway to use the default
end of message delay.
7.2.2 MBS Port [x] Commands

Use the Modbus Port [x] Commands (where x can be 1, 2, 3 or 4) sections of the
PCB tree Window to define a naster serial port Command List. This list holds the
parameters needed to poll slave devices attached to a Master port.

User Manual
To configure the MBS Port [x] commands PCB

the [+] next to MBS Port [x].
2 Double-click the Modbus Port [x] Commands to display the Edit - Modbus
Port [x] Commands dialog box.
3 In the dialog box, click ADD ROW to add a command, then click EDIT ROW to
enter values for the command.

Enable Disabled Specifies if the command is to be executed and under what conditions.
Continuous DISABLED (0) - The command is disabled and is not executed in the
Event normal polling sequence. However, the command can still be activated
Command using Command Control.
Conditional CONTINUOUS (1) - The command is executed upon each scan of the
Command List if you set Poll Interval to zero (0). If you set Poll Interval
to a non-zero value, the gateway executes the command when the
interval timer for that command expires.
EVENT COMMAND (2) - The gateway executes the command only if the
internal data associated with the command changes. This parameter is
valid only for write commands (FC 5, 6, 15, and 16).
CONDITIONAL (3) - The gateway executes the command only if the
internal bit data associated with the command changes. It also clears the
bit or bits in the internal database after the write command is built. This
parameter is valid only for bit-level write commands (FC 5 and 15).
Internal 0 to 3999 (for Specifies the database address in the gateway's internal database for
Address register-level the destination for data from a read command, or as the source for data
addressing) for a write command. The database address is interpreted as a bit
or address or a 16-bit register (word) address, depending on the Modbus
0 to 63999 (for Function Code used in the command.
bit-level  For Modbus functions 1, 2, 5, and 15, this parameter is interpreted
addressing) as a bit-level address.
 For Modbus functions 3, 4, 6, and 16, this parameter is interpreted
as a register-level address.
Poll Interval 0 to 65535 Specifies the minimum interval between executions of continuous
commands, in seconds. If you enter a value of 10, the command
executes no more frequently than once every 10 seconds.
Reg Count 1 to 125 (for Specifies the number of 16-bit registers or binary bits to be transferred
registers) by the command.

User Manual

or  Modbus functions 5 and 6 ignore this field as they apply only to a
1 to 800 (for single data point.
coils)  For Modbus functions 1, 2, and 15, this parameter sets the number
of bits (inputs or coils) to be transferred by the command.
 For Modbus functions 3, 4, and 16, this parameter sets the number
of registers to be transferred by the command.
Swap Code No Change Specifies if and how the order of bytes in data received or sent is
Word Swap rearranged. This option allows for the fact that different manufacturers
Word and Byte store and transmit multi-byte data in different combinations. This
Swap parameter is helpful when dealing with floating-point or other multi-byte
values, as there is no one standard method of storing these data types.
Byte Swap You can set Swap Code to rearrange the byte order of data received or
sent into an order more useful or convenient for other applications.
NO CHANGE (0) - No change is made in the byte ordering (1234 = 1234)
WORD SWAP (1) -The words are swapped (1234=3412)
WORD AND BYTE SWAP (2) - The words are swapped, then the bytes in
each word are swapped (1234=4321)
BYTE SWAP (3) - The bytes in each word are swapped (1234=2143)
These swap operations affect 4-byte (or 2-word) groups of data.
Therefore, you should use data swapping only when using an even
number of words, such as when 32-bit integer or floating-point data.
Node 1 to 255 (0 is a Specifies the node address of the Modbus slave device.
Address broadcast) Note: Most Modbus devices only accept addresses in the range of 1 to
247, so check with the slave device manufacturer to see if a particular
slave can use addresses 248 to 255.
If you set the value to zero (0), the gateway broadcasts the command on
the network. The Modbus protocol permits broadcast commands for
write operations. Do not use node address 0 for read operations.
Modbus 1, 2, 3, 4, 5, 6, Specifies the Modbus Function Code executed by the command. These
Function 15, or 16 function codes are defined in the Modbus protocol. More information on
the protocol is available from www.modbus.org (http://www.modbus.org)
or see About the Modbus Protocol (page 113).) The following function
codes are supported by the gateway.
1 - Read Coil Status
2 - Read Input Status
3 - Read Holding Registers
4 - Read Input Registers
5 - Force (Write) Single Coil
6 - Preset (Write) Single Register
15 - Force Multiple Coils
16 - Preset Multiple Registers

User Manual

MB Address Varies Specifies the starting Modbus register or bit address in the server for the
in Device command. Refer to the documentation of each Modbus server device for
the register and bit address assignments valid for that device.
The Modbus Function code determines whether the address is a
register-level or bit-level OFFSET address into a given data type range.
The offset is the target data address in the server minus the base
address for that data type. Base addresses for the different data types
are:
 00001 or 000001 (0x0001) for bit-level Coil data (Function Codes 1,
5, and 15).
 10001 or 100001 (1x0001) for bit-level Input Status data (Function
Code 2)
 30001 or 300001 (3x0001) for Input Register data (Function Code
4)
 40001 or 400001 (4x0001) for Holding Register data (Function
Codes 3, 6, and 16).
Address calculation examples:
 For bit-level Coil commands (FC 1, 5, or 15) to read or write a Coil
0X address 00001, specify a value of 0 (00001 - 00001 = 0).
 For Coil address 00115, specify 114
 (00115 - 00001 = 114)
 For register read or write commands (FC 3, 6, or 16) 4X range, for
40001, specify a value of 0
(40001 - 40001 = 0).
 For 01101, 11101, 31101 or 41101, specify a value of 1100.
(01101 - 00001 = 1100)
(11101 -10001 = 1100)
(31101 - 30001 = 1100)
(41101 - 40001 = 1100)
Note: If the documentation for a particular Modbus server device lists
data addresses in hexadecimal (base16) notation, you must convert the
hexadecimal value to a decimal value for this parameter. In such cases,
you usually do not have to subtract 1 from the converted decimal
number, as this addressing scheme typically uses the exact offset
address expressed as a hexadecimal number.

User Manual
7.3 MBS Diagnostics
7.3.1 MBS PCB Diagnostics

The best way to troubleshoot the MBS driver is to use ProSoft Configuration
MBS driver:
MBS Port [x] Config Configuration settings for MBS Port [x].
Comm Status Status information for MBS Port [x] commands. Displays a
summary of all the errors resulting from MBS Port [x]
commands.
Slave Status Current poll status of each slave device on MBS Port [x].
Modbus Cmds Configuration for the MBS Port [x] Modbus command list.
Modbus Cmd Current error codes for each command on the MBS Port [x]
Errors (Decimal) command list in decimal number format. A zero means
there is currently no error for the command.
Modbus Cmd Current error codes for each command on the MBS Port [x]
Errors (Hex) command list in hexadecimal number format. A zero
means there is currently no error for the command.
7.3.2 MBS Status Data in Upper Memory

Each Modbus port has an associated status data area located in the gateway’s
upper memory. The Data Map functionality of the gateway can be used to map
this data into the normal user data range of the gateway’s database. See
Mapping Data in Module Memory (page 24).
General Modbus Error and Status Data

The following table lists the starting addresses in upper memory where the
gateway writes general error and status data for each Modbus master or slave
port. Note that all the status values are initialized to zero (0) at power-up, cold
boot and during warm boot.
Modbus Port Starting Address
1 4400
2* 4800
3* 5200
4* 5600
*Status data for Ports 2 through 4 is only present in 4-port PLX3x gateways.
Warning: None of these addresses are available in the Modbus address range. In order to access
this data through a Modbus request, you must move the data into the 0 to 3999 address range.
See Mapping Data in Module Memory (page 24).

User Manual
Port 1 General Modbus Error and Status Layout

The addresses listed are for Port 1only. The format is the same for each port.
See General Modbus Error and Status Data (page 128) for the start address for
each port.
Example Internal Offset Description

Database Address
4400 0 Number of Command Requests
4401 1 Number of Command Responses
4402 2 Number of Command Errors
4403 3 Number of Requests
4404 4 Number of Responses
4405 5 Number of Errors Sent
4406 6 Number of Errors Received
4407 7 Configuration Error Code
4408 8 Current Error/Index
4409 9 Last Error/Index
Slave Port: General Port State and ComState Status
Note: There are two additional port status parameters that are not available from the General
Modbus Error and Status Data area. The status values, Port State and Port ComState (circled in
red in the graphic below), can be found only in the PCB diagnostic menus under Comm Status for
a port.

User Manual
These status values are state registers. They are used as "scratchpad" areas by
the gateway firmware to keep track of the current logical state of activities on a
slave port. These state registers are constantly changing as the gateway
progresses through the various stages needed to process communication on the
serial ports. This processing happens faster than can be followed, unless a port
error causes the value to remain constant for some noticeable length of time.
The diagnostic screen display a snapshot of the data; that is, the current values
at the time they are displayed, but the module does not update the data. They
are not live-data screens. Therefore, to see a change in State or ComState, you
must repeatedly update the screen by pressing the appropriate menu key to have
the screen refreshed. Depending on the refresh timing you may or may not see a
change in the displayed values every time you call for an update.
The State register may display any of the following values:
State Value Description
-2 Preparing port, Flushing all buffers, Scan for RTS-Off, or Waiting for port
enable signal
-1 Waiting for receipt of data
0 Undefined state
1 Receiving a message from the Master
2 Building a slave response message
7 Modbus master is fetching next command
2000 Sending slave response to the Master
The ComState register may display any of the following values:

ComState Value Description
0 Port not sending data (Wait for send)

1 Setting up minimum Response Delay Timer
101 Waiting for Minimum Response Delay to timeout
2 Turning on RTS line and starting RTS-On Delay Timer
3 Waiting for RTS-On Delay timer to timeout
4 Sending data
5 Waiting for all data to be sent and starting RTS-Off Delay Timer
6 Waiting for RTS-Off Delay timeout and then turning OFF RTS line after timeout
Master Port: Command List Errors

The individual command errors for each master port are returned to the address
locations specified in the following table. Each port can have up to 100
commands configured. Each configured command uses one word of these data
areas to store a value representing the execution status from the most recent
command execution attempt. Note that all the status values are initialized to zero
(0) at power-up, cold boot and during warm boot.

User Manual
Modbus Port Address Range

1 4410 to 4509
2* 4810 to 4909
3* 5210 to 5309
4* 5610 to 5709
*Status data for Ports 2 through 4 is only present in 4-port PLX3x gateways
Port 1 Command Error List Layout

The first word in the specified register location contains the status/error code for
the first command in the port's Command List. Successive words in the
Command Error List are associated with corresponding commands in the list.
The addresses listed are for Port 1 only; but the format is the same for each port.
See Master Port: Command List Errors (page 130) for the start address for each
port.
Internal Database Offset Description

Address (Example)
4410 0 Command #1 Error Code
... ... ...
... ... ...
... ... ...

User Manual
Note that the gateway initializes the Command Error List tables to zero (0) at
power-up, cold boot, and warm boot. If a command executes successfully, the
value in the associated register remains at zero (0), indicating no command error
was detected. Any non-zero value in this table indicates the corresponding
command experienced an error.
The data in this table is dynamic and is updated each time a command is
executed. Therefore, if the command fails once and succeeds on the next
attempt, the error code from the previously failed attempt is overwritten with zero
and be lost. Error codes are not archived in the gateway's database. To see if the
port has experienced an error since the most recent restart and what the most
recently occurring error was, if any, you can check the Last Error/Index.
Master Port: Modbus Slave List Status

The gateway stores Slave List Status values for each Master port in the address
locations specified in the following table. Note that all the status values are
initialized to zero (0) at power-up, cold boot and during warm boot.
Modbus Port Address Range

1 4510 to 4764
2* 4910 to 5164
3* 5310 to 5564
4* 5710 to 5964
*Status data for Ports 2 through 4 is only present in 4-port MBS gateways.
Port 1 Slave List Status Layout

The addresses listed are for Port 1 only; but the format is the same for each port.
See Master Port: Modbus Slave List Status (page 132) for the start address for
each port.
Internal Offset Description
Database
Address
(Example)
4510 0 Slave #1 Status

User Manual
Internal Offset Description

Database
Address
(Example)
. .
. .
The slave status list contains the current poll status of each slave device on a
master port. Slaves attached to a master port can have one of three states.
Status Description
0 The slave has is not defined in the command list for the master port and is not polled
from the Command List.
1 The slave is configured to be polled by the master port and the most recent
communication attempt was successful.
2 The Master port failed to communicate with the slave device. Communication with the
slave is suspended for a user-defined period based on the scanning of the command list.
Slaves are defined to the system when the gateway loads the Master Command
List during start-up and initialization. Each slave defined is set to a state value of
1 in this initial step. If the master port fails to communicate with a slave device
(timeout expired on a command, retries failed), the master sets the state of the
slave to a value of 2 in this status table. This suspends communication with the
slave device for a user-specified Error Delay Count.
When the master first suspends polling of a particular slave, it creates an Error
Delay Counter for this slave address and set the value in that counter equal to
the Error Delay Counter parameter in the configuration file. Then, each time the
gateway scans a command in the list that has the address of a suspended slave,
the gateway decrements the delay counter value. When the value reaches zero,
the gateway sets the slave state to 1. This re-enables polling of the slave.
The first word in the defined register locations contains the status code for slave
node address 1. Each successive word in the list is associated with the next
node in sequence, up to slave node address 247.
7.3.3 MBS Error Codes

These are error codes that are part of the Modbus protocol or are extended
codes unique to this gateway.

User Manual
Standard Modbus Exception Code Errors

These error codes are generated or returned on both the Controller and slave
ports. These codes are the standard Modbus errors.
Code Description
1 Illegal Function
2 Illegal Data Address
3 Illegal Data Value
4 Failure in Associated Device
5 Acknowledge
6 Busy, Rejected Message
Gateway Communication Error Codes

These gateway-specific error codes are also returned from the command polling
process and stored in the Command Error List memory area.
Code Description
-1 CTS modem control line not set before transmit
-2 Timeout while transmitting message
-11 Timeout waiting for response after request
253 Incorrect slave address in response
254 Incorrect function code in response
255 Invalid CRC/LRC value in response
MBS Command List Error Codes

These command-specific error codes are detected during command list loading
at gateway reboot and are stored in the Command Error List memory area.
Code Description
-41 Invalid enable code
-42 Internal address > maximum address
-43 Invalid node address (<0 or > 255)
-44 Count parameter set to 0
-45 Invalid function code
-46 All parameters set to 0
-47 All parameters set to -1
7.4 MBS Reference

For the Modbus Protocol Specifications, see About the Modbus Protocol (page
113).

PLX3x Series ♦ Multi-Protocol Gateways ASCII Protocol
User Manual
8 ASCII Protocol
In This Chapter
 ASCII Functional Overview.................................................................. 135
 ASCII Configuration ............................................................................. 142
 ASCII Diagnostics ............................................................................... 147
8.1 ASCII Functional Overview

You can use the ASCII protocol in the PLX3x gateway to interface many different
protocols into the Rockwell Automation family of processors, or other software-
based solutions. The ASCII driver permits the gateway to interface any ASCII
device to the many protocols and networks available. ASCII devices include
barcode scanners, weigh scales, many field instruments, printers, and terminals.
The driver supports one to four ports that provide accessibility from one to four
independent serial networks. The number of ports depends on your specific
gateway model.
The following illustration shows the functionality of the ASCII protocol:

ASCII Protocol PLX3x Series ♦ Multi-Protocol Gateways
User Manual
8.1.1 General Specifications
Ports One to four ports to receive and/or transmit data

Receive buffer size 255 bytes
Receive termination Stream mode, termination character(s), message timeout,
inter-character delay, or packet size length
Receive database location -1 = Disable receiver, 0 to 3896
Transmit buffer size 255 bytes
Transmit characters with pacing 0 to 65535 millisecond delay between each transmitted
character
Transmit database location -1 = Disable transmitter, 0 to 3896
Communication Configuration Baud Rate: 110 to 115,200
Parity: None, Odd, Even
Data Bits: 5 to 8
Stop Bits: 1 or 2
RTS On and Off Timing: 0 to 65535 milliseconds
Minimum Response Delay: 0 to 65535 milliseconds
Hardware or Software Handshaking: RTS/CTS, DTR/DSR,
or XON/XOFF
8.1.2 ASCII Data Flow

The following illustration shows receive and transmit data flow of the ASCII
driver.
Data received from the ASCII device is accepted by the receive driver and placed
in the receive database location configured by the user. The receive driver waits
until the termination condition that you define is recognized while receiving the
data before placing the new data into the database.
For example, if you use the carriage-return character (ASCII 13) as the
termination condition for a received message, this signals the end of the
message. When the receive driver sees this character in the input stream, it
takes all received characters and places them in the internal database.

User Manual
In both receive and transmit operations, the driver requires a signal to determine
when new data is received or must be transmitted. The first word in the two data
area is used for this purpose. When the value of the first word changes, new data
is available.
Here is a receive example.
1 The sequence number in the receive data block has a value of 0 (set when
the module initializes).
2 The ASCII device sends a new data packet and the termination condition is
present.
3 The receive driver copies the data into the internal data area, sets the
message length in the data area, and finally, sets the new sequence number.
Receive Data
The gateway places data from the receive driver in the module’s internal
database in a fixed format at the location that you define in ProSoft Configuration
Builder (PCB). The receiver driver is disabled if you set the receive database
start location to a value of -1 when you configure the gateway in PCB. The
following table shows the structure of the received data.
Word Offset Description
0 Receive sequence number. This register is incremented by the module’s Receive
Driver for each new packet received.
1 Number of characters transmitted (0 to 255) from last transmit request on this port.
2 Number of characters received (0 to 255) in the last received terminated string.
3 Receive State
4 Receive Total Count (number of characters received on the port since last reboot).
5 Receive Message Count (number of messages/terminated strings received on the
port since the last reboot).
6 Transmit State
7 Transmit Total Count (number of characters transmitted on this port since the last
reboot).
8 Configuration Error Code
9 to 136 Byte Values for data received, up to 254 characters.
Swapping data bytes

If you configure the module to swap the data bytes, the receive driver swaps the
bytes in each word before placing the data into the data block. Because the data
received may contain an odd number of bytes, the driver increases the length of
the message by 1 when the data has an odd number of bytes when using the
swap option. This avoids losing the last byte of data in the message.

User Manual
Transmit Data
Data to transmit by the transmit driver is placed in the module’s internal database
in a fixed format at the location that you define in ProSoft Configuration Builder
(PCB). The transmit driver is disabled if you set the database start location to a
value of -1. The following table shows the structure of transmit data.
0 Transmit sequence number. This number is incremented by the user’s application
for each new packet to transmit.
1 Number of characters received (0 to 256) from last receive request.
2 Inter-character delay for this message (milliseconds between characters)
3 Number of characters to transmit on Port (0 to 255)
4 to 131 Data to transmit on port
 The first word of the data block signals when new transmit data is available.
 Word 1 of the block optionally contains the number of characters processed
in the last receive message.
 Word 2 of the message paces the characters during the transmission
process. This may be required when interfacing with slow ASCII devices (for
example, modems in command mode). If the word is set to a value other than
zero, the driver inserts a time delay corresponding to the number of
milliseconds between each character transmitted. If you set word 2 to zero,
the transmit driver sends the whole data packet as fast as the driver can
function.
 Word 3 of the data block contains the number of bytes present in the transmit
data area to send out the ASCII port.
 Words 4 to 131 contain the data to transmit.
Swapping data bytes

If you configure the gateway to swap the data bytes, the transmit driver swaps
each byte in the words received before transmitting them. Take care if an odd
number of bytes are sent by the end device when using the swap option. The last
byte of the message may be lost.

User Manual
8.1.3 ASCII Internal Database

 Lower memory for the user data area: Module memory 0 to 3999. This is
where incoming data from external devices is stored and accessed.
Data can be written to and read from the user data area.
 To use the transmit function in the module, you define the starting location in
the user data area for the transmitted data.
 To use the receive function in the module, you define the starting location in
the user data area for the received data.

User Manual
module status data, see ASCII Diagnostics (page 147).
8.1.4 ASCII Modes of Operation

The PLX3x gateway can operate in several different modes with each port acting
independently. The configuration of each port’s driver determines its mode. The
following topics describe these modes and describe the flow of data between the
pieces of hardware (the ASCII device and the gateway). These topic describe the
three possible types of communication devices that can be attached to
application ports: receive-only, transmit-only, and transmit-receive mode. See
ASCII Configuration (page 142) for the specific configuration information for each
mode.
Receive-Only Mode
A port on the module configured to function in receive-only mode only receives
data from an ASCII device. In this mode, the gateway never transmits data back
to the ASCII device. Any data received from the ASCII device is passed from the
receiver driver (Rx Driver) to the gateway’s internal database (Rx Data). The
following illustration shows the flow of data on a port configured for receive-only
mode.

User Manual
Transmit-Only Mode
A port on the module configured to function in transmit-only mode only transmits
data from the gateway’s internal database (received from an external source or
mapped from upper memory) to an ASCII device. When the transmit driver (Tx
Driver) recognizes a new write block containing data in the module’s internal
database, it transmits this data out to the port. The sequence number in the block
is different than that of the previous block. This signals that the packet is fully
assembled and ready to send. The following illustration shows flow of data on a
port configured for transmit-only mode.
Transmit-Receive Mode
A port configured in transmit-receive mode can send and receive data from an
ASCII device (for example, a terminal). This mode functions in both the transmit
and receive modes. Data flow to and from an ASCII device is handled by the
module’s transmit and receive drivers.
 Data received from the ASCII device is stored in the module’s internal
database until ready to be sent to an external device.
 Data received by an external device is also stored in the module’s internal
database until ready to be transmitted to the ASCII device.
The following illustration shows the flow of data on a port configured for transmit-
receive mode.

User Manual
8.2 ASCII Configuration

The ASCII driver requires that a minimum amount of configuration data must be
transferred to the PLX3x gateway from the gateway's file system. Take care
when configuring the module parameters. If the module does not function as
expected, examine the configuration file using the Debugger Port on the module.
All configuration parameters for the driver are found under the [ASCII Port x]
section. The x in the section name will have a value of 0 to 3 corresponding to
the appropriate ASCII port. See Diagnostics and Troubleshooting (page 31).
After you set up the configuration file, download it to the module using ProSoft
8.2.1 ASCII Port [x]

Use the ASCII Port [x] section in ProSoft Configuration Builder to configure the
ASCII port parameters. The value of [x] depends on the number of ports on your
PLX3x gateway (1 to 4).
To configure the ASCII Port in PCB

the [+] next to ASCII Port [x].
2 Double-click the second ASCII PORT [x] to display the Edit - ASCII PORT [x]
dialog box.

Enabled Yes or No Specifies if the port on the module will be utilized.
 NO - the port will not be used.
 YES - the port will be used supporting the ASCII protocol.
RS Interface 0, 1, 2 Specifies the RS interface to be utilized when serial ports are used on the
serial expansion module (Ports 1 to 3).
0 = RS-232
1 = RS-485
2 = RS-422
Rx DB Start -1 or 0 to Specifies the starting location in the internal database where the received
3896 data will be stored. The buffer holds 130 words, however, the first three
words of the data area define the sequence number, last write byte count

User Manual
and the Rx message length. If the parameter is set to -1, the port will not
receive data. See Receive Data (page 137) for detailed information on Rx
data structure.
Tx DB Start -1 or 0 to Specifies the starting location in the internal database where the transmit
3896 data will be stored. The buffer holds 130 words, however, the first three
words of the data area define the sequence number, last write byte count
and the Rx message length. If the parameter is set to -1, the port will not
transmit data. See Transmit Data (page 138) for detailed information on Tx
data structure.
Baud Rate Specifies the bits per second rate to use on the port. Enter the baud rate
(bits per second or bps) as a value. You may omit any trailing zeros from
the entered value for the higher bps rates and the gateway firmware will
interpret the setting correctly. For example:
To select 19200 bps, you may enter 192 or 19200.
Valid Values Bits per Second (bps)
110 110 bps
150 150 bps
300 3000 bps
600 6000 bps
1200 1200 bps
2400 2400 bps
4800 4800 bps
96 or 9600 9600 bps
192 or 19200 19200 bps
384 or 38400 38400 bps
576 or 57600 57600 bps
115 or 115200 115200 bps
Parity None, Odd, Specifies the type of parity checking to use. Parity is a simple error
Even checking algorithm used in serial communication. All devices
communicating through this port must use the same parity setting.
Data Bits 5, 6, 7 or 8 Specifies the number of data bits for each word used by the protocol. All
devices communicating through this port must use the same number of
data bits.
Stop Bits 1 or 2 Specifies the number of stop bits. Stop bits signal the end of a character in
the data stream. For most applications, use one stop bit. For slower
devices that require more time to re-synchronize, use two stop bits. All
devices communicating through this port must use the same number of
stop bits.
RTS On 0 to 65535 Specifies the number of milliseconds to delay after Ready To Send (RTS)
milliseconds is asserted before data will be transmitted.
RTS Off 0 to 65535 Specifies the number of milliseconds to delay after the last byte of data is
milliseconds sent before the RTS modem signal will be set low.
Handshaking N, Y, D, X Specifies the handshaking used on the port.
 N - No hardware or software handshaking
 Y - RTS/CTS hardware handshaking
 D - DTR/DSR hardware handshaking
 X - XON/XOFF software handshaking.

User Manual
Rx 0 to 15 Specifies the receive termination characteristics for the port. This value is
Termination bit mapped as follows:
Type  Bit 0 - Termination character(s) used
 Bit1- Message timeout used
 Bit2 - Intercharacter delay timeout used
 Bit3 - Packet size limit used. If the parameter is set to zero, the port is
placed in stream mode.
Rx Term 0 to 12 Specifies the number of termination characters used to define the end of
Count received message if bit 0 of the Type parameter is set.
Rx Term ASCII This array of 12 characters specifies the termination characters at the end
Chars characters of each received message. Each character occupies one position in the
array. The number of characters to be used in the array is set in the Rx
Term Count parameter.
Rx Packet 0 to 200 Specifies the length of data required to be received on the port before
Length transferring the data to the processor if bit 3 is set in the RX Termination
Type parameter.
Rx Timeout 0 to 65535 Specifies the number of milliseconds to wait after the first character is
received on the port before automatically sending the data to the processor
if bit 1 is set in the RX Termination Type parameter.
Rx Delay 0 to 65535 Specifies the number of milliseconds to wait between each character
received on the port before sending the data to the processor if bit 2 is set
in the RX Termination Type parameter.
Swap Rx Yes or No Specifies if the data received by the module has the byte order of the data
Data Byte swapped.
 NO - no byte swapping occurs.
 YES - the odd byte is swapped with the even byte in each word of data
received.
Tx Timeout 0 to 65535 Specifies the timeout period to transmit a message out the port. A
message must be transmitted out the port within the specified timeout
period. Message transmission is aborted if the timeout is exceeded.
Tx Minimum 0 to 65535 Specifies the minimum number of milliseconds to delay before transmitting
Delay a message out the port. This pre-send delay is applied before the RTS on
time. This may be required when communicating with slow devices.
Swap Tx Yes or No Specifies if the data to be transmitted by the module has the byte order of
Data Bytes the data swapped.
 NO - no byte swapping occurs.
 YES - the odd byte is swapped with the even byte in each word of data
received.

User Manual
8.2.2 Configuring a Port for Receive-Only Mode

In order to set a port for Receive-Only mode, ensure that the Rx DB Start
parameter in the configuration file contains the starting location where the data
will be stored. The Tx DB Start parameter must contain a value of -1. This value
indicates that the port will not transmit any data.
8.2.3 Configuring a Port for Transmit-Only Mode

In order to set a port for Transmit-Only mode, ensure that the Tx DB Start
parameter in the configuration file contains the starting location where the data
will be stored. The Rx DB Start parameter must contain a value of -1. This value
indicates that the port will not receive any data.
8.2.4 Configuring a Port for Transmit-Receive Mode

In order to set a port to both receive data and transmit data to an ASCII device,
ensure that the Rx DB Start parameter and the Tx DB Start parameter both
contain values that specify data storage starting locations for received and
transmitted data. A value of -1 in either parameter disables the particular function
that the parameter serves.
8.2.5 Termination of Received Data

When the PLX3x gateway receives data on the application port, you must define
when this data will be transferred to the internal database in the module. You do
this by setting the termination type for the port. When the termination condition is
met, the gateway sends the data from the port’s receive buffer (data area of 255
bytes) to the internal database. You set the termination type in the bit mapped Rx
Termination Type field of the module object. The following illustration shows the
bit map used for this parameter.
Termination Type Field
Bit(s) 4 to 7 3 2 1 0
Bit Value - 8 4 2 1
Definition Reserved Packet size Intercharacter Message Termination
limit used delay timeout timeout used character(s)
used used
If none of the bits are set (Type=0), the port is configured for stream mode. Any
characters received on the port are immediately sent to the processor. The
processor must buffer and assemble a packet of information if this mode is
selected as required by the application. If the data can be handled by the
processor in this mode and it is appropriate for your application, this is the fastest
method of communication between the device and the processor.

User Manual
Any combination of bits is acceptable to the module and should be set to match
the device on the specific port. An example of each termination type appears
below.
Termination character(s) used

Settings:
Count = 1 (RTermCnt=1)
Termination on 0x0d (carriage return character) (RTermChar = 0d 00 00 00 …)
Data Received on port:
A B C 0x0d D E
Comment:
The characters "ABC" will be sent along with the 0x0d character to the controller after the
0x0d character is received. The characters "DE" will not be sent until the 0x0d character is
received.
Message timeout used

Settings:
Message timeout = 1000 mSec (Rtimeout=1000)

TIME
0 1000 mSec 2000 mSec
A B C D E F G
Comment:
After the 'A' character is received on the port, the message timeout is started.
The characters "ABCDE" will be sent to the controller in one block. The characters
"FG" will follow in the second block one second later.
Intercharacter delay timeout used

Settings:
Intercharacter delay timeout = 300 mSec (Rdelay=300)

TIME
0 1000 mSec 2000 mSec
A B C D E F G H
>=300mSec time gap
Comment:
After each character is received, the intercharacter delay timer is reset. The characters
"ABCDEF" will be sent to the controller in one block because the delay timer expires.
The characters "GH" will follow in the second block when the next time gap is recognized.

User Manual
Packet size limit used

Settings:
Packet size = 4 (RPacketLen=4)
A B C D E F G H I J
Comment:
The first block sent to the controller will contain the characters "ABCD", and the second
block will contain the characters "EFGH". The characters "IJ" will not be sent until two
more characters are received on the port.
8.3 ASCII Diagnostics
8.3.1 ASCII PCB Diagnostics

The best way to troubleshoot the ASCIII driver is to use ProSoft Configuration
ASCII driver.

ASCII Port [x] Config Configuration settings for the ASCII port.
Comm Status Status of the ASCII communications. Displays any
configuration errors, as well as the communication
statistics.

User Manual
8.3.2 ASCII Status Data in Upper Memory

Each ASCII port associated with the ASCII driver has an associated status data
area. This data is in the upper memory of the module, and cannot be accessed
directly. You must use the Data Map function in the module to map this data into
the lower memory (user data area) of the module’s database. See Mapping Data
in Module Memory (page 24).
The following tables lists the content of the status data areas associated with
each ASCII port driver.
ASCII Port Driver Status
Port 0 Status Data

Status Register Description
13000 Receive State:
-1 = Listening for data
1 = Receiving Port Data
2 = Waiting for Backplane transfer
13001 Receive character count
13002 Receive message count
13003 Transmit State:
0 = Waiting for Data to Send
1 = RTS On
2 = RTS Timeout
3 = Sending data
4 = Waiting for RTS Off
5 = RTS turned off
30 = Intercharacter Delay
100 = Message Delay before Transmit
13004 Transmit character count
13005 Transmit message count
13006 Configuration error word
13007 to 13009 No Valid Data

User Manual
Port 1 Status Data

1 = RTS On
2 = RTS Timeout
3 = Sending data
5 = RTS turned off

User Manual
Port 2 Status Data

1 = RTS On
2 = RTS Timeout
3 = Sending data
5 = RTS turned off

User Manual
Port 3 Status Data

1 = RTS On
2 = RTS Timeout
3 = Sending data
5 = RTS turned off

User Manual
ASCII Error Codes

If the module is configured correctly, the configuration error word should have a
value of zero. Any other value indicates a configuration error. Use the value in
the configuration error word to determine which set of parameters are invalid in
the driver configuration area. The following table lists the bits associated with
each configuration error in the error word:
Bit Code Description
0 0x0001 Invalid selection for enabled parameter
1 0x0002 Invalid Rx DB Start parameter
2 0x0004 Invalid Tx DB Start parameter
3 0x0008 Invalid Baud Rate
4 0x0010 Invalid Parity (N, O, E, M or S)
5 0x0020 Invalid Data bits (5 to 8)
6 0x0040 Invalid Stop bits (1 or 2)
7 0x0080 Invalid Handshaking parameter (N, Y, D or X)
8 0x0100 Invalid Rx Termination Type
9 0x0200 Invalid Rx Term Count value
10 0x0400 Invalid Rx Timeout
11 0x0800 Invalid Rx Delay
12 0x1000 Invalid Rx Packet Length
13 0x2000 Invalid Tx Timeout
14 0x4000 Invalid RS interface selected (0 to 2)
15 0x8000

PLX3x Series ♦ Multi-Protocol Gateways SIE Protocol
User Manual
9 SIE Protocol
In This Chapter
 SIE Functional Overview ..................................................................... 153
 SIE Configuration ................................................................................ 157
 SIE Diagnostics ................................................................................... 170
 SIE Reference ..................................................................................... 174
9.1 SIE Functional Overview

You can use the PLX3x Siemens Industrial Ethernet (SIE) protocol to easily
interface with multiple Siemens Industrial Ethernet server-compatible instruments
and devices. The SIE protocol improves performance when controlling multiple
servers on a Siemens Industrial Ethernet network by supporting up to 20 clients.
The gateway's clients interface with processors (and other server-based devices)
on the SIE network using a user-constructed command list of up to 16 entries per
client. The gateway's internal database is the source for write commands to the
remote processors. The gateway stores data collected from the processors using
read commands in the gateway's database. The following illustration shows the
functionality of the SIE protocol.

SIE Protocol PLX3x Series ♦ Multi-Protocol Gateways
User Manual
9.1.1 SIE General Specifications
10/100 MB Ethernet Communication  Actively reads data from and writes data to Siemens
port Industrial Ethernet devices, using Siemens Industrial
Ethernet protocol
 Siemens Industrial Ethernet data types overlap in the
gateway's memory database, so the same data can be
conveniently read or written as bit-level or register-level
data
 Offers 20 client connections with up to 16 commands
each to multiple servers
 Configurable floating-point data movement
 Status and error information is generated by the
gateway
Supported PLC Data Exchange Siemens S7-200, Siemens S7-300, Siemens S7-400,
(Read and Write) Siemens S7-1200, Siemens S7-1500
Supported Register Types DB, Inputs, Outputs, Flags, Counters, Timers
9.1.2 SIE Gateway Internal Database


User Manual
user data area.
the user data area.
module status data, see SIE Diagnostics (page 170).

User Manual
SIE Client Access to Database

The client functionality exchanges data between the PLX3x gateway's internal
database and data tables established in one or more processors or other server
based devices. The command list that you define in ProSoft Configuration Builder
specifies what data is to be transferred between the gateway and each of the
servers on the network. No ladder logic is required in the processor (server) for
client functionality, except to assure that sufficient data memory exists.
The following illustration describes the flow of data between the clients and the
internal database.

User Manual
9.2 SIE Configuration
9.2.1 Configuring SIE Client [x] Connection

Use the SIE Client [x] section in ProSoft Configuration Builder to configure the
SIE Client [x] parameters. The value of [x] depends on the number of ports on
your PLX3x gateway (1 to 4).
To configure the ASCII Port in PCB

the [+] next to SIE Client [x].
2 Double-click the second SIE Client [x] to display the Edit - SIE Client [x]
dialog box.
The following table defines the configuration parameters for the SIE client
(master):
Minimum Command 0 to 65535 Specifies the number of milliseconds to wait between the initial
Delay issuances of a command. This parameter can be used to delay all
commands sent to servers to avoid "flooding" commands on the
network. This parameter does not affect retries of a command as
they will be issued when failure is recognized.
Response Timeout 0 to 65535 Specifies the time in milliseconds that a Client will wait before re-
transmitting a command if no response is received from the
addressed server. The value to use depends on the type of
communication network used, and the expected response time of
the slowest device on the network.
Retry Count 0 to 65535 Specifies the number of times a command will be retried if it fails.
Command Error 0 to 300 Number of intervals to wait after command error (in seconds).
Delay

User Manual
9.2.2 Configuring SIE Client x Commands

The SIE Client x Commands section In ProSoft Configuration Builder sets the
Siemens Industrial Ethernet Client Command list. This command list polls
Siemens Industrial Ethernet server devices attached to the Siemens Industrial
Ethernet client port. The PLX3x gateway supports many commands so that the
gateway can communicate with a wide variety of Siemens Industrial Ethernet
protocol devices.
The function codes for each command are those specified in the Siemens
Industrial protocol. Each command list record has the same format.
 The first part of the record contains the information relating to the gateway.
 The second part contains information required to interface to the Siemens
Industrial Ethernet server device.
Command List Overview

You must construct a command list to interface the gateway with Siemens
Industrial Ethernet server devices. The commands in the list specify the server
device to be addressed, the function to be performed (read or write), the data
area in the device to interface with, and the registers in the internal database to
be associated with the device data. Each client command list supports up to 16
commands.
The gateway processes the command list from top (command #1) to bottom. The
Poll Interval parameter specifies a minimum delay time in tenths of a second
between issuing commands.
To add SIE Client [x] commands

the [+] next to SIE Client [x].
2 Double-click SIE Client [x] Commands to display the Edit - SIE Client [x]
Commands dialog box.
3 Click ADD ROW to add a new command.
you configure the command.

User Manual

Enable Disabled Specifies if the command is to be executed and under what
Enabled conditions.
Conditional Write DISABLED (0) - The command is not executed in the normal
polling sequence.
ENABLED (1) - The command is executed upon each scan
of the Command List if you set the Poll Interval to zero (0).
If you set the Poll Interval to a non-zero value, the
command is executed when the interval timer for that
command expires.
CONDITIONAL WRITE (2) - The command execute only if the
internal data associated with the command changes.
Internal 0 to 3999 (for register-level Specifies the database address in the gateway's internal
Address addressing) database to use as the destination for data from a read
or command, or as the source for data for a write command.
0 to 63999(for bit-level The gateway interprets the database address as a bit
addressing) address or a 16-bit register (word) address, depending on
the Siemens Industrial Ethernet’s Data Type used in the
command.
 If you use Data Type = Bool in the command list, then
the database address is interpreted as a bit address.
 If you use Data Type = Byte in the command list, then
the database address is interpreted as a byte address.
 For any other data types, the database address is
interpreted as a 16-bit word (register) address.
Poll Interval 0 to 65535 Specifies the minimum interval between executions of
continuous commands. The value is in tenths of a second.
Therefore, if a value of 100 is entered, the command will
execute no more frequently than once every 10 seconds.
Reg Count Command-dependent Specifies the number of 16-bit registers or binary bits
transferred by the command. The range depends on the
Siemens processor and the type of command. See SIE
Maximum Register Counts (page 174).
Swap Code No Change Specifies if and how the gateway rearranges the order of
Word Swap bytes in data received or sent. This option exists to allow
Word and Byte Swap for the fact that different manufacturers store and transmit
multi-byte data in different combinations. This parameter is
Byte Swap helpful when dealing with floating-point or other multi-byte
values, as there is no one standard method of storing these
data types. You can set the parameter to rearrange the
byte order of data received or sent into an order more
useful or convenient for other applications.
NO CHANGE (0) - No change is made in the byte ordering
(1234 = 1234)
WORD SWAP (1) -The words are swapped (1234=3412)
WORD AND BYTE SWAP (2) - The words are swapped, then
the bytes in each word are swapped (1234=4321)
BYTE SWAP (3) - The bytes in each word are swapped
(1234=2143)
These swap operations affect 4-byte (or 2-word) groups of
data. Therefore, use data swapping only when using an
even number of words, such as 32-bit integer or floating-
point data.

User Manual
Node IP xxx.xxx.xxx.xxx Specifies the IP address of the Siemens processor being

Address addressed by the command.
PLC Type Manual TSAP, Specifies the type of Siemens processor being addressed
S7-300/S7-400/S7-1200 by the command.
Rack 0 to 999 Specifies the rack number of the S7-300, S7-400 or S7-
1200 CPU.
Note: Rack number is not used for the S7-200 CPU.
Slot 0 to 12 Specifies the slot number of the S7-300, S7-400 or S7-
1200 CPU.
Note: Slot number is not used for the S7-200 CPU.
TSAP Specifies the TSAP of the S7-200 CPU. This can be found
in the Siemens STEP 7 MicroWIN software.
Note: TSAP is only needed for controllers that specifically
need custom TSAP settings.
Func Type Read Specifies the type of command: Read or Write.
Write
Data Type BOOL Specifies the data type for the command.
BYTE
DINT
REAL
INT
TIME
COUNT
Address INPUT Specifies the address type for the command. DB is Data
Type OUTPUT Block.
FLAG
TIMER
COUNTER
DB
DB Number 0 to 32767 Specifies the Data Block number for the command.
Note: DB Number is only used when the Address Type =
DB.
Address Specifies the address of the data in the Siemens device.
 For Read or Write operations using the INT, DINT,
REAL or BYTE Data Types, the address is a byte
address.
 For Read or Write operations using the BOOL Data
Type, the address is a bit address. See Notes on
Addressing in S7 Processors (page 167).

User Manual
SIE Commands Supported by Siemens Devices

The format of each command in the list depends on the Siemens Industrial
Ethernet Function Code being executed. The type of supported functions also
depends on the server device.
SIE S3-700 Supported Commands
Address Type: Data Block

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
READ TIME
Write TIME
READ COUNT
Write COUNT
Address Type: Timer

Function Data Type
READ TIME
Address Type: Counter

Function Data Type
READ COUNT

User Manual
Address Type: Flag

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
READ TIME
Write TIME
READ COUNT
Write COUNT
Address Type: Output

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
READ TIME
Write TIME
READ COUNT
Write COUNT

User Manual
Address Type: Input

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
READ TIME
Write TIME
READ COUNT
Write COUNT

User Manual

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
Address Type: Flag

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT

User Manual
Address Type: Input

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
READ TIME
Write TIME
READ COUNT
Write COUNT

User Manual
Address Type: Flag

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
READ TIME
Write TIME
READ COUNT
Write COUNT

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
READ TIME
Write TIME
READ COUNT
Write COUNT

User Manual
Address Type: Input

Function Data Type
READ BOOL
Write BOOL
READ BYTE
Write BYTE
READ DINT
Write DINT
READ REAL
Write REAL
READ INT
Write INT
READ TIME
Write TIME
READ COUNT
Write COUNT
Notes on Addressing in S7 Processors

This topic applies to the S7-300 and the S7-1200 processors.
The gray area represents the byte memory locations being overlapped when the
word address is used consecutively (DB1.DBW0, DB1.DBW1, DB1.DBW2, etc.).

User Manual
If DB1-DBW0 is used as the first address in the Siemens processor, the next
word address that can be used without overwriting the data is DB1.DBW2.
The gray area above represents the byte memory locations being overlapped
when the double word address is used consecutively (DB1.DBD0, DB1.DBD1,
DB1.DBD2, etc.).
If DBD1.DBD0 is used as the first address in the Siemens processor, the next
double word address that can be used without overwriting the data would be
DB1.DBD4.
All of the above share the same memory locations in the processor.
Note: Incorrect memory location addressing can cause the data to be overwritten.
The following image represents the addressing of the processor's memory.

User Manual
Example:
Sending an integer value of 11733 from gateway register 1000 to a Siemens S7-
300 processor demonstrates the addressing scheme in the Siemens S7-300
processor. The following image from ProSoft Configuration Builder shows a client
command sent from the gateway to INT data to DB1 address 0.
Row 1 in the SIMATICS Manager screen (below) shows the data transferred
from the gateway
If the data is broken up and displayed in binary format, you can see that the
binary data stored in the first byte of DB1.DBW0 is identical to that stored in byte
address DB1.DBB 0. This is because the memory locations referenced by the
first byte of DB1.DBW 0 and by DB1.DBB0 are one and the same, as explained
above.
The first byte of DB1.DBW0 is the same as DB1.DBB0.

User Manual
The second byte of DB1.DBW0 is the same as DB1.DBB1, and is the same as
the first byte of DB1.DBW1. In reality, the memory space looks like the following:
To access the first address of Data Block, Flag, Input, Output, Timer, and
Counter memory locations in the S7-300 and S7-1200 processors, use the
following address syntax:
 Data Block: DB1.DBB0, DB1.DBW0, DB1.DBD0
 Flag: MB0, MW0, MD0
 Input: IB0, IW0, ID0
 Output: QB0, QW0, QD0
 Timers: T0 - T65535
 Counters: C0 - C65535
To access the first address of Data Block, Flag, Input, and Output memory
locations in the S7-200 processor, use the following address syntax:
 Data Block: VB0, VW0, VD0
 Flag: MB0, MW0, MD0
 Input: IB0, IW0, ID0
 Output: QB0, QW0,QD0
9.3 SIE Diagnostics
9.3.1 SIE PCB Diagnostics

The best way to troubleshoot the SIE client driver is to use ProSoft Configuration
SIE driver for each client.

SIE Client [x] Config Configuration settings for SIE client [x].
Status Communication status for the SIE client [x]
Command List Command list for the SIE client [x]
Command Status Status of the commands in the SIE client [x] command
list

User Manual
9.3.2 SIE Status Data in Upper Memory

Each SIE client has an associated status data area located in the gateway's
upper memory. You can use data mapping in the gateway to map this data into
the normal user data range of the gateway's database. See Mapping Data in
Module Memory (page 24).
The following table lists the starting addresses in the upper memory where the
gateway stores the status data for each client:
Client Gateway Starting Register for Status Data
0 21100
1 21126
2 21152
… …
… …
18 21568
19 21594
The following table describes the content of each client's status data area:
0 Command Request Count
1 Command Response Count
2 Command Error Count
3 Number of Request Packets
4 Number of Response Packets
5 Errors Sent
6 Errors Received
7 Configuration Error Word
8 Current Error
9 Last Error
10 to 25 Command List Errors (16 per Client)
For every command that generates an error, the gateway automatically sets the
poll delay parameter for that command to 30 seconds. This instructs the gateway
to wait 30 seconds before it attempts to issue the command again.
As the gateway polls and executes the commands in the Client Command List,
the gateway maintains an error code for each command. The gateway stores the
current error value for each command in the Command List Errors section of
each client's status data area. There is one register for each of the 16 commands
in the command list. An error code of 0 means no error is currently detected for
the specified command.

User Manual
9.3.3 SIE Error Codes
SIE Module Communication Error Codes

Decimal Hex Description
1 0x0001 No data from I/O module
3 0x0003 The desired item is not available in the PLC (200 family)
5 0x0005 The desired address is beyond limit for this PLC
6 0x0006 The CPU does not support reading a bit block of length<>1
7 0x0007 Write data size error
10 0x000a The desired item is not available in the PLC
-123 0xff85 Cannot evaluate the received PDU
-124 0xff84 The PLC returned a packet with no result data
-125 0xff83 The PLC returned an error code not understood by this library
-126 0xff82 This result contains no data
-127 0xff81 Cannot work with an undefined result set
-128 0xff80 Unexpected function code in answer
-129 0xff7f PLC responds with an unknown data type
-1024 0xfc00 Short packet from PLC
-1025 0xfbff Timeout when waiting for PLC response
-32767 0x8001 Not allowed in current operating status
-32511 0x8101 Hardware fault
-32509 0x8103 Object access not allowed
-32508 0x8104 Context is not supported. Step7 says: Function not implemented or error in
telegram
-32507 0x8105 Invalid address
-32506 0x8106 Data type not supported
-32505 0x8107 Data type not consistent
-32502 0x810A Object does not exist
-31999 0x8301 Insufficient CPU memory
-31742 0x8402 CPU already in RUN or already in STOP
-31740 0x8404 Severe error
-31488 0x8500 Incorrect PDU size
-30974 0x8702 Address invalid
-12286 0xd002 Step7: Variant of command is illegal
-12284 0xd004 Step7: Status for this command is illegal
-12127 0xd0A1 Step7: Function is not allowed in the current protection level
-11775 0xd201 Block name syntax error
-11774 0xd202 Syntax error function parameter
-11773 0xd203 Syntax error block type
-11772 0xd204 No linked block in storage medium
-11771 0xd205 Object already exists

User Manual

-11770 0xd206 Object already exists
-11769 0xd207 Block exists in EPROM
-11767 0xd209 Block does not exist/could not be found
-11762 0xd20e No block present
-11760 0xd210 Block number too big
-11712 0xd240 Coordination rules were violated
-11711 0xd241 Operation not permitted in current protection level
-11710 0xd242 Protection violation while processing F-blocks. F-blocks can only be
processed after password input
-11263 0xd401 Invalid SZL ID
-11262 0xd402 Invalid SZL index
-11258 0xd406 Diagnosis: Info not available
-11255 0xd409 Diagnosis: DB error
SIE Error Codes

-33 0xffdf Failed to connect to server specified in command
-34 0xffde Failed to create a socket
-36 0xffdc SIE command response timeoout (same as -11)
-37 0xffdb TCP/IP connection ended before session finished
SIE Error Codes

-40 0xffd8 Too few parameters
-41 0xffd7 Invalid enable code
-42 0xffd6 Internal address > maximum address
-44 0xffd4 Count parameter set to 0
-45 0xffd3 Invalid function code
-46 0xffd2 Invalid swap code
-47 0xffd1 Invalid TSAP code

User Manual
9.4 SIE Reference
9.4.1 SIE CPU315-2 DP

Function Data Type Max Reg Count
READ BOOL 1
Write BOOL 1
READ BYTE 164
Write BYTE 164
READ DINT 41
Write DINT 41
READ REAL 41
Write REAL 41
READ INT 82
Write INT 82
READ TIME 82
Write TIME 41
READ COUNT 82
Write COUNT 82
Address Type: Timer

READ TIME 1
Address Type: Counter

READ COUNT 111
Address Type: Flag

READ BOOL 1
Write BOOL 1
READ BYTE 222
Write BYTE 212
READ DINT 55
Write DINT 53
READ REAL 55
Write REAL 53
READ INT 111

User Manual
Write INT 106

READ TIME 111
Write TIME 53
READ COUNT 111
Write COUNT 106

READ BOOL 1
Write BOOL 1
READ BYTE 128
Write BYTE 128
READ DINT 32
Write DINT 32
READ REAL 32
Write REAL 32
READ INT 64
Write INT 64
READ TIME 64
Write TIME 32
READ COUNT 64
Write COUNT 64
Address Type: Input

READ BOOL 1
Write BOOL 1
READ BYTE 128
Write BYTE 128
READ DINT 32
Write DINT 32
READ REAL 32
Write REAL 32
READ INT 64
Write INT 64
READ TIME 64
Write TIME 32
READ COUNT 64
Write COUNT 64

User Manual
9.4.2 SIE CPU1212C

Function Data Type Max Read Max Write
READ BOOL 1
Write BOOL 1
READ BYTE 30
Write BYTE 30
READ DINT 7
Write DINT 7
READ REAL 7
Write REAL 7
READ INT 15
Write INT 15
READ TIME 15
Write TIME 15
READ COUNT 15
Write COUNT 15
Address Type: Flag

READ BOOL 1
Write BOOL 1
READ BYTE 212
Write BYTE 212
READ DINT 53
Write DINT 53
READ REAL 53
Write REAL 53
READ INT 106
Write INT 106
READ TIME 105
Write TIME 105
READ COUNT 106
Write COUNT 106

User Manual

Function Data Type Max Reg Cnt Max Reg Cnt
READ BOOL 1
Write BOOL 1
READ BYTE 212
Write BYTE 212
READ DINT 53
Write DINT 53
READ REAL 53
Write REAL 53
READ INT 106
Write INT 106
READ TIME 105
Write TIME 105
READ COUNT 111
Write COUNT 106
Address Type: Input

READ BOOL 1
Write BOOL 1
READ BYTE 222
Write BYTE 212
READ DINT 55
Write DINT 53
READ REAL 55
Write REAL 53
READ INT 111
Write INT 111
READ TIME 111
Write TIME 106
READ COUNT 111
Write COUNT 106

User Manual
9.4.3 SIE CPU224XP

Function Data Type Max Read Max Write
READ BOOL 1
Write BOOL 1
READ BYTE 222
Write BYTE 212
READ DINT 55
Write DINT 53
READ REAL 55
Write REAL 53
READ INT 111
Write INT 106
Address Type: Flag

READ BOOL 1
Write BOOL 1
READ BYTE 32
Write BYTE 32
READ DINT 8
Write DINT 8
READ REAL 8
Write REAL 8
READ INT 16
Write INT 16

READ BOOL 1
Write BOOL 1
READ BYTE 16
Write BYTE 16
READ DINT 4
Write DINT 4
READ REAL 4
Write REAL 4
READ INT 8
Write INT 8

User Manual
Address Type: Input

Function Data Type Max. Reg Count
READ BOOL 1
Write BOOL 1
READ BYTE 16
Write BYTE 16
READ DINT 4
Write DINT 4
READ REAL 4
Write REAL 4
READ INT 8
Write INT 8

User Manual

PLX3x Series ♦ Multi-Protocol Gateways PND Protocol
User Manual
10 PND Protocol
In This Chapter
 PND Functional Overview ................................................................... 181
 PND Configuration .............................................................................. 183
 Step 7 Configuration ............................................................................ 188
 PND Diagnostics ................................................................................. 205
 PND Performance ............................................................................... 207
10.1 PND Functional Overview

PROFINET is the communication standard for automation of PROFIBUS and
PROFINET Intenational (PI). Many years of experience with PROFIBUS and the
widespread use of Industrial Ethernet are all rolled into PROFINET.
With its integrated, Ethernet-based communication, PROFINET satisfies a wide
range of requirements, from data intensive parameter assignments to extremely
fast I/O data transmission which enables automation in real-time.
10.1.1 PND General Specifications
Driver Type Class A Device

PROFINET I/O Data 1440 bytes IN, 1440 bytes OUT
Exchange Types Cyclic Real-time (RT) and Acyclic Data

PND Protocol PLX3x Series ♦ Multi-Protocol Gateways
User Manual
10.1.2 PND Internal Database

In addition to data from the Controller, you can map status and error information
generated by the gateway into the user data area of the internal database. The
internal database is divided into two areas:
user data area. The gateway functions as a PROFINET Device, and an external
PROFINET Controller can read data from, or write data to, the gateway user data
area.

User Manual
module status data, see PND Diagnostics (page 205).
10.2 PND Configuration

The following procedure shows how to configure a PLX3x gatewayGateway with
the PND protocol using ProSoft Configuration Builder (PCB). This configuration
provides the ability to communicate with a Siemens processor via the PROFINET
protocol. This example uses a PLX31-EIP-PND gateway.
1 Launch ProSoft Configuration Builder.
2 Create a new PLX31-EIP-PND module.
3 Click OK.

User Manual
4 Expand PLX31-EIP-PND module and double-click PND MODULE MAP.
5 In the Edit - PND MODULE MAP dialog, click ADD ROW and double-click on
the row that appears.

User Manual
6 In the Module in Slot field, select the number of input or output bytes to be
used for each slot. This example uses 32-bytes input and 32-bytes output.
Note: The PND module map is very important because the values enter here must match the
values that are entered in the Siemens processor in order for them to communicate correctly.
7 Click OK. You can now download the configuration to the module.

User Manual
10.2.1 Configuring PIE Connection

Use the PND section in ProSoft Configuration Builder to configure the PND
communication parameters so that the gateway can communicate with a
Siemens processor via the PROFINET protocol.
To configure the PND communications in PCB

the [+] next to PND.
2 Double-click the second PND to display the Edit - PND dialog box.
In the dialog box, click a parameter and then enter a value for the parameter.The
following table defines the configuration parameters for the PND
communications.
Note: The gateway can store up to 720 registers (1440 bytes) of input data, and up to 720
registers of output data. Make sure that the input and output data regions do not overlap.

Start Input Byte Offset 0 to 8000 Byte offset for input data in the gateway's lower memory
Start Output Byte Offset 0 to 8000 Byte offset for output data in the gateway's lower memory
Swap Read Input Data No Change Specifies if and how the order of bytes in data received is to
Bytes Word Swap be rearranged. Different manufacturers store and transmit
Word and multi-byte data in different combinations. You can use this
Byte Swap parameter when dealing with floating-point or other multi-
byte values, as there is no standard method of storing
Byte Swap these data types. You can set this parameter to rearrange
the byte order of data received into an order more useful or
NO CHANGE (0) - No change is made in the byte ordering
(1234 = 1234).
WORD AND BYTE SWAP (2) - The words are swapped, then
the bytes in each word are swapped (1234=4321).
(1234=2143).
These swap operations affect 4-byte (2-word) groups of
data. Therefore, data swapping using Swap Codes should
be done only when using an even number of words, such
as 32-bit integer or floating-point data.

User Manual

Swap Read Output Data No Change Specifies if and how the order of bytes in data sent is to be
Bytes Word Swap rearranged. This parameter is otherwise the same as Swap
Word and Read Input Data Bytes.
Byte Swap
Byte Swap
Comm Failure Mode No YES - Reset output database values to 0 if communications
Yes fail.
NO - Retain output database value if communications fail.
10.2.2 Configuring PND Module Map

Use the PND Module Map section in ProSoft Configuration Builder to configure
the PND Module Map parameters.
To configure the PND Module Map in PCB

the [+] next to PND.
2 Double-click PND MODULE MAP to display the Edit - PND MODULE MAP
dialog box.
3 Click ADD ROW to add a new module mapping.
you configure module mapping.

Module in Slot Input or Output Specifies the module type (Input/Output) assigned to a specific
4, 8, 16, 32, 64, 128, slot.
256, 512, or 1024
bytes
Swap Code No Change Specifies if and how the order of bytes in data received and
Word Swap sent is to be rearranged. Different manufacturers store and
Word and Byte transmit multi-byte data in different combinations. You can use
Swap this parameter when dealing with floating-point or other multi-
byte values, as there is no standard method of storing these
Byte Swap data types. You can set this parameter to rearrange the byte
order of data received or sent into an order more useful or

User Manual

NO CHANGE (0) - No change is made in the byte ordering (1234
= 1234).
WORD AND BYTE SWAP (2) - The words are swapped, then the
bytes in each word are swapped (1234=4321).
(1234=2143).
These swap operations affect 4-byte (2-word) groups of data.
Therefore, data swapping using Swap Codes should be done
only when using an even number of words, such as 32-bit
integer or floating-point data.
Comment Optional 32 character comment for the module.
10.3 Step 7 Configuration

This procedure describes the steps to set up the PLX3x gateway with Siemens
Step 7. It is important to note that the gateway parameters you configure and
download to the gateway from ProSoft Configuration Builder must match the
parameters you configure in this procedure.
1 Start Step 7 software.
2 Create a new project. For example, Profinet_Sample.

User Manual
3 Add a station to the project in which the network will be configured.
4 Click SIMATIC 300 STATION.

5 Double-click the hardware icon for SIMATIC 300 to configure the station.
This opens the HW Config page.

User Manual
10.3.1 Installing a GSD File
1 On the menu bar, click OPTIONS and then click INSTALL GSD FILE.
This opens the Install GSD File dialog box.

User Manual
2 Click BROWSE and browse to the location of the GSD file stored on your PC.
3 Select the file and click INSTALL. The system informs you when the install is
complete.
4 Click OK.

User Manual
10.3.2 Configuring the PLX3x Gateway in Step 7
1 From the HW Config page, select a Rack and a Power Supply.
2 Drag and drop the processor that will be used in the network. In this example,
we use 315-2 PN/DP.

User Manual
3 Right-click the PN-IO option and then click INSERT PROFINET IO SYSTEM.
4 Insert the ProfiNet bus network where the ProSoft gateway is located by
clicking the PN-IO option and the clicking NEW to open Properties - Ethernet
Interface dialog box.

User Manual
5 Click NEW to open the Properties - New subnet Industrial Ethernet dialog box.
6 Click OK on the following prompt.

User Manual
7 Add the PLX3x gateway to the network.
8 Configure the interface port for the ProSoft gateway as shown.

User Manual
9 Configure the inputs and outputs to match the PCB configuration. In this
example, 32 inputs and 32 outputs were configured in the module.

User Manual
10 Verify the name and IP address as shown.
11 If the module is correctly configured, the following appears. If the status is not
a green checkmark, you must assign the gateway name and IP by selecting
the gateway and then clicking ASSIGN NAME.

User Manual
The following image shows an example:

User Manual
12 Save and download the program.

User Manual
Once you download the program, the RUN LED and the DC5V on the processor
should be green. There should be no red LEDs.

User Manual
10.3.3 Monitoring Data Values

1 To monitor the values coming out of the processor, click the Input and then
click MONITOR/MODIFY.

User Manual
The values coming into the processor are displayed at the input section.
2 To modify the values that the processor sends to the module, choose the
output, select the desired value, and click MODIFY VALUE.

User Manual
10.3.4 Creating a Variable Table to Display Floating Point Input

Values
1 On the menu bar, click INSERT NEW OBJECT and then click VARIABLE TABLE.
2 Enter a name for the table.

User Manual
3 Double-click the table.
4 Monitor the value.

User Manual
10.4 PND Diagnostics
10.4.1 PND PCB Diagnostics

The best way to troubleshoot the SIE client driver is to use ProSoft Configuration
PND driver:
PROFINET Config Configuration settings for PROFINET
Module Map Module Map settings for PROFINET
Status Communication status for PROFINET
10.4.2 PND Status Data in Upper Memory

The PND driver has an associated status data area located in the gateway’s
upper memory. You can use data mapping in the gateway to map this data into
the normal user data range of the gateway's database. See Mapping Data in
Module Memory (page 24).
The following table lists the locations in the gateway's upper memory area for the
general status and error data:
 PLX31-PND-MBS The gateway stores status data in the upper memory area starting at
 PLX31-PND-MBS4 address 6000
 PLX31-EIP-PND The gateway stores status data in the upper memory area starting at
 PLX32-EIP-PND address 13000.
 PLX31-MBTCP-PND
 PLX32-MBTCP-PND
The following table lists the specific status data:

Register Description
6000 / 13000 Total number of write messages to PLC
6001 / 13001 Total number of write message errors
6002 / 13002 Input Error message status. See below for error code descriptions.
6003 / 13003 Total number of read messages from PLC
6004 / 13004 Total number of read message errors
6005 / 13005 Output Error message status. See below for error code descriptions.
6006 / 13006 Connection Status
6007 / 13007 Driver Enabled? 1=Yes, 0=No

User Manual
10.4.3 Input/Output Error Message Status Codes

Input Error Message Status Description
0 No error
0x0604 Pointer to data memory is NULL
0x0503 Write buffer is already locked or unlocked
0x060A Data length to be written is invalid
Output Error Message Description

Status
0 No error
0x0001 No new data was copied into the buffer
0x0604 Pointer to data memory is NULL, or pointer to variable to receive
the APDU Data Status is NULL
0x060B IOCR ID is 0
0x0803 IOCR ID could not be found, or IOCR ID is invalid
0x060A Data length to be read is invalid
10.4.4 Configuration Error Codes

The ERR LED on the PLX3x gateway faceplate is lit when no connection from
the Controller is established.
Error Code Description
0 No error
1 Input Swap Error
2 Output Swap Error
18 Get Network Data Adapter
19 Get IP Address Error
20 Get NetMask Error
21 Get Gateway Error
22 Get MAC Address Error
23 PROFINET Mapping Error

User Manual
10.5 PND Performance

The following tables contain PND performance rates.
EIP Class 1 Number of EIP Class 1

Connections Connections
RPI (ms)
1 2 3 4 5 6 7 8
2 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes
256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes NA NA
496 Bytes 496 Bytes 496 Bytes NA NA NA NA NA
PROFINET PROFINET I/O Size (bytes)

Update Rate
(ms)
128 256 512 768 1024 1280 1400
2* YES NO NO NO NO NO NO
4* YES YES YES NO NO NO NO
8 YES YES YES YES YES YES YES
Example:
PLX3x gateway sending/receiving 128 bytes of EIP data on a single 4 ms Class
1 connection and PLX3x gateway sending/receiver 128 bytes of PROFINET data
with a 4 ms update rate.
The maximum cycle time is calculated as:
EIP = 4 ms/in + 4 ms/out = 8 ms
PND = 4 ms/in + 4 ms/out = 8 ms
PLX3x latency = 4 ms
Total: 20 ms
 To use a 2 to 4 ms update rate, you must use a different GSDML file. This
GSDML is available at www.prosoft-technology.com
 Under certain conditions (high network load, low update rate, etc.) the
PROFINET Controller may need to raise the watchdog time.

User Manual

PLX3x Series ♦ Multi-Protocol Gateways Support, Service & Warranty
User Manual
11 Support, Service & Warranty
In This Chapter
 Contacting Technical Support ............................................................. 209
 Warranty Information ........................................................................... 211
11.1 Contacting Technical Support

ProSoft Technology, Inc. is committed to providing the most efficient and
effective support possible. Before calling, please gather the following information
to assist in expediting this process:
1 Product Version Number
2 System architecture
3 Network details
If the issue is hardware related, we will also need information regarding:

1 Module configuration and associated ladder files, if any.
2 Module operation and any unusual behavior
3 Configuration/Debug status information
4 LED patterns
5 Details about the serial, Ethernet or Fieldbus devices interfaced to the
module, if any.
Note: For technical support calls within the United States, ProSoft’s 24/7 after-hours phone support
is available for urgent plant-down issues. Detailed contact information for all our worldwide
locations is available on the following page.

Support, Service & Warranty PLX3x Series ♦ Multi-Protocol Gateways
User Manual
Asia Pacific Europe / Middle East / Africa

Regional Office Regional Office
Phone: +603.7724.2080 Phone: +33.(0)5.34.36.87.20
[email protected] [email protected]
Languages spoken: Bahasa, Chinese, English, Languages spoken: French, English
Japanese, Korean REGIONAL TECH SUPPORT
REGIONAL TECH SUPPORT [email protected]
[email protected]
Middle East & Africa
North Asia (China, Hong Kong) Phone: +971.4.214.6911
Phone: +86.21.5187.7337 [email protected]
[email protected] Languages spoken: Hindi, English
Languages spoken: Chinese, English REGIONAL TECH SUPPORT
REGIONAL TECH SUPPORT [email protected]
[email protected]
North Western Europe (UK, IE, IS, DK, NO, SE)
Southwest Asia (India, Pakistan) Phone: +44.(0)7415.864.902
Phone: +91.98.1063.7873 [email protected]
[email protected] Language spoken: English
Languages spoken: English, Hindi, Urdu
Central & Eastern Europe, Finland
Australasia (Australia, New Zealand) Phone: +48.22.250.2546
Phone: +603.7724.2080 [email protected]
[email protected] Languages spoken: Polish, English, Russia & CIS
Language spoken: English Phone: +7.499.704.53.46
[email protected]
Southeast Asia (Singapore, Indonesia, Languages spoken: Russian, English
Philippines)
Phone: +603.7724.2080 Austria, Germany, Switzerland
[email protected] Phone: +33.(0)5.34.36.87.20
Languages spoken: English, Bahasa, Tamil [email protected]
Language spoken: English, German
Northeast & Southeast Asia
(Japan, Taiwan, Thailand, Vietnam, Malaysia) BeNeLux, France, North Africa
Phone: +603.7724.2080 Phone: +33(0)5.34.36.87.27
Languages spoken: English, Chinese, Japanese Languages spoken: French, English
Korea Mediterranean Countries

Phone: +603.7724.2080 Phone: +39.342.8651.595
Languages spoken: English, Korean Languages spoken: Italian, English, Spanish

User Manual
Latin America North America

Regional Office Regional Office
Phone: +52.222.264.1814 Phone: +1.661.716.5100
Languages spoken: Spanish, English Languages spoken: English, Spanish
REGIONAL TECH SUPPORT REGIONAL TECH SUPPORT
Brazil
Phone: +55.11.5084.5178
[email protected]
Languages spoken: Portuguese, English
REGIONAL TECH SUPPORT
[email protected]
Mexico
Phone: +52.222.264.1814
[email protected]
Languages spoken: Spanish, English
REGIONAL TECH SUPPORT
[email protected]
Andean Countries, Central America &

Caribbean
Phone: +507.6427.48.38
[email protected]
Southern Cone (Argentina, Bolivia, Chile,

Paraguay & Uruguay)
Phone: +54.911.4565.8119
[email protected]
11.2 Warranty Information

For complete details regarding ProSoft Technology’s TERMS & CONDITIONS
OF SALE, WARRANTY, SUPPORT, SERVICE AND RETURN MATERIAL
AUTHORIZATION INSTRUCTIONS, please see the documents at:
www.prosoft-technology/legal
Documentation is subject to change without notice.

User Manual

User Manual
Configuring Gateway Parameters • 23

Configuring MBS Port [x] • 120
Index Configuring MBTCP Client [x] • 104
Configuring MBTCP Client [x] Commands • 106
Configuring MBTCP Servers • 100, 101
A Configuring PIE Connection • 186
Configuring PND Module Map • 187
About the Modbus Protocol • 39, 107, 113, 126, 134 Configuring SIE Client [x] Connection • 157
Accessing the Gateway’s Internal Memory • 53 Configuring SIE Client x Commands • 158
Adding the Gateway to RSLogix5000 v.16 through Configuring the Ethernet Port • 18, 23
v.19 • 58 Configuring the Port for Receive-Only Mode • 145
Adding the Gateway to RSLogix5000 v.20 • 56 Connecting Power to the Unit • 13
Agency Approvals and Certifications • 3 Connecting the PC to the Gateway • 15, 27, 29
ASCII Configuration • 140, 142 Contacting Technical Support • 209
ASCII Data Flow • 136 Content Disclaimer • 2
ASCII Diagnostics • 140, 147 Control • 83
ASCII Error Codes • 152 ControlLogix and CompactLogix Processor Specifics •
ASCII Functional Overview • 135 84
ASCII Internal Database • 139 Creating a Variable Table to Display Floating Point
ASCII Modes of Operation • 140 Input Values • 190, 192, 201, 203
ASCII PCB Diagnostics • 147
ASCII Port [x] • 142 D
ASCII Port Driver Status • 148
ASCII Protocol • 135 DB9 to RJ45 Adaptor (Cable 14) • 45
ASCII Status Data in Upper Memory • 41, 148 Delay Preset • 26
Diagnostics and Troubleshooting • 31, 109, 128, 142,
B 147, 170, 205
Diagnostics Menu • 34, 36, 39
Basic Command Set Functions • 55 Disabling Gateway Ports • 20
BT • 83 Downloading the Project to the Gateway • 27
C E
Capturing a Diagnostic Session to a Log File • 37 EIP Client Access to Database • 52
CIP Data Table Operations • 89 EIP Client Command List Error Data • 71
CIP Data Table Read • 91 EIP Client Status Data • 71
CIP Data Table Write • 89 EIP Command Entry Form • 93
Class 3 Client/UClient [x] Commands SLC500 2 EIP Configuration • 53
Address Fields • 62 EIP Error Codes • 70, 73, 75
Class 3 Client[x]/UClient • 60 EIP Functional Overview • 43, 49
Class 3 Client[x]/UClient Commands • 61 EIP Internal Database • 51
Class 3 Client[x]/UClient Commands Basic • 69 EIP PCB Diagnostics • 70
Class 3 Client[x]/UClient Commands CIP Generic • 67 EIP Protocol • 49
Class 3 Client[x]/UClient Commands Controller Tag EIP Reference • 76
Access • 66 EIP Server Status Data • 72
Class 3 Client[x]/UClient Commands PLC5 ASCII • 65 EIP Status Data in Upper Memory • 41, 71
Class 3 Client[x]/UClient Commands PLC5 Binary • 64 Encapsulated PCCC Messages • 84
Class 3 Client[x]/UClient Commands SLC500 3 Encapsulated PCCC Read Message • 87
Address Fields • 63 Encapsulated PCCC Write Message • 84
Common Response Error Codes • 75 Ethernet Port LEDs • 33
Configuration Error Codes • 206 EtherNet/IP Explicit Messaging Server Command
Configuration Parameters Common to Master and Support • 55
Slave • 122 EtherNet/IP General Specifications • 50
Configuring a Port for Transmit-Only Mode • 145 EXT STS Error Codes • 74
Configuring a Port for Transmit-Receive Mode • 145
Configuring EIP Class 1 Connection • 56 F
Configuring EIP Class 1 Connections in PCB • 59
Configuring EIP Class 3 Client[x]/UClient Connection • Forward Open Response Error Codes • 76
60 From Address • 26
Configuring EIP Class 3 Server • 53

Support, Service & Warranty PLX3x Series ♦ Multi-Protocol Gateways
User Manual
G MBTCP Status Data in Upper Memory • 41, 109

Messaging from a ControlLogix or CompactLogix
Gateway Communication Error Codes • 134 Processor • 84
Gateway Status Data in Upper Memory • 40 Messaging from a PLC5 • 80
General Gateway Status Data in Upper Memory • 40 Messaging from a SLC 5/05 • 76
General Modbus Error and Status Data • 128, 129 MG • 84
General Specifications • 136 Modbus Master/Slave Port Specifications • 117
Modbus Message Routing
H Port 2001 • 101
Hardware Information • 43 Modbus Port Access to Database • 120
How to Contact Us • 2 Modbus Serial Specifications • 117
Modbus TCP/IP Client • 96
I Modbus TCP/IP Client Access to Database • 99
Modbus TCP/IP Server • 96
Important Installation Instructions • 3 Mounting the Gateway on a DIN-rail • 11
Input/Output Error Message Status Codes • 206 MSG Instruction Type - CIP • 54
Installing ProSoft Configuration Builder Software • 14 MSG Instruction Type - PCCC • 54
J Multiple Server Access to Database • 99
Multiple Server Access to EIP Database • 52
Jumper Settings • 12
N
L
Network Diagnostics • 52, 70, 98, 108
LED Indicators • 31 Notes on Addressing in S7 Processors • 160, 167
Local STS Error Codes • 73
O
M
Overview • 9
Main Gateway LEDs • 32
Mapping Data in Module Memory • 24, 40, 52, 98, 119, P
128, 131, 132, 140, 148, 155, 171, 183, 205 Package Contents - PLX3x • 10
Master Port PCCC Response Error Codes • 76
Command List Errors • 130, 131 PD • 83
Modbus Slave List Status • 132 Pinouts • 45
MBS Command List Error Codes • 134 PLC-5 Command Set Functions • 55
MBS Configuration • 120 PLC5 Processor Specifics • 80
MBS Diagnostics • 119, 128 PLC5 Read Commands • 81
MBS Error Codes • 133 PLC-5 Sub-Element Fields • 83
MBS Functional Overview • 116 PLC5 Write Commands • 80
MBS Internal Database • 116, 118 PND Configuration • 183
MBS Master Configuration Parameters • 123 PND Diagnostics • 183, 205
MBS PCB Diagnostics • 128 PND Functional Overview • 181
MBS Port [x] Commands • 123, 124 PND General Specifications • 181
MBS Protocol • 116 PND Internal Database • 182
MBS Reference • 134 PND PCB Diagnostics • 205
MBS Slave Configuration Parameters • 124 PND Performance • 207
MBS Status Data in Upper Memory • 41, 128 PND Protocol • 181
MBTCP Client Command List Error Data • 111 PND Status Data in Upper Memory • 41, 205
MBTCP Client Specific Errors • 112 Port 1 Command Error List Layout • 131
MBTCP Client Status Data • 110 Port 1 General Modbus Error and Status Layout • 129
MBTCP Command List Error Codes • 113 Port 1 Slave List Status Layout • 132
MBTCP Communication Error Codes • 112 Printing a Configuration File • 23
MBTCP Configuration • 101 Protocol-Specific Status Data in Upper Memory • 41
MBTCP Error Codes • 112
MBTCP Functional Overview • 95 R
MBTCP General Specifications • 96
MBTCP Internal Database • 95, 97 Receive Data • 137, 143
MBTCP PCB Diagnostics • 109 Receive-Only Mode • 140
MBTCP Protocol • 95 Register Count • 26
MBTCP Reference • 113 Register Session Response Error Codes • 75
MBTCP Server Status Data • 109 Remote STS Error Codes • 73

User Manual
Renaming PCB Objects • 23 U

RS-232 - DTE to DCE Modem Connection • 46
RS-232 - Null Modem (DTE without Hardware Uploading the Project from the Gateway • 29
Handshaking) • 46 Using Diagnostics in ProSoft Configuration Builder •
RS-422 Interface Connections • 47 33, 37, 38
RS-485 Interface Connection • 47 Using ProSoft Configuration Builder • 15
Using the Data Analyzer (Serial Protocols Only) • 38
S
W
SD Card • 13
Serial Port Cables (for Gateways with Serial Ports) • Warranty Information • 211
44
Serial Port LEDs (for Gateways with Serial Ports) • 33
Y
Serial Port Specifications • 44, 45 Your Feedback Please • 2
Setting a Temporary IP Address in the Gateway • 15
Setting Up the Project • 19, 21
SIE Client Access to Database • 156
SIE Commands Supported by Siemens Devices • 161
SIE Configuration • 157
SIE CPU1212C • 176
SIE CPU224XP • 178
SIE CPU315-2 DP • 174
SIE Diagnostics • 155, 170
SIE Error Codes • 172, 173
SIE Functional Overview • 153
SIE Gateway Internal Database • 154
SIE General Specifications • 154
SIE Maximum Register Counts • 159
SIE Module Communication Error Codes • 172
SIE PCB Diagnostics • 170
SIE Protocol • 153
SIE Reference • 174
SIE S3-700 Supported Commands • 161
SIE Status Data in Upper Memory • 41, 171
Slave Port
General Port State and ComState Status • 129
SLC and MicroLogix Specifics • 76
SLC File Types • 79
SLC5/05 Read Commands • 78
SLC5/05 Write Commands • 76
SLC-500 Command Set Functions • 55
Standard Modbus Exception Code Errors • 112, 134
Start Here • 9
Step 7 Configuration • 188
Support, Service & Warranty • 209
Supported Function Codes • 114
Swap Code • 26
System Requirements • 10
T
TCP/IP Interface Error Codes • 75
Termination of Received Data • 145
Timer / Counter • 83
To Address • 26
Transmit Data • 138, 143
Transmit-Only Mode • 141
Transmit-Receive Mode • 141

PLX3x UM001

Uploaded by

Copyright:

Available Formats

PLX3x UM001

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PLX3x UM001

Uploaded by

Copyright:

Available Formats

PLX3x Series

May 10, 2019

PLX3x Series User Manual

May 10, 2019

Agency Approvals and Certifications

For professional users in the European Union

Warning – Cancer and Reproductive Harm – www.P65Warnings.ca.gov

2 Using ProSoft Configuration Builder 15

3 Diagnostics and Troubleshooting 31

ProSoft Technology, Inc. Page 5 of 215

3.3.2 Protocol-Specific Status Data in Upper Memory .................................................... 41

Page 6 of 215 ProSoft Technology, Inc.

7 MBS Protocol 116

8 ASCII Protocol 135

9 SIE Protocol 153

10 PND Protocol 181

ProSoft Technology, Inc. Page 7 of 215

10.1.2 PND Internal Database ......................................................................................... 182

11 Support, Service & Warranty 209

Page 8 of 215 ProSoft Technology, Inc.

ProSoft Technology, Inc. Page 9 of 215

1.2 System Requirements

Supported operating systems:

1.3 Package Contents

Gateway with Ethernet Port

Gateway with Two Ethernet Ports

Page 10 of 215 ProSoft Technology, Inc.

Gateway with Ethernet Port and Single Serial Port

Gateway with Ethernet Port and Four Serial Ports

1.4 Mounting the Gateway on a DIN-rail

To mount the PLX3x gateway on a DIN-rail, follow these steps.

ProSoft Technology, Inc. Page 11 of 215

1.5 Jumper Settings

 MODE 1 - The two pins should be jumpered during normal operation.

 MODE 2 - Default IP Jumper: This is the middle jumper. The default IP

 MODE 3 – If set, this jumper provides a level of security resulting in the

o This jumper disables ProSoft Configuration Builder (PCB) upload

o If a previous version of PCB is installed and Jumper Mode 3 is set,

o This jumper position is recognized even if changed after module

o Applies to all modules with firmware version 1.04.

Page 12 of 215 ProSoft Technology, Inc.

1.7 Connecting Power to the Unit

ProSoft Technology, Inc. Page 13 of 215

1.8 Installing ProSoft Configuration Builder Software

To install ProSoft Configuration Builder from the ProSoft Technology website

Page 14 of 215 ProSoft Technology, Inc.

2 Using ProSoft Configuration Builder

2.1 Connecting the PC to the Gateway

2.2 Setting a Temporary IP Address in the Gateway

ProSoft Technology, Inc. Page 15 of 215

1 To open PDS, right-click on the gateway icon in PCB and click on

2 In the Diagnostics dialog box, click on the CONNECTION SETUP icon.

Page 16 of 215 ProSoft Technology, Inc.

ProSoft Technology, Inc. Page 17 of 215

5 Right-click module, and then select ASSIGN TEMPORARY IP.

6 The module’s default IP address is 192.168.0.250.

7 Enter an unused IP within your subnet, and then click OK.

Page 18 of 215 ProSoft Technology, Inc.

2.3 Setting Up the Project