Page 1 QnUCPU User's Manual (Communication via Built-in Ethernet Port) -Q03UDVCPU -Q03UDECPU -Q04UDVCPU -Q04UDEHCPU -Q06UDVCPU -Q06UDEHCPU -Q10UDEHCPU -Q13UDVCPU -Q13UDEHCPU -Q20UDEHCPU -Q26UDVCPU -Q26UDEHCPU -Q50UDEHCPU -Q100UDEHCPU...
Page 3: Safety Precautions
SAFETY PRECAUTIONS (Read these precautions before using this product.) Before using this product, please read this manual and the relevant manuals carefully and pay full attention to safety to handle the product correctly. In this manual, the safety precautions are classified into two levels: " WARNING"...
Page 4 [Design Precautions] WARNING ● In an output module, when a load current exceeding the rated current or an overcurrent caused by a load short-circuit flows for a long time, it may cause smoke and fire. To prevent this, configure an external safety circuit, such as a fuse.
Page 5 [Installation Precautions] CAUTION ● Use the programmable controller in an environment that meets the general specifications in the QCPU User's Manual (Hardware Design, Maintenance and Inspection). Failure to do so may result in electric shock, fire, malfunction, or damage to or deterioration of the product.
Page 6 [Wiring Precautions] WARNING ● Shut off the external power supply (all phases) used in the system before installation and wiring. Failure to do so may result in electric shock or damage to the product. ● After wiring, attach the included terminal cover to the module before turning it on for operation. Failure to do so may result in electric shock.
Page 7 Pulling the cable connected to the module may result in malfunction or damage to the module or cable. ● Mitsubishi Electric programmable controllers must be installed in control panels. Connect the main power supply to the power supply module in the control panel through a relay terminal block.
Page 8 [Startup and Maintenance Precautions] CAUTION ● Shut off the external power supply (all phases) used in the system before mounting or removing a module. Failure to do so may cause the module to fail or malfunction. A module can be replaced online (while power is on) on any MELSECNET/H remote I/O station or in the system where a CPU module supporting the online module change function is used.
Page 9: Conditions Of Use For The Product
CONDITIONS OF USE FOR THE PRODUCT (1) Mitsubishi programmable controller ("the PRODUCT") shall be used in conditions; i) where any problem, fault or failure occurring in the PRODUCT, if any, shall not lead to any major or serious accident; and ii) where the backup and fail-safe function are systematically or automatically provided outside of the PRODUCT for the case of any problem, fault or failure occurring in the PRODUCT.
Page 10: Introduction
When applying the program examples introduced in this manual to the actual system, ensure the applicability and confirm that it will not cause system control problems. Relevant CPU module CPU module Model Q03UDVCPU, Q03UDECPU, Q04UDVCPU, Q04UDEHCPU, Q06UDVCPU, Built-in Ethernet port QCPU Q06UDEHCPU, Q10UDEHCPU, Q13UDVCPU, Q13UDEHCPU, Q20UDEHCPU, Q26UDVCPU, Q26UDEHCPU, Q50UDEHCPU, Q100UDEHCPU Remark This manual does not describe any functions other than the functions of CPU module using Ethernet communication.
Page 11 Memo...
Page 12: Table Of Contents
CONTENTS CONTENTS SAFETY PRECAUTIONS ............. 1 CONDITIONS OF USE FOR THE PRODUCT .
Page 13 Predefined Protocol Function Instructions ........6.4.1 Executing the predefined protocol (SP.ECPRTCL) .
Page 14 11.2 How to Use the Function ........... . 11.2.1 Write operation.
Page 15: Manuals
MANUALS To understand the main specifications, functions, and usage of the CPU module, refer to the basic manuals. Read other manuals as well when using a different type of CPU module and its functions. The manuals related to this product are listed below. Please place an order as needed. : Basic manual, : Other CPU module manuals/Use them to utilize functions.
Page 16 (3) Operating manual Manual name Manual Description <manual number (model code)> type GX Works2 Version 1 Operating Manual (Common) System configuration, parameter settings, and online operations of GX ● <SH-080779ENG, 13JU63> Works2, which are common to Simple projects and Structured projects GX Developer Version 8 Operating Manual Operating methods of GX Developer, such as programming, printing, <SH-080373E, 13JU41>...
Page 17: Manual Page Organization
MANUAL PAGE ORGANIZATION In this manual, pages are organized and the symbols are used as shown below. The following page illustration is for explanation purpose only, and is different from the actual pages. "" is used for screen names and items. The chapter of the current page is shown.
Page 18 Icon Description Universal model QCPU Icons indicate that specifications described on the page contain some precautions. Universal...
Page 19 Pages describing instructions are organized as shown below. The following page illustrations are for explanation purpose only, and are different from the actual pages. Instruction name Execution condition of the instruction Structure of the instruction in the ladder mode shows the devices applicable to the instruction Setting side Descriptions of...
Page 20 • Instructions can be executed under the following conditions. On the falling On the falling Execution condition Any time During on During off edge edge Symbol No symbol • The following devices can be used. Link direct device Intelligent Internal device Index Setting File...
Page 21: Terms
A generic term for the Q03UDVCPU, Q03UDECPU, Q04UDVCPU, Q04UDEHCPU, Built-in Ethernet port QCPU Q06UDVCPU, Q06UDEHCPU, Q10UDEHCPU, Q13UDVCPU, Q13UDEHCPU, Q20UDEHCPU, Q26UDVCPU, Q26UDEHCPU, Q50UDEHCPU, and Q100UDEHCPU A generic term for the Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, and High-speed Universal model QCPU Q26UDVCPU  CPU module model...
Page 22: Chapter 1 Overview
CHAPTER 1 OVERVIEW Features The features specific to the Built-in Ethernet port QCPU are described below. (1) Connection of programming tools and GOTs ( Page 24, CHAPTER 3) • The Find CPU function makes it possible to find the Built-in Ethernet port QCPU connected to the same hub as programming tool and displays a list.
Page 23 CHAPTER 1 OVERVIEW (7) File transfer function (FTP) ( Page 139, CHAPTER 9) Each of the files stored in the CPU module can be read or written from the interfacing device with the FTP client function, and a large amount of data can be easily transferred. (8) Remote password ( Page 163, CHAPTER 10) Remote password setting can prevent unauthorized access from the outside and enhance the security of the...
Page 24: Chapter 2 Communication Specifications
CHAPTER 2 COMMUNICATION SPECIFICATIONS The following are the communication specifications of the built-in Ethernet port of the CPU module. Item Specification Data transfer speed 100 or 10 Mbps Communication mode Full-duplex or half-duplex Transmission method Base band Transmission Maximum distance between hub 100 m specifications and node...
Page 25 CHAPTER 2 COMMUNICATION SPECIFICATIONS Remark TCP and UDP are defined as follows: • TCP (Transmission Control Protocol) In communications among programmable controllers and networked devices, this protocol establishes a connection between port numbers of the two devices to perform reliable data communications. •...
Page 26: Chapter 3 Connection Of Programming Tools And Got
CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT This chapter explains how to connect the CPU module to a programming tool or GOT. CPU module CPU module Ethernet Programming Programming tool tool ● The CPU module and programming tool can be connected directly (simple connection) through one Ethernet cable. In direct connection, the module and the tool can communicate with each other without each other's IP address in mind.
Page 27: Setting For The Cpu Module
CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT Setting for the CPU Module (1) PLC parameter setting Select the "Built-in Ethernet Port Setting" tab and set the parameters. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] Set the IP address of the CPU module.
Page 28 Set MELSOFT connection. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] button button can be used with the QnUDVCPU. • For "Ethernet Conf.", drag and drop the "MELSOT Connection Module" from "Module List" to the left side on the window. Select a protocol from "Protocol" depending on the target device. •...
Page 29: Setting For The Programming Tool
CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT Setting for the Programming Tool Configure the settings in the "Transfer Setup" window. Connection Destination window [Connection1] Select "Ethernet Board" for "PC side I/F". In the "PC side IF Ethernet Board Setting" window, select a "TCP" or "UDP" protocol. Select the same protocol as the one set in the Ethernet Configuration or the Open Setting window.
Page 30 Select "PLC Module" for "PLC side I/F". Enter the IP address or host name of the CPU module in the "PLC side I/F Detailed Setting of PLC Module" window, as shown below. ® ® (For the host name, enter the name set in the Microsoft Windows hosts file.) Set "Other Station Setting".
Page 31: Searching Cpu Modules On The Network
CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT Searching CPU Modules on the Network In a configuration using a hub, clicking in the "PLC side I/F Detailed Setting of PLC Module" window will start searching for CPU modules connected to the hub where the programming tool is also connected, and display a list of them.
Page 32: Communication Via Routers
Communication via Routers From the built-in Ethernet port, access is available via routers on a network such as a corporate LAN. Router Corporate Factory Control room Personal computer CPU module For some functions as shown below, communications via a router are not available. •...
Page 33: Melsoft Connection Extended Setting
CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT MELSOFT Connection Extended Setting Note 3.1 GOT on Ethernet can be accessed from the programming tool via the built-in Ethernet port of a CPU module. An access via another network is also enabled.Note 3.1 CPU module Ethernet...
Page 34 Remark If the MELSOFT connection extended setting is not used, an Ethernet module needs to be used to access the GOT and modules on Ethernet from the programming tool. Ethernet module Ethernet...
Page 35 CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT By setting the routing parameter, the following network stations other than Ethernet can also be accessed. • CC-Link IE Controller Network • MELSECNET/H • CC-Link IE Field Network • CC-Link When relaying multiple networks, communications can be made with stations up to eight networks apart (number of relay stations: 7).
Page 36: Setting Method
3.5.1 Setting method (1) MELSOFT connection extended setting Set the network number and station number of a CPU module. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] Button Item Description Setting range MELSOFT Connection Extended • Not to Use (default) Select whether to use this function.
Page 37 CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT (2) Station No. <-> IP information setting Communication in Ethernet is performed based on the IP address and UDP port number while communication in other networks is performed based on the network number and station number. Communication is relayed between another network and Ethernet, the network number and station number are converted into an IP address.
Page 38 (a) Station No. <-> IP information setting system (conversion method) There are four kinds of station No. <-> IP information setting system as shown below. : Setting required, ×: Setting not required Conversion method Net mask pattern Conversion setting Automatic response system ×...
Page 39 CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT (3) Routing parameter settings For communication through multiple networks, the communication path needs to be set. For this purpose, routing parameters need to be set for relaying CPU modules. To send data to the network No. data passes through the station with the own network No.
Page 40 (a) Setting examples Making access from request source (network No.1) to request destination (network No.3) via network No. 2 Network No.: 1 Network No.: 2 Network No.: 2 Network No.: 1 Network No.: 3 Network No.: 3 Station No.3 Station No.0 Station No.6 Station No.0 Station No.7...
Page 41: Convert Format Between The Network Number/Station Number And Ip Address/Port Number
CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT 3.5.2 Convert format between the network number/station number and IP address/port number This section provides an overview of the processing of the conversion method that is set in "Station No. <-> IP Information Setting".
Page 42 (2) IP address calculation system During calculation, the IP address of the partner station is obtained from the calculation equation below according to the network number and station number, and the UDP port number predefined for the CPU module system is used as the UDP port number of the destination.
Page 43 CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT For class B • When the own station IP Address is 8438FA0A • When the net mask pattern for routing other networks is FFFF0000 • When the destination network number is 03 , and the station number is 05H Own station IP Address Logical product...
Page 44 (3) Table exchange system This method uses the network number, station number, and IP address set in the conversion table of the Station No. <-> IP information, and uses the UDP port number predefined for the Ethernet system as the UDP port number of the destination.
Page 45 CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT Module setting details when accessing from CPU [3] to CPU [4] Item [3] Relay sending station *1 Network No., station 2, 22 number Setting value (Decimal) Setting not necessary Setting not necessary Setting not necessary IP Address 192.0.2.22...
Page 46: Checking Communication Status
3.5.3 Checking communication status Among the errors that occurred when the MELSOFT connection extended setting is used, those arising from communication errors are stored in the error history of Ethernet diagnostics. "MELSOFT connection" is displayed for the connection number and open system of each error. For information on the Ethernet diagnostics, refer to the following manual.
Page 47: Precautions
CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT Precautions (1) IP address duplication Check that the IP address is not duplicated when configuring a network or connecting a new device to a network. If the IP address is duplicated, a device may communicate with the wrong device. Check for the IP address duplication in the following ways.
Page 48 (5) MELSOFT connection over TCP or UDP For TCP or UDP communications with multiple MELSOFT devices, set the same number of protocols as that of the connected MELSOFT devices in the setting of the PLC parameter. CPU module Ethernet MELSOFT device MELSOFT device MELSOFT device Set the same number...
Page 49 CHAPTER 3 CONNECTION OF PROGRAMMING TOOLS AND GOT (8) Network No. and station number overlapping When the MELSOFT connection extended setting is used, do not overlap the network number to be set for a CPU module with the network number of another relay network. Set a station number different from those used in the same network.
Page 50: Chapter 4 Direct Connection To Programming Tool
CHAPTER 4 DIRECT CONNECTION TO PROGRAMMING TOOL (SIMPLE CONNECTION) The CPU module can be directly connected to the programming tool with an Ethernet cable, without using a hub (simple connection). For direct connection, the IP address and host name need not be specified in the connection target setting. (Simultaneous broadcast is used.) CPU module Ethernet cable...
Page 51: Setting Method
CHAPTER 4 DIRECT CONNECTION TO PROGRAMMING TOOL (SIMPLE CONNECTION) Setting Method Set the items on the Transfer Setup window. Connection Destination window [Connection1] Select "Ethernet Board" for "PC side I/F". Select "PLC Module" for "PLC side I/F". In the "PLC side IF Detailed Setting of PLC Module" window, select the Ethernet Port Direct Connection checkbox as shown below.
Page 52: Precautions
Precautions (1) Connection to LAN line When connecting the CPU module to a LAN line, do not set direct connection. Doing so will apply a load to the LAN line and adversely affect communications with other external devices. (2) Indirect connection •...
Page 53: Chapter 5 Mc Protocol Communication
CHAPTER 5 MC PROTOCOL COMMUNICATION CHAPTER 5 MC PROTOCOL COMMUNICATION The built-in Ethernet port allows MC protocol communication. Sending a Command from an External Device to the CPU Module From peripherals such as a personal computer or HMI, device data of the CPU module can be read or written using MC protocol.
Page 54: Setting Method
5.1.1 Setting Method Setting for communication using the MC protocol is described below. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] Select Binary or ASCII code as the communication data code used for MC protocol. Select the "Enable online change (FTP, MC Protocol)" checkbox to enable data to be written to the CPU module even in the RUN state.
Page 55 CHAPTER 5 MC PROTOCOL COMMUNICATION Set connections used for MC protocol communication. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] button button can be used with the QnUDVCPU. • For "Ethernet Conf.", drag and drop "SLMP Connection Module" from "Module List" to the left side on the window.
Page 56: Mc Protocol Commands
5.1.2 MC protocol commands (1) Command list The following commands are executable for MC protocol communication of the CPU module. (a) When 4E frame or QnA-compatible 3E frame is used : Available, ×: N/A CPU module state Number of Command Function Description processed...
Page 57 CHAPTER 5 MC PROTOCOL COMMUNICATION (b) When A-compatible 1E frame is used : Available, ×: N/A Status of CPU module Command Number of Function /response Description processed STOP Write Write type points enabled disabled In units Reads bit devices in units of one point. 256 points of bits Batch read...
Page 58 (2) Available devices lists the devices available in the commands used for MC protocol communication. The following table (a) When 4E frame or QnA-compatible 3E frame is used Device code Classification Device Device number range ASCII Binary Input Hexadecimal The number range of a device in a CPU module, which is accessed to, can be specified.
Page 59 CHAPTER 5 MC PROTOCOL COMMUNICATION (b) When A-compatible 1E frame is used Device code Classification Device Device range Device number ASCII Binary 5820 0000 to 07FF Input X0 to X7FF 5920 0000 to 07FF Output Y0 to Y7FF • M0 to M8191 4D20 •...
Page 60 Device code Classification Device Device range Device number ASCII Binary 5453 Contact 5443 T0 to T2047 0000 to 07FF Timer Coil Note, however, that local devices cannot be accessed. 544E Current value Contact Retentive timer Coil Cannot be accessed. Current value 4353 internal user Contact...
Page 61: Precautions
CHAPTER 5 MC PROTOCOL COMMUNICATION 5.1.3 Precautions (1) Number of devices Only the external devices set in "Ethernet Conf." or "Open Setting" can be connected concurrently using MC protocol. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] button button can be used with the QnUDVCPU. (2) Data communication frame The following table lists the availability of data communication frames.
Page 62 (6) Receiving a response message The following shows an example of receive processing on the other device side. Communication processing on the other device side Request message, send processing Response message, receive processing Is TCP connection open? Received data within the time specified by the monitoring timer value? Check the received data size.
Page 63 CHAPTER 5 MC PROTOCOL COMMUNICATION (7) Sending request messages consecutively When request messages are sent consecutively without waiting for the reception of the response message using 4E frame, the number of commands must not exceed the limit listed as follows. TCP/UDP Applicable number of commands for processing per one connection 11680 ÷...
Page 64: Error Codes, End Codes, And Abnormal Codes In Mc Protocol Communication
5.1.4 Error codes, end codes, and abnormal codes in MC protocol communication When an error occurs during MC protocol communication, an error code is sent from the CPU module to the external device. The following table lists error codes, error descriptions, and corrective actions. (1) When 4E frame or QnA-compatible 3E frame is used Error code Description...
Page 65 CHAPTER 5 MC PROTOCOL COMMUNICATION Error code Description Corrective action (Hexadecimal) The port used for communication is locked with the remote password. C201 Or, because of the remote password lock status with Unlock the remote password before communication. "Communication Data Code" set to ASCII Code, the subcommand and later part cannot be converted to a binary code.
Page 66 (2) When A-compatible 1E frame is used An end code and abnormal code are added to a response in MC protocol communication that uses A-compatible 1E frames. When the end code is a value other than "5B " Response format Subheader End code 0000...
Page 67: Sending A Command From The Cpu Module To An External Device
CHAPTER 5 MC PROTOCOL COMMUNICATION Sending a Command from the CPU Module to an External Device Note 5.1 MC protocol messages (QnA-compatible 3E frame and 4E frame) can be sent from the CPU module to external devices on the Ethernet network. To send the messages, use the SLMP frame send instruction.Note 5.1 External device...
Page 68: Sending An Slmp Frame (Sp.slmpsnd)
5.2.1 Sending an SLMP frame (SP.SLMPSND) Command SP.SLMPSND SP.SLMPSND "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word File registers set for each local device or program cannot be used. (1) Setting data Setting data Description Data type Set by...
Page 69 CHAPTER 5 MC PROTOCOL COMMUNICATION (2) Control data Device Item Description Setting range Set by [1] Execution type • 0: Without arrival check (The instruction is regarded as completed when a request message is sent from the host station.) • 1: With arrival check (The instruction is regarded as completed Execution/error User when a response message is received from the external device.)
Page 70 Device Item Description Setting range Set by Specify an access target module. • 03FF : Host station/control CPU • 03E0 : Multiple CPU No.1 • 03E1 : Multiple CPU No.2 03FF , 03E0 Request • 03E2 : Multiple CPU No.3 03E3 , 03D0 destination module...
Page 71 CHAPTER 5 MC PROTOCOL COMMUNICATION Device Item Description Setting range Set by The IP address (third and fourth octets) of the device where an error was detected is stored. IP address of error detected device (third and fourth octets) 3, 4: Indicates the octets of the IP address. System The IP address (first and second octets) of the device where an error was detected is stored.
Page 72 (3) Request frame Device Item Description Setting range Set by Request data Specify the data length from the monitoring timer to the request 1 to 2000 User length data. (In units of bytes) This timer sets the waiting time for the external device that received a request message to wait for the response after it issued a processing request to the access destination.
Page 73 CHAPTER 5 MC PROTOCOL COMMUNICATION (5) Function • This instruction sends the request frame in the device specified by and later to the external device specified by the external device IP address in the control data. When a response message is received from the external device, it is stored in the device specified by The following figures show the request data and the response data when the instruction is completed normally or with an error.
Page 74 • The result of the SP.SLMPSND instruction can be checked with the completion device, +0 and • Completion device This device turns on at the END processing of the scan in which the SP.SLMPSND instruction is completed and turns off at the next END processing. •...
Page 75 CHAPTER 5 MC PROTOCOL COMMUNICATION (6) Error A detection of an operation error turns on the Error flag (SM0) and a corresponding error code is stored in SD0 when: • An instruction is used in a CPU module with a serial number (first five digits) of "18111" or earlier. (Error code: 4002) •...
Page 76 The SP.SLMPSND instruction is normally completed even if the external device returns an abnormal response. When the SP.SLMPSND instruction is completed normally, whether the response is normal or abnormal can be identified by the end code of the response frame. When an abnormal response is returned, check the manual of the external device being used and take corrective action.
Page 77: Chapter 6 Data Communications Using The Predefined Protocol
CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Note 6.1 The predefined protocol function sends and receives packets predefined by using GX Works2, enabling easy communications with external devices (such as measuring instruments and bar code readers). Protocols can be either selected from the prepared predefined protocol library, or created and edited by users.Note 6.1 1) Setting protocols...
Page 78: Specifications
Specifications The following table lists the specifications. Item Description Up to 128 Number of protocols Protocol setting data Up to 256 Number of packets Up to 12288 bytes Packet area data size Available connection Connection No.1 to No.16 Protocol execution method SP.ECPRTCL instruction Communication data code Binary code...
Page 79: Setting Method
CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Setting Method The setting required for using the predefined protocol function is described below. Open the "Predefined Protocol Support Function" window. [Tool] [Predefined Protocol Support Function] [Built-in Ethernet] Create a new file. [File] [New...] "Add"...
Page 80 Set the items required for data communications. In the "Protocol Detailed Setting" window, set the communication parameters for the protocol. "Protocol Setting" window Select protocol [Edit] [Protocol Detailed Setting] Set the packet configuration. In the "Packet Setting" window, set the configuration of packets to be sent or received.
Page 81 CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Write the protocol setting data to the CPU module. In the "Writing Protocol Setting" window, specify the write-target drive in the CPU module and write the protocol setting data. [Module Read/Write] [Write to Module] The written protocol setting data will be enabled when •...
Page 82 Create a program for starting data communications. • In the case of Active open, create the program in which SP.SOCOPEN instruction is used to establish a connection. ( Page 106, Section 7.4.1) • To activate the predefined protocol, the SP.ECPRTCL instruction is used.
Page 83 CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL (1) Start device to store the predefined protocol operation status In the open setting, set the start device where the predefined protocol operation status is to be stored. The following information is stored in the area of 19 words starting from the selected device. Start Device to Store Predefined Protocol Name...
Page 84: Setting Items Of Predefined Protocol Support Function
Setting Items of Predefined Protocol Support Function 6.3.1 Communication type There are three protocol communication types: "Send Only", "Receive Only", and "Send & Receive". For details of the protocol communication types, refer to the following. Q Corresponding Ethernet Interface Module User's Manual (Basic) 6.3.2 Packet elements set for "Packet Setting"...
Page 85: Predefined Protocol Function Instructions
CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Predefined Protocol Function Instructions The predefined protocol function instructions are provided for the CPU module to use the predefined protocol function. This section describes the predefined protocol function instructions. Instruction Description Reference Establishes a connection with the external device.
Page 86: Execution Conditions Of Predefined Protocol Function
Execution Conditions of Predefined Protocol Function The predefined protocol function can be executed when the protocol setting data is enabled and SM1354 (Predefined protocol ready) is on. The written protocol setting data will be enabled when • the CPU module is powered on or is reset, or •...
Page 87: Precautions
CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Precautions (1) Send/receive packet • When a message larger than 1460 bytes is sent from the external device using TCP, a packet may be divided. As a result, data may not be received as one message with the predefined protocol function. Keep the message less than 1460 bytes or use UDP.
Page 88: Chapter 7 Socket Communication Function
CHAPTER 7 SOCKET COMMUNICATION FUNCTION Note 7.1 The socket communication function allows data communications with the devices on Ethernet by TCP or UDP using various dedicated instructions. Sending data SP.SOCSND instruction Socket communication receive area Connection No.1 Program Connection No.2 SP.SOCRCV instruction Connection No.3 S.SOCRCVS instruction...
Page 89 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (1) Port numbers In socket communication, port numbers are used to identify respective communications and thereby multiple communications are available both on TCP and UDP. • For sending Specify the port number of the CPU module from which data are sent, and the port number of the destination device.
Page 90: Communication Using Tcp
Communication Using TCP TCP (Transmission Control Protocol) establishes a connection to a device with a port number, and performs reliable data communications. To perform socket communication using TCP, confirm the following in advance. • IP address and port number of the target device •...
Page 91 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (2) Program example for Active open The following shows a communication flow of an Active open. Start Specify the port number of the external device waiting for TCP connection and open a connection by Active open. Open processing: SP.SOCOPEN instruction YES (Completed, or disconnected by the external device.)
Page 92 • For "Open Setting" Item Setting Protocol Open System Socket Communication TCP Connection Active Host Station Port No. 1000 (Setting range: 0001 to 1387 , 1392 to FFFE Destination IP Address 192.168.3.40 (Setting range: 0.0.0.1 to 223.255.255.254) 1000 (Setting range: 0001 to FFFE Destination Port No.
Page 93 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (c) Sample program <<Fixed length mode setting>> Setting TCP receive mode to 1 Setting receive data size to 6 Changing TCP receive mode of Connection No.1 <<Connection No.1 open processing (Active)>> Setting Execution/completion type to 0 Connection No.1 open Normal completion Error completion...
Page 94 (d) Precaution for Active open communication Configure an interlock circuit using the Open completion signal (SD1282) and Open request signal (SD1284) in the program. The following chart shows on/off timings of the Open completion signal and Open request signal. <When disconnected by the CPU module> TCP disconnection completed upon Open completion signal response from the external device...
Page 95 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (3) Program example for Passive open The following shows a communication flow of a Passive open. Start Waiting for TCP connection in Passive open state. Send or receive? Send by the SP.SOCSND instruction, or receive by the SP.SOCRCV or S.SOCRCVS instruction.
Page 96 • For "Open Setting" Item Setting Protocol Open System Socket Communication TCP Connection Unpassive Host Station Port No. 1000 (Setting range: 0001 to 1387 , 1392 to FFFE (1 to 4999, 5010 to 65534)) Blank. Destination IP Address When "Fullpassive" is selected for "TCP Connection", a value must be set. (Setting range: 0.0.0.1 to 223.255.255.254) Blank.
Page 97 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (c) Sample program <<Fixed length mode setting>> Setting TCP receive mode to 1 Setting receive data size to 6 Changing TCP receive mode of Connection 1 <<Target checking>> Obtaining information of connected device <<Data sending>> Setting send data length Setting send data Sending data to Connection No.1...
Page 98 (d) Precaution for Passive open communication • Configure an interlock circuit using the Open completion signal (SD1282) and Open request signal (SD1284) in the program. The following chart shows on/off timings of the Open completion signal and Open request signal. TCP disconnection completed by the external device Open completion signal...
Page 99: Communication Using Udp
CHAPTER 7 SOCKET COMMUNICATION FUNCTION Communication Using UDP UDP (User Datagram Protocol) is a simple protocol that does not perform data sequencing and retransmission. To perform socket communication using UDP, confirm the following in advance. • IP address and port number of the target device •...
Page 100 • For "Open Setting" Item Setting Protocol Open System Socket Communication TCP Connection Blank Host Station Port No. 1000 (Setting range: 0001 to 1387 and 1392 to FFFE (1 to 4999, 5010 to 65534)) Destination IP Address 192.168.3.40 (Setting range: 0.0.0.1 to 223.255.255.254/255.255.255.255) 1000 (Setting range: 0001 to FFFE...
Page 101 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (c) Sample program <<Target changing>> Setting target IP address Setting target port No. Changing setting of Connection No.1 <<Data sending>> Setting send data length Setting send data Sending data to Connection No.1 Normal completion Error completion <<Data receiving>>...
Page 102 (2) Simultaneous broadcast For simultaneous broadcast using UDP, set the parameters as follows. • Destination IP Address: FF.FF.FF.FF • Destination Port No.: FFFF CPU module (IP address: xx.xx.xx.xx, Subnet mask: 255.255.255.0) Ethernet Sending data from port No.A of the CPU module to each port No.N of all Port No.A External device 1 external devices.
Page 103 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (3) Precautions (a) Use of UDP Data may be lost, or may arrive out of order. Consider the application of TCP if any problem is expected. (b) Sending and receiving data Data sending process may be terminated even if the communication line between the CPU module and target device is not connected due to a reason such as cable disconnection.
Page 104 (i) Destination IP address of the message transferred by simultaneous broadcast Use a CPU module IP address of which all the bits corresponding to the host address are on. When the subnet musk pattern is specified, apply the pattern before using the above mentioned IP address. IP address of the CPU module side : 168.
Page 105: Precautions For The Socket Communication Function
CHAPTER 7 SOCKET COMMUNICATION FUNCTION Precautions for the Socket Communication Function This section provides other precautions for the socket communication function. (1) Port number Host station port number, 0001 to 03FF , are assigned for reserved port numbers (WELL KNOWN PORT NUMBERS) and F000 to FFFE are for other communication functions.
Page 106 (7) Checking receive data length Since no delimiter is provided for TCP communication data, on the receiving end, separate data blocks that are sent continuously may be combined, or data sent all at once may be segmented. The receive data length must be confirmed on the receiving side as necessary. When data are received on the CPU side and the data length is determined, the fixed-length mode is recommended.
Page 107: Socket Communication Function Instructions
CHAPTER 7 SOCKET COMMUNICATION FUNCTION Socket Communication Function Instructions The socket communication function instructions are provided for the CPU module to use the socket communication function. This section explains the socket communication function instructions. The following is a list of the instructions. Instruction Description Reference...
Page 108: Establishing A Connection (Sp.socopen)
7.4.1 Establishing a connection (SP.SOCOPEN) Command SP.SOCOPEN SP.SOCOPEN Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (except for T, ST, and File registers set for each local device or program cannot be used. (1) Setting data Setting data Description Data type...
Page 109 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (2) Control data Device Item Description Setting range Set by Specify which settings are used to open a connection, parameter settings configured by a programming tool or control data settings 0000 Execution/compl 0000 User etion type 8000 Connection is opened according to the settings set in "Open settings"...
Page 110 (3) Function This instruction opens a connection specified in The set values used for the open processing is selected in The result of the SP.SOCOPEN instruction can be checked with the completion device, +0 and • Completion device Turns on in the END processing of the scan after completion of the SP.SOCOPEN instruction, and turns off in the next END processing.
Page 111 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (5) Program examples (a) Opening a connection using parameter settings When M1000 is turned on, connection No.1 is opened using the parameters set in "Open settings" of PLC parameter. • Devices used Device number Application SD1282 Open completion signal SD1284...
Page 112: Disconnecting A Connection (Sp.socclose)
7.4.2 Disconnecting a connection (SP.SOCCLOSE) Command SP.SOCCLOSE SP.SOCCLOSE Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (except for T, ST, and File registers set for each local device or program cannot be used. (1) Setting data Setting data Description Data type...
Page 113 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (3) Function This instruction closes a connection specified in . (Disconnection of a connection) The result of the SP.SOCCLOSE instruction can be checked with the completion device, +0 and • Completion device Turns on in the END processing of a scan after completion of the SP.SOCCLOSE instruction, and turns off in the next END processing.
Page 114 (5) Program example When M2000 is turned on or when the connected device disconnects connection No.1, connection No.1 is disconnected by the following program. • Devices used Device number Application SD1282 Open completion signal SD1284 Open request signal D200 SP.SOCCLOSE instruction control data M200 SP.SOCCLOSE instruction completion device •...
Page 115: Reading Out Received Data In The End Processing (Sp.socrcv)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.3 Reading out received data in the END processing (SP.SOCRCV) Command SP.SOCRCV SP.SOCRCV Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (except for T, ST, and File registers set for each local device or program cannot be used. (1) Setting data Setting data Description...
Page 116 (2) Control data Device Item Description Setting range Set by System area Completion status is stored. Completion 0000 : Completed status Other than 0000 : Failed (Error code) The length of the data which were read out from Receive data the Socket communication receive data area is 0 to 10238 System...
Page 117 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (3) Function This instruction reads out received data of the connection specified in from the Socket communication receive data area in the END processing after execution of the SP.SOCRCV instruction. CPU module Receive data D1 +0 length Socket communication Receive data...
Page 118 (4) Error A detection of an operation error turns on the Error flag (SM0) and a corresponding error code is stored in SD0 when: • The instruction is executed in the QnUDE(H)CPU with a serial number (first five digits) of "11011" or earlier or a CPU module other than the Built-in Ethernet port QCPU.
Page 119: Reading Out Received Data During Instruction Execution (S.socrcvs)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.4 Reading out received data during instruction execution (S.SOCRCVS) Command S.SOCRCVS S.SOCRCVS Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (1) Setting data Setting data Description Data type Set by Dummy Character string Connection number (Setting range: 1 to 16)
Page 120 ● Receive data size is 2046 bytes by default. To receive data over 2046 bytes, change the receive data size with the SP.SOCRMODE instruction. ● If the CPU module receives odd-byte data, invalid data is stored to the high byte of the device where the last received data is stored.
Page 121 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (4) Error A detection of an operation error turns on the Error flag (SM0) and a corresponding error code is stored in SD0 when: • The instruction is executed in the QnUDE(H)CPU with a serial number (first five digits) of "11011" or earlier or a CPU module other than the Built-in Ethernet port QCPU.
Page 122: Sending Data (Sp.socsnd)
7.4.5 Sending data (SP.SOCSND) Command SP.SOCSND SP.SOCSND Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (except for T, ST, and File registers set for each local device or program cannot be used. (1) Setting data Setting data Description Data type...
Page 123 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (2) Control data Device Item Description Setting range Set by System area Completion status is stored. Completion 0000 : Completed System status Other than 0000 : Failed (Error code) Send data length The length of send data is specified (in bytes). 1 to 10238 User Send data...
Page 124 (3) Function This instruction sends data set in to the target device of the connection specified by CPU module Send data S3 +0 length Send data S3 +1 Send data S3 +2 External device SP.SOCSND (Sending data) Send data S3 +n The result of the SP.SOCSND instruction can be checked with the completion device, +0 and •...
Page 125 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (4) Error A detection of an operation error turns on the Error flag (SM0) and a corresponding error code is stored in SD0 when: • The instruction is executed in the QnUDE(H)CPU with a serial number (first five digits) of "11011" or earlier or a CPU module other than the Built-in Ethernet port QCPU.
Page 126: Reading Out Connection Information (Sp.soccinf)
7.4.6 Reading out connection information (SP.SOCCINF) Command SP.SOCCINF SP.SOCCINF Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (1) Setting data Setting data Description Data type Set by Dummy Character string Connection number (Setting range: 1 to 16) User BIN 16-bit Start number of the device from which control data are stored...
Page 127 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (2) Control data Device Item Description Setting range Set by System area Completion status is stored. Completion 0000 : Completed status Other than 0000 : Failed (Error code) Target device IP to FFFFFFFF IP address of the target device is stored. address *4 *5 Target device...
Page 128 (3) Function This instruction reads out connection information specified in (4) Error A detection of an operation error turns on the Error flag (SM0) and a corresponding error code is stored in SD0 when: • The instruction is executed in the QnUDE(H)CPU with a serial number (first five digits) of "11011" or earlier or a CPU module other than the Built-in Ethernet port QCPU.
Page 129: Changing The Target Of A Connection (Udp/Ip) (Sp.soccset)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.7 Changing the target of a connection (UDP/IP) (SP.SOCCSET) Command SP.SOCCSET SP.SOCCSET Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (1) Setting data Setting data Description Data type Set by Dummy Character string Connection number (Setting range: 1 to 16)
Page 130 (3) Function This instruction changes the IP address and port number of the target device of which connection is specified in (Note that this instruction is available only for UDP/IP communications.) ● The target device can be changed without closing the connection by using the SP.SOCCSET instruction. ●...
Page 131: Changing The Receive Mode Of A Connection (Sp.socrmode)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.8 Changing the receive mode of a connection (SP.SOCRMODE) Command SP.SOCRMODE SP.SOCRMODE Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (1) Setting data Setting data Description Data type Set by Dummy Character string Connection number (Setting range: 1 to 16)
Page 132 (3) Function This instruction changes the TCP receive mode and receive data size of the connection specified in . The mode is changed as specified in +2. (This instruction is invalid for UDP connections.) (a) TCP standard receive mode When data are received, they are stored in the Socket communication receive data area, and SD1286 turns on. If data are received exceeding the specified receive data size, the excess data are read out the next time.
Page 133 CHAPTER 7 SOCKET COMMUNICATION FUNCTION ● Effective use of devices Devices can be effectively used by setting the receive data size to less than 1024 words while the default size of the receive data storing devices for the SP.SOCRCV and S.SOCRCVS instructions is 1024 words. ●...
Page 134 (5) Program example When M4000 is turned on, connection No.1 is set to the TCP fixed-length receive mode and the receive data size is set to 256 bytes. After execution of the instruction and when the receive data size of connection No.1 reaches 256 bytes, the Receive state signal is turned on.
Page 135: Socket Communication Receive Data Read (S(P).Socrdata)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.9 Socket communication receive data read (S(P).SOCRDATA) Command S.SOCRDATA S.SOCRDATA Command SP.SOCRDATA SP.SOCRDATA Internal device J\ Setting Constant R, ZR U\G Others data K, H Word Word (1) Setting data Setting data Description Data type Set by Dummy Character string...
Page 136 (3) Function This instruction reads out the data of the amount specified for n from the Socket communication receive data area of which connection is specified in , and stores them in the device specified in or higher. No processing is performed when the number of read data (n) is 0.
Page 137 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (5) Program example When M4000 is turned on, the receive data length of connection No.1 is read out. • Devices used Device number Application SD1282 Open completion signal SD1286 Receive state signal D400 S.SOCRDATA instruction control data D4000 Storage location where data are read out Number of read data (one word)
Page 138: Chapter 8 Time Setting Function (Sntp Client)
CHAPTER 8 TIME SETTING FUNCTION (SNTP CLIENT) The CPU module collects time information from a time information server on LAN, and automatically sets its own time. With this time setting function, the CPU module queries the server for time information at the specified timing, and can set the time information sent from the server as its own clock data.
Page 139: Setting Method
CHAPTER 8 TIME SETTING FUNCTION (SNTP CLIENT) Setting Method Configure the time settings in the Built-in Ethernet port tab of the PLC parameter window. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] button Item Description Setting range SNTP Function Setting Select whether to use this function or not.
Page 140: Precautions
Precautions (1) Communication timeout A communication timeout occurs when 20 seconds have elapsed without receiving any response after sending a time query. At the time of a communication timeout, the value in SD1270 is FFFF (2) Time information server When the time setting function is used, an SNTP server (time information server) is required on the LAN. (3) Delay resulted from the time required for communication A delay occurs and affects the set time as a result of the time spent for communication with the SNTP server computer.
Page 141: Chapter 9 File Transfer Function (Ftp)
CHAPTER 9 FILE TRANSFER FUNCTION (FTP) CHAPTER 9 FILE TRANSFER FUNCTION (FTP) The CPU module supports the server function for FTP (File Transfer Protocol) which is a protocol designed for file transfer to or from the connected device. The device with the FTP client function can directly access any files located in the CPU module. CPU module (FTP server) Target device (FTP client)
Page 142: Setting For Ftp Communication
Setting for FTP Communication (1) Operation on the CPU module side Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] Set the IP address of the CPU module. Select "Enable online change (FTP, MC Protocol)" when data need to be written even while the CPU module is in RUN state.
Page 143 CHAPTER 9 FILE TRANSFER FUNCTION (FTP) Configure the FTP settings. Item Description Select "Used". Set a log-in name used for file transfer (login) request from an external device. Login Name [Default value] • QnUDVCPU: "MELSEC" • QnUDE(H)CPU: "QNUDECPU" Set an FTP password used for file transfer request from an external device. To change the password, enter both the current password and a new password for confirmation.
Page 144 (2) Operation on the connected device (FTP client) side The following describes the procedure and processing on the connected device side, which is required for using the FTP server function of the CPU module. Various FTP commands and how to enter each of them are also shown. (<ret>...
Page 145 CHAPTER 9 FILE TRANSFER FUNCTION (FTP) (b) For the QnUDE(H)CPU Start Start up FTP client. (ftp<ret>) Log-in to the QnUDE(H)CPU. (open IP address of the QnUDE(H)CPU<ret>) Is the FTP communication port subject to remote password check? Unlock the remote password. (quote password-unlock Remote password<ret>) Has the file File write...
Page 146 (c) Logging in to the CPU module The following explains the operation flow from starting an FTP session until log-in to the CPU module. ® ® Start up the FTP from the MS-DOS prompt of Microsoft Windows Start an FTP session. (FTP <ret>) Open a connection to the FTP server (open "IP address of the CPU module"...
Page 147: Files Transferable Using Ftp
CHAPTER 9 FILE TRANSFER FUNCTION (FTP) Files Transferable Using FTP The following table lists the files that can be transferred using the file transfer function. :Available, :N/A × Program File name and Standard Standard SRAM Flash memory ATA card memory extension (Any card card...
Page 148 The SP.FWRITE or SP.FREAD instruction in the program will write or read the file respectively. For details, refer to the following manual. MELSEC-Q/L Programming Manual (Common Instruction) Files can be written to the program memory only when the CPU module is in the STOP state. Write destination is the program cache memory.
Page 149: Files That Can Be Deleted Using Ftp
CHAPTER 9 FILE TRANSFER FUNCTION (FTP) Files That Can Be Deleted Using FTP The following table lists the files that can be deleted using the file transfer function. : Deletable, : Not deletable only in RUN state, ×: Not deletable, -: Not writable Program File name and Standard...
Page 150 The SP.FWRITE or SP.FREAD instruction in the program will write or read the file respectively. For details, refer to the following manual. MELSEC-Q/L Programming Manual (Common Instruction) Files can be written to the program memory only when the CPU module is in the STOP state. Write destination is the program cache memory.
Page 151: Ftp Commands
CHAPTER 9 FILE TRANSFER FUNCTION (FTP) FTP Commands 9.4.1 List of FTP commands : Available, × : N/A CPU module state Remote password Command Function Unlocked Locked Write Write STOP enabled disabled Notifies the FTP server of file transfer without conversion. ×...
Page 152 The following table lists the subcommands available with the command, "quote". : Available, × : N/A CPU module state Remote password Subcommand Function STOP Unlocked Locked Write Write enabled disabled × × change Displays or changes the CPU module file attribute. Sets/displays/clears the Built-in Ethernet port QCPU file access ×...
Page 153: How To Specify An Ftp Command
CHAPTER 9 FILE TRANSFER FUNCTION (FTP) 9.4.2 How to specify an FTP command This section explains how to specify a file with an FTP command on the FTP client (connected device), which is supported by the CPU module. (1) File specification A file can be specified for an FTP command on the FTP client side as follows: •...
Page 154: Details Of Ftp Commands
9.4.3 Details of FTP commands Details of the FTP commands on the FTP client side, which are supported by the CPU module, and how to use each of them are described below. Note that some FTP commands may not function as described in this manual, depending on the FTP application used on the FTP client side.
Page 155 CHAPTER 9 FILE TRANSFER FUNCTION (FTP) ● [Function] Reads a file from the CPU module. [Specification format] get "source file path name" [destination file path name] [Example 1] When reading a file stored in the standard RAM and saving it under the same file name: get 3:\MAINSEQ1.QDR [Example 2] When reading a file stored in the standard RAM and saving it under a different file name:...
Page 156 mget ● [Function] Reads out a file from the CPU module. To read out multiple files, specify the file name and extension within the file path name using a wild card (* and/or ?). When reading multiple files, reception is checked for each file transfer. [Specification format] mget "file path name"...
Page 157 CHAPTER 9 FILE TRANSFER FUNCTION (FTP) ● [Function] Writes a file to the CPU module. [Specification format] put "source file path name" [destination file path name] [Example 1] When writing the MAINSEQ1.QDR file to the standard RAM with the same file name: put MAINSEQ1.QDR 3:\MAINSEQ1.QDR [Example 2] When writing the MAINSEQ.QDR file to the standard RAM with a different file name:...
Page 158 (2) CPU-module-dedicated subcommands The CPU-module-dedicated subcommands affixed to an FTP command, "quote," are described below. change ● [Function] Displays or changes the attribute of a file stored in the CPU module. [Specification format 1] When displaying the file attribute: quote change "file path name" Either of the following is displayed as an execution result upon completion.
Page 159 CHAPTER 9 FILE TRANSFER FUNCTION (FTP) ● password-unlock [Function] Specify the remote password set in the CPU module to unlock the password. [Specification format] quote password-unlock [remote password] • Remote password: Specify the remote password set with a parameter for the CPU module.
Page 160 ● [Function] Changes the CPU module state to RUN. (Remote RUN.) At this time, device memory clear can be specified. [Specification format] quote run [mode [clear mode]] • Mode: Specify whether to force remote RUN or not. 0: Normal RUN (default) 1: Forced RUN •...
Page 161 CHAPTER 9 FILE TRANSFER FUNCTION (FTP) pm-write ● [Function] Transfers program cache memory to the program memory. [Specification format] quote pm-write The following message is displayed as an execution result upon completion. 200 Command successful [Note] Before writing data, set the CPU module to STOP. passwd-rd ●...
Page 162 passwd-wr ● [Function] Sets the write password (file password 32) that has been registered in a target file to transfer in the CPU module. Displays and clears the write password that has been set in the CPU module. Use this command only when a write password has been registered in the target file to transfer.
Page 163: Precautions
CHAPTER 9 FILE TRANSFER FUNCTION (FTP) Precautions (1) FTP clients • Some FTP clients may have FTP command specifications different from those described in this manual. In such a case, check the functions and operation methods, referring to the manuals for the FTP client. ®...
Page 164 (4) File writing • An existing file cannot be overwritten. Delete or rename an existing file with the file delete command (delete, mdelete) or the file rename command (rename) before writing files. • A read-only file or a file locked by the function except for FTP cannot be written. If attempted, a write error occurs.
Page 165: Chapter 10 Remote Password
CHAPTER 10 REMOTE PASSWORD CHAPTER 10 REMOTE PASSWORD A remote password is checked when a connection is requested for the following. • Communication using a programming tool • Communication using MC protocol • File transfer (FTP) The remote password function is one of the preventive methods against unauthorized access (e.g. destruction of data and programs) from external devices.
Page 166: Communication Using Remote Password
10.1 Communication Using Remote Password Communication is performed in the order described below when a remote password is set for the CPU module. (1) Allowing access (unlock processing) On a communication device such as a personal computer, unlock the remote password set for the CPU module. If it is not unlocked, an error will occur on the connected device because the CPU module will prohibit any access.
Page 167: Remote Password Setting
CHAPTER 10 REMOTE PASSWORD 10.2 Remote Password Setting (1) Setting a remote password Set a remote password and a target connection in the programming tool, and write the data to the CPU module. Project window [Parameter] [Remote Password] Item Description Setting range Up to four Password Setting...
Page 168 One-byte alphanumeric and special characters can be used for remote password entry. (Case-sensitive) To enable the remote password for the port for which the open system is set to "MELSOFT Connection" in PLC Parameter, select the following checkbox. When Protocol is set to "TCP" "MELSOFT Transmission Port (TCP/IP)".
Page 169: Precautions
CHAPTER 10 REMOTE PASSWORD 10.3 Precautions (1) When a remote password is set for UDP connections • Determine a target device before data communication. (The communication target needs to be determined because, after unlocking of the remote password, communication is available with any other devices.) •...
Page 170 (4) Operation performed when CPU modules are set as relay stations The following shows the accessibility when CPU modules are set as relay stations in the MELSOFT connection extended setting. Programming tool Ethernet Ethernet module module module module Enable/ Disable Remote password Ethernet check...
Page 171: Detection Of Unauthorized Access And Actions
CHAPTER 10 REMOTE PASSWORD 10.4 Detection of Unauthorized Access and Actions When the remote password mismatch count reaches the upper limit in unlock processing, "REMOTE PASS FAIL" (error code: 2700) is detected. If this occurs, unauthorized access from the outside of the system can be considered as a cause of the error. Take the following actions as needed.
Page 172: Chapter 11 Ip Address Change Function
CHAPTER 11 IP ADDRESS CHANGE FUNCTION Note 11.1 The IP address of a built-in Ethernet port can be changed without changing the built-in Ethernet port settings of PLC parameters, by storing the values in special relays and special registers. 2) Store the IP address of the special register (SD) to the IP address storage area (flash ROM) by turning the special relay (SM) on.
Page 173: Ip Address Of The Built-In Ethernet Port
CHAPTER 11 IP ADDRESS CHANGE FUNCTION 11.1 IP Address of the Built-in Ethernet Port For IP address of the built-in Ethernet port, a value of the built-in Ethernet port setting of the PLC Parameter is set at the initial processing of the CPU module. When this function is used, the value stored in the IP address storage area (flash ROM) will be set to the IP address of the built-in Ethernet port which is set during the initial processing of the CPU module, instead of the value set in the parameter.
Page 174: How To Use The Function
11.2 How to Use the Function 11.2.1 Write operation This operation can be performed by storing the IP address to be changed in SD1292 to SD1297 and turning off and on SM1292 (IP address storage area write request). (1) Operating procedure The following shows the write operation flow.
Page 175 CHAPTER 11 IP ADDRESS CHANGE FUNCTION (2) Operations of special relay and special register The following shows the operations of special relay and special register during the operation of writing to the IP address storage area (flash ROM). (a) Operations of special relay and special register during the operation of writing to the IP address storage area (flash ROM) Write start Write complete...
Page 176 (4) Program example The following shows a program example of writing to the IP address storage area (flash ROM). (a) Devices used in programs Device number Application Device number Application M100 Write Instruction SM1293 IP address storage area write complete IP address to be changed SM1294 IP address storage area write error...
Page 177: Clear Operation
CHAPTER 11 IP ADDRESS CHANGE FUNCTION 11.2.2 Clear operation This operation can be performed by turning off and on SM1295 (IP address storage area clear request). (1) Operating procedure The following shows the clear operation flow. Turn off and then on the IP address storage area clear request (SM1295).
Page 178 (2) Operations of special relay and special register The following shows the operations of special relay and special register during the operation of clearing the IP address storage area (flash ROM). (a) Operations of special relay and special register during the operation of clearing the IP address storage area (flash ROM) Clear start Clear complete...
Page 179 CHAPTER 11 IP ADDRESS CHANGE FUNCTION (4) Program example The following shows a program example of clearing the IP address storage area (flash ROM). (a) Devices used in programs Device number Application Device number Application M200 Clear instruction M201 Normal clear completion indication SM1295 IP address storage area clear request M202...
Page 180: Checking The Ip Address
11.3 Checking the IP Address (1) Checking using the Ethernet diagnostics The IP address of the built-in Ethernet port can be checked with the Ethernet diagnostics. For details of the Ethernet diagnostics, refer to the following. GX Works2 Version 1 Operating Manual (Common) (2) Confirmation using the special register The IP address of the built-in Ethernet port can be checked with the special register.
Page 181 CHAPTER 11 IP ADDRESS CHANGE FUNCTION (4) Functions that cannot be performed during write processing and clear processing The following functions cannot be executed during the write or clear processing to the IP address storage area. Do not execute the functions before the processing is completed. Doing so may cause an error. If operation of writing to or clearing the IP address storage area (flash ROM) is executed during the execution of the following functions, the write or clear operation is processed as an error.
Page 182: Chapter 12 Ip Packet Transfer Function
CHAPTER 12 IP PACKET TRANSFER FUNCTION Note 12.1 Communications can be performed with a device which supports the following IP addresses, which have been specified via a CC-Link IE Controller Network module or CC-Link IE Field Network module, using a protocol such as the FTP or HTTP via a built-in Ethernet port from an Ethernet device such as a personal computer.
Page 183 CHAPTER 12 IP PACKET TRANSFER FUNCTION (1) How to use For the settings of IP packet transfer function or how to use the function, refer to the following. Manual for the CC-link IE Controller Network module used Manual for the CC-link IE Field Network module used (2) Precautions •...
Page 184: Chapter 13 Reading/Writing Device Data Of Another Station Cpu By Ip Address Specification
CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION Note 13.1 Dedicated instructions allow the CPU module on the host station to read/write device data from/to the CPU module on another station.Note 13.1 CPU module CPU module IP address setting IP address setting on the host station...
Page 185 CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION (2) Applicable devices The following table lists the devices whose data can be read from and written to a target CPU module using the SP.READ/SP.WRITE instructions: Category Type Device name Requirements for configuration...
Page 186 (4) When executing multiple SP.READ/SP.WRITE instructions simultaneously When executing multiple SP.READ/SP.WRITE instructions simultaneously, ensure that SP.READ/SP.WRITE instruction channels are not duplicated. If multiple SP.READ or SP.WRITE instructions are set to the same channel, then cannot be executed simultaneously. If the same channel is shared by multiple SP.READ or SP.WRITE instructions, those SP.READ/SP.WRITE instructions must be executed sequentially (one after another), rather than simultaneously.
Page 187: Specification
CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION 13.1.1 Reading device data (SP.READ) Command SP.READ SP.READ " " Internal device J\ Constant Indirect Setting data R, ZR U\G Other specification string Word Word *1*2 Local devices and the file registers set for individual programs cannot be used. Word devices T, C, D, W, ST, SD, and SW can be specified.
Page 188 (2) Control data Device Item Description Setting range Set by b15 b14 b9 b8 b7 b6 b1 b0 S1 +0 [2] [1] [1] Error completion type Specifies whether or not clock data setting is required 8001 Instruction upon error completion. 8081 execution User...
Page 189 CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION Device Item Description Setting range Set by Stores the enable/disable state of the data for +12 to +17. Clock set flag System 0: Disable 1: Enable Stores the clock data upon error completion. This data is stored only when +0 is configured to set the error completion type to "1: Clock data setting is required."...
Page 190 The following are the timing charts for the SP.READ instruction: • When completed normally READ Sequence program Read command Completion device CPU module (Device specified in D2 ) on the host station 1 scan Completion status indication device (Device of D2 +1) Read data storage device (Device specified in D1 ) Sequence program...
Page 191 CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION (4) Error (a) An operation error occurs, the error flag (SM0) turns on, and the error code is stored in SD0 in the following cases: • The instruction is executed on an unsupported QnUDVCPU. (Error code: 4002) •...
Page 192 (5) Sample program This sample program reads data from devices D10 to D14 of the CPU module on another station identified by an IP address of 192.168.20.4 and stores the data in devices D200 to D204 of the CPU module on the host station. Setting control data for the SP.READ instruction Executing the SP.READ instruction...
Page 193: Writing Device Data (Sp.write)
CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION 13.1.2 Writing device data (SP.WRITE) Command SP.WRITE SP.WRITE " " Internal device J\ Indirect Constant Setting data R, ZR U\G Other specification string Word Word *1*2 Local devices and the file registers set for individual programs cannot be used. Word devices T, C, D, W, ST, SD, and SW can be specified.
Page 194 (2) Control data Device Item Description Setting range Set by b15 b14 b9 b8 b7 b6 b1 b0 [3] [2] [1] Execution type No arrival confirmation The instruction completes as soon as it sends data from the host station's CPU module. Completed 8000 Execution...
Page 195 CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION Device Item Description Setting range Set by Specifies the monitoring If the arrival monitoring time time allowed before the setting is set to 1s with completion of the 1 to 16383 processing.
Page 196 (3) Function This function writes the data to the specified device of the CPU module on another station specified with the IP address setting in the control data. When the function finished writing the device data, the completion device specified with turns on.
Page 197 CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION The following are the timing charts for the SP.WRITE instruction: • When completed normally WRITE Sequence program Write command Completion device CPU module (Device specified in D2 ) on the host station Completion status 1 scan...
Page 198 (4) Error (a) An operation error occurs, the error flag (SM0) turns on, and the error code is stored in SD0 in the following cases: • The instruction is executed on an unsupported QnUDVCPU. (Error code: 4002) • The number of devices is incorrect. (Error code: 4003) •...
Page 199 CHAPTER 13 READING/WRITING DEVICE DATA OF ANOTHER STATION CPU BY IP ADDRESS SPECIFICATION (5) Sample program This sample program writes the data stored in devices D50 to D53 of the CPU module on the host station to the devices D300 to D303 of the CPU module identified by an IP address of 192.168.20.4. Setting control data for the SP.WRITE instruction Storing write data in D50 to D53...
Page 200: Appendices
APPENDICES Appendix 1 Operation Processing Time for Each Instruction The following table lists the processing time of instructions described in this manual. For details on the processing time, refer to the following. MELSEC-Q/L Programming Manual (Common Instruction) Processing time(µs) Type Instruction Condition QnUDVCPU...
Page 201 APPENDICES Processing time(µs) Type Instruction Condition QnUDVCPU QnUDE(H)CPU Minimum Maximum Minimum Maximum Instruction for the predefined SP.ECPRTCL 15.900 50.300 protocol function Number of processing points = 1 word 43.10 48.60 SP.READ Device Number of processing points = 960 words 43.10 48.60 read/write Number of processing points = 1 word...
Page 202: Appendix 2 Port Numbers Used By Built-In Ethernet Port Qcpu
Appendix 2 Port Numbers Used by Built-in Ethernet Port QCPU Do not specify the following port numbers, because these numbers are used by the system. Port number Application For future extension 1388 (5000) (For Ethernet modules, this port number is used for "Auto Open UDP Port".) 1389 (5001) MELSOFT communication port (UDP/IP)
Page 203: Appendix 3 Added And Changed Functions
APPENDICES Appendix 3 Added and Changed Functions The following table lists added or modified functions in the CPU module and programming tool for built-in Ethernet port communications and the corresponding serial numbers of CPU modules and software versions of GX Works2 software.
Page 204: Appendix 4 Specifications Comparison With Ethernet Module
Appendix 4 Specifications Comparison with Ethernet Module (1) Specifications comparison with the Ethernet module The following table lists the comparison of specifications between the Built-in Ethernet port QCPU and the Ethernet module (QJ71E71-100). : Available, : Available but partially restricted, × : Not available Availability Built-in Item...
Page 205 APPENDICES Availability Built-in Item Description Ethernet port QJ71E71-100 QCPU Checks the connection status of an external device by sending a Ping message (ICMP Echo) to an external Check with Ping ("Use the Ping") × device. Closes the corresponding connection if no Alive check function response message is received.
Page 206 Availability Built-in Item Description Ethernet port QJ71E71-100 QCPU Enables the Ethernet module to send/receive data to/from an external device by using the protocol for the external Data communications using the predefined protocol device. The external device side protocol can be easily selected, or created/edited from the Predefined Protocol Library of GX Works2.
Page 207 APPENDICES (2) Differences on MC protocol functions between the Built-in Ethernet port QCPU and Ethernet module Consequence of a Built-in Ethernet port Item QJ71E71-100 communication with the Action QCPU Built-in Ethernet port QCPU Data sending method is Perform the Data sending method on TCP when the Data sending method is selectable.
Page 208 (3) Differences between the socket communication and the nonprocedural communication using a fixed buffer of the Ethernet module Consequence of a Built-in Ethernet port communication with Item QJ71E71-100 Action QCPU the Built-in Ethernet port QCPU ZP.OPEN SP.SOCOPEN ZP.CLOSE SP.SOCCLOSE Instruction name ZP.BUFRCV SP.SOCRCV Replace the instruction name.
Page 209 APPENDICES Memo...
Page 210: Index
INDEX ......88 ......164 Active open Lock processing .
Page 211 ........23 ....130 TCP fixed-length receive mode .
Page 212: Instruction Index
INSTRUCTION INDEX ......117 S.SOCRCVS ......133 S(P).SOCRDATA .
Page 213 Memo...
Page 214: Revisions
REVISIONS *The manual number is given on the bottom left of the back cover. Print date *Manual number Revision December 2008 SH(NA)-080811ENG-A First edition March 2009 SH(NA)-080811ENG-B Revisions involving function addition to the Built-in Ethernet port QCPU (support for the serial number (first five digits) of "11012"...
Page 215 Overall revision due to addition of the Universal model QCPU and the changed manual February 2013 SH(NA)-080811ENG-I layout Model addition Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU Revision on the new functions of the Universal model QCPU with a serial number (first 5 September 2013 SH(NA)-080811ENG-J digits) of "15043" or later Correction Section 5.2.2, 8.1, 8.2, 8.4.1, Appendix 3...
Page 216 This manual confers no industrial property rights or any rights of any other kind, nor does it confer any patent licenses. Mitsubishi Electric Corporation cannot be held responsible for any problems involving industrial property rights which may occur as a result of using the contents noted in this manual.
Page 217: Warranty
WARRANTY Please confirm the following product warranty details before using this product. 1. Gratis Warranty Term and Gratis Warranty Range If any faults or defects (hereinafter "Failure") found to be the responsibility of Mitsubishi occurs during use of the product within the gratis warranty term, the product shall be repaired at no cost via the sales representative or Mitsubishi Service Company.
Page 218 Ethernet is a registered trademark of Fuji Xerox Co., Ltd. in Japan. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The company names, system names and product names mentioned in this manual are either registered trademarks or trademarks of their respective companies.
Page 220 SH(NA)-080811ENG-T(1708)MEE MODEL: QNUDEHCPU-U-ET-E MODEL CODE: 13JZ29 HEAD OFFICE : TOKYO BUILDING, 2-7-3 MARUNOUCHI, CHIYODA-KU, TOKYO 100-8310, JAPAN NAGOYA WORKS : 1-14 , YADA-MINAMI 5-CHOME , HIGASHI-KU, NAGOYA , JAPAN When exported from Japan, this manual does not require application to the Ministry of Economy, Trade and Industry for service transaction permission.

This manual is also suitable for:

Q03udecpu Q04udvcpu Q04udehcpu Q06udvcpu Q06udehcpu Q10udehcpu ... Show all

Mitsubishi Electric Q03UDVCPU User Manual

Chapter 1 Overview

Chapter 2 Communication Specifications

Chapter 3 Connection of Programming Tools and Got

Chapter 4 Direct Connection to Programming Tool

Chapter 5 MC Protocol Communication

Chapter 6 Data Communications Using the Predefined Protocol

Chapter 7 Socket Communication Function

Chapter 8 Time Setting Function (Sntp Client)

Chapter 9 File Transfer Function (Ftp)

Chapter 10 Remote Password

Chapter 11 Ip Address Change Function

Chapter 12 Ip Packet Transfer Function

Chapter 13 Reading/Writing Device Data of Another Station Cpu by Ip Address Specification

Appendix 1 Operation Processing Time for each Instruction

Appendix 2 Port Numbers Used by Built-In Ethernet Port QCPU

Appendix 3 Added and Changed Functions

Appendix 4 Specifications Comparison with Ethernet Module

Quick Links

Related Manuals for Mitsubishi Electric Q03UDVCPU

Summary of Contents for Mitsubishi Electric Q03UDVCPU

This manual is also suitable for:

Table of Contents