Explicit Messaging


Thread Starter

Kris Philpott

I am trying to read parameters into a PLC from a VFD (such as current, output frequency...) using explicit messaging. I want to be able to display the parameters of a drive, using an HMI.

Does anyone have experience doing this?


Ahhh.... A kindred spirit :->

What brand of VFD? I can tell you all about *reading* data with an S2K series GE Fanuc drive. Not a thing about writing tho... ;-<

You need to have a copy of your drives DeviceNet Object Model. For example. If I was to read an integer variable from the S2K, I would need
to know that:

Integer Variables are object number 0x66
The 'Get' Service Code is 0x0E
All get/set operations use attribute 1
All get/set operations use the object instance for the variable number
The drive is at DeviceNet address 2

I would then fill in my DeviceNet packet as follows

The header of a DeviceNet packet looks like:

TXID | command
port | Size
service | MAC ID

So: The first word is 0x0101. Id is 0x01, and the command (execute block) is 0x01
Word #2 is 0x0006 port is 0x00 (always), and size is 6 bytes. This is the size of the message not including the header...
Word #3 is 0x0E02 Service code 0x0E, and Mac ID is 02

Next, we need to set the message data. According to pub 1747-5.8 July 1997, p24. The first 6 bytes (3 words) of the message are:

Class (aka Object number)
Attribute (optional)

each word is 2 bytes, which is how we got the message size of 6. Per my table above, the Object number is 66, The instance in this case will be 01, so we get the data in the first integer variable, and the Attribute is 1 (always a 1 for this model of drive).


Our final data block is (in Hex):


Once you build this up in, say, an Integer file, you need to copy it into the M0 file for that slot. Starting at word 224. Since my DeviceNet
scanner is in slot 3, I use:

COP #N7:0 #M0:3.224 15

The length (15) is whatever works in your situation. Make sure you dont go higher than 31, or you will run past the end of the M0 file (255).

After you send this, you need to copy the response out of the M1 file.....

COP #M1:3.224 #N7:50 31

Then, by examining your data at N7:50, you can get your info. The reply block consists of:

TXID | Status
Port | size
Service | MAC ID


The first word should be : 0101

This indicates that it is a reply to the block ID you sent (01) and the Status is success (01)
Next is : 0004 port 0 (always) , length of 4 bytes
Next, I get 8E02, service code 8E, Mac ID 02 (My drive)

Finally, 4 bytes of data : 9400 7735

which, in bytes, is 94 00 77 35

Arranged in proper order, is:

77 35 94 00

Which is hex for a value of 2 000 000 000. This I can verify by querying the drive thru the serial port.

Once this is complete, you need to erase this transaction response from the module. I am still working on that one, although sending a msge with TXID = 01 and Command set to 03 will reset the comms, which seems to work.

If you get something working for writing data, let me know, as that is what I am still struggling with.


--Joe Jansen