The Unity (UMAS) protocol (Part V)

This is the fourth article of a series of entries in this blog about the Unity protocol, used by Schneider Electric devices for configuration purposes.

INDEX

Part I. Introduction, initialization phase, functions codes used in the initialization phase

Part II. Function codes used to read and write memory values from/to memory

Part III. Function codes used to deal with logic programs, and work with the PLC

Part IV. Other extra function codes

Part V. Modicon Premium PLCs specific function codes

In this part we'll talk about specific function codes for Schneider Electric's Modicon Premium PLCs.

---

Only for Schneider Premium Modicon PLCs there are a number of function codes. For instance:

Read IO Object (“01 70”) and Read IO Module ("01 73")

These function codes allow Unity to read the Discrete Premium I/O Modules (More information on them in this link. These modules can be read normally, for status or when an error occurs in the module.

Normal requests

To be able to read an IO module, first you need to put it in "read status". To do that a "01 73" request need to be sent. This is the structure of that request:

• NMOD is generally 4 or 8, depending on the size of the IO Module. If NMOD is 4, next 2 WORDs (4 bytes) indicate which module we are referring. If NMOD is 8, next 4 Words (8 bytes) indicate the IO Module number & Offset. Therefore the NMOD field is kind of a length field for the IO Module Offset.
• WORD 0, WORD 1, WORD 2, WORD 3. Indicate the Premium IO Module number & Offset.

Response

In the response the first byte can be value from 0 to 4. The last two bits in this byte have this meaning:

• Last bit: Module Present (True/False)
• 7th bit: Module configured (True/False)

Next 4 bytes received store the Module Identity, and next 4 bytes are useless.

9th byte indicates the module version, and 10th byte indicates LEDs states.

Read IO Object

An IO Object is a value inside an IO Module. Function Code 0x70 allows Unity to read IO Module Objects. To be able to read these object, first, the module need to be set as "read". To do that a 0x73 request like the previously seen need to be sent prior to sending a 0x70 request.

An IO Object can be read normally, for status or for an module in error. The normal request structure is the following:

In this request the field in blue is the "Channel" and the second Word of the orange field is the "IO Object". A FF value means "all".

When the request is done to read the IO Object status, the request is the following:

Green field can have the values:

• 01 10: When a channel exchange for an IO Object is requested.
• 01 40: When an IO Object is read "For explicit".

And finally when the request is for a module in error the request is the following:

Response

The response for a 0x70 request indicate the input Number, Output Number, State and Structure of the module. If the request was made "For status" only the status of the module is returned.

Write IO Object (“01 71”)

The structure of a IO Object write request is the following:

---

Read Ethernet Master Data(“01 39”)

Clients running Unity can access or download applications to devices on distributed control systems. The ethernet Master Data is the network configuration information for distributed control systems. It can be read, in Schneider Modicon premium device with request "01 39".

The "Read Ethernet Master Data" request has the following structure:

Response

• First six bytes of the response have an unknown meaning.
• Seventh byte is 0x22 (unless an error in device).
• Next 4 bytes are the 4 bytes of the device's IP Address.
• Next 4 bytes are the 4 bytes of the device's Network Mask.
• Next 4 bytes are the 4 bytes of the device's default gateway.

In the next entry the last function codes found of this protocol will be explained.