Ethernet/IP: writing zero to soft tags --- More Info

[John Dobbins <jad@lepp.cornell.edu>]

Some additional info regarding this problem of writing to soft tags.

First, I should have made clear this has to do with bo records.

Second, if I compare a hardware tag and a soft tag I see that when they are read the hardware tag, 
e.g. Local:9:O.Data[0], is treated as a bit in an integer whereas the soft tag reads back as a 
boolean, value =255 or 0.

For EIP_verbosity=10 the following excerpt illustrates this, there is a record that references 
Local:9:O.Data[0] which results in the tag Local:9:O.Data being read back as a group of bits and a 
record that references the soft tag remote_reset_a and reads back the boolean value 255 ("on").

It seems to me that when I subsequently try to write a zero to the soft tag remote_reset_a, the value 
255 is treated by the Ethernet/IP driver as a collection of bits, the lowest bit is set to zero to 
generate the value 254. This is then written and interpreted by the controller as "on". (?)

MR_Response:
    USINT service         = 0x8A (Response to S_CIP_MultiRequest)
    USINT reserved        = 0x00
    USINT status          = 0x00 (Ok)
    USINT ext. stat. size = 0
    2 subreplies:
Response #0 (Local:9:O.Data):
MR_Response:
    USINT service         = 0xCC (Response to CIP_ReadData)
    USINT reserved        = 0x00
    USINT status          = 0x00 (Ok)
    USINT ext. stat. size = 0
Data (1 elements):
DINT 127
Response #1 (remote_reset_a):
MR_Response:
    USINT service         = 0xCC (Response to CIP_ReadData)
    USINT reserved        = 0x00
    USINT status          = 0x00 (Ok)
    USINT ext. stat. size = 0
Data (1 elements):
BOOL 255

-----------------------------------------------------------------

Dear All,

We have the following problem using Ethernet/IP device support (and EPICS R3.14.7) with an
Allen-Bradley ControlLogix PLC. We can write to hardware output tags (things like Local:9:O.Data[1])
just fine, however when we try to write to a soft tag, i.e. a controller tag or a program tag, we find
we can write a "one" but not a "zero".

There was a related thread in 2004, beginning with
http://www.aps.anl.gov/epics/tech-talk/2004/msg00636.php
but it wasn't clear to me whether this issue was resolved.

If I set EIP_verbosity = 10 and look at the output (see below) the only difference  between writing a
"one" and writing a "zero" is the data sent. In the case of writing a "one" the data sent is "ff",
when writing a "zero" the data sent is "fe".

Is it possible "fe" counts as zero for a hardware output but not for a "soft" tag?

Any advice or suggestions on how to further debug are welcome.

Thanks

John Dobbins
Lab for Elementary Particle Physics
Cornell University





Write Zero Request:

epics>  ------------------- New Request ------------
EncapsulationHeader:
    UINT  command   = 0x6F (SendRRData)
    UINT  length    = 64
    UDINT session   = 0x12023400
    UDINT status    = 0x00000000 (OK)
    USINT context[8]= 'Funstuff'
    UDINT options   = 0x00000000
Send RR Data
    UDINT interface handle   0
    UINT timeout             0
    UINT count (addr., data) 2
    UINT address_type        0x00 (UCMM)
    UINT address_length      0
    UINT data_type           0xB2 (Unconnected Message)
    UINT data_length         48
MR Request
    USINT service   = 0x52 (CM_Unconnected_Send)
    USINT path size = 2 words
    Path: Class 0x6 (ConnectionManager), instance 1
    USINT tick time   = 10
    USINT ticks       = 240
    UINT message size = 33
    ... (embedded message of 33 bytes)
    USINT path_size   = 1 words
    USINT reserved    = 0x0
    Path: Port 1, link 0
Embedded Message:
MR Request
    USINT service   = 0xA (S_CIP_MultiRequest)
    USINT path size = 2 words
    Path: Class 0x2 (MessageRouter), instance 1
    UINT count 1
Request #0 (remote_reset_a):
MR Request
    USINT service   = 0x4D (CIP_WriteData)
    USINT path size = 8 words
    Path: Tag 'remote_reset_a'    UINT type     = 0xC1
    UINT elements = 1
    Data: 00000000 FE                                              - .
Data sent (88 bytes):
00000000 6F 00 40 00 00 34 02 12 00 00 00 00 46 75 6E 73 - o.@..4......Funs
00000010 74 75 66 66 00 00 00 00 00 00 00 00 00 00 02 00 - tuff............
00000020 00 00 00 00 B2 00 30 00 52 02 20 06 24 01 0A F0 - ......0.R. .$...
00000030 21 00 0A 02 20 02 24 01 01 00 04 00 4D 08 91 0E - !... .$.....M...
00000040 72 65 6D 6F 74 65 5F 72 65 73 65 74 5F 61 C1 00 - remote_reset_a..
00000050 01 00 FE 00 01 00 01 00                         - ........


Write One Request:

epics>  ------------------- New Request ------------
EncapsulationHeader:
    UINT  command   = 0x6F (SendRRData)
    UINT  length    = 64
    UDINT session   = 0x12023400
    UDINT status    = 0x00000000 (OK)
    USINT context[8]= 'Funstuff'
    UDINT options   = 0x00000000
Send RR Data
    UDINT interface handle   0
    UINT timeout             0
    UINT count (addr., data) 2
    UINT address_type        0x00 (UCMM)
    UINT address_length      0
    UINT data_type           0xB2 (Unconnected Message)
    UINT data_length         48
MR Request
    USINT service   = 0x52 (CM_Unconnected_Send)
    USINT path size = 2 words
    Path: Class 0x6 (ConnectionManager), instance 1
    USINT tick time   = 10
    USINT ticks       = 240
    UINT message size = 33
    ... (embedded message of 33 bytes)
    USINT path_size   = 1 words
    USINT reserved    = 0x0
    Path: Port 1, link 0
Embedded Message:
MR Request
    USINT service   = 0xA (S_CIP_MultiRequest)
    USINT path size = 2 words
    Path: Class 0x2 (MessageRouter), instance 1
    UINT count 1
Request #0 (remote_reset_a):
MR Request
    USINT service   = 0x4D (CIP_WriteData)
    USINT path size = 8 words
    Path: Tag 'remote_reset_a'    UINT type     = 0xC1
    UINT elements = 1
    Data: 00000000 FF                                              - .
Data sent (88 bytes):
00000000 6F 00 40 00 00 34 02 12 00 00 00 00 46 75 6E 73 - o.@..4......Funs
00000010 74 75 66 66 00 00 00 00 00 00 00 00 00 00 02 00 - tuff............
00000020 00 00 00 00 B2 00 30 00 52 02 20 06 24 01 0A F0 - ......0.R. .$...
00000030 21 00 0A 02 20 02 24 01 01 00 04 00 4D 08 91 0E - !... .$.....M...
00000040 72 65 6D 6F 74 65 5F 72 65 73 65 74 5F 61 C1 00 - remote_reset_a..
00000050 01 00 FF 00 01 00 01 00                         - ........