Page 1 MELSEC-L CPU Module User's Manual (Built-In Ethernet Function) -L02CPU -L02CPU-P -L06CPU -L06CPU-P -L26CPU -L26CPU-P -L26CPU-BT -L26CPU-PBT...
Page 3: Safety Precautions
SAFETY PRECAUTIONS (Read these precautions before using this product.) Before using this product, please read this manual and the relevant manuals carefully and pay full attention to safety to handle the product correctly. In this manual, the safety precautions are classified into two levels: " WARNING"...
Page 4 [Design Precautions] WARNING ● Configure safety circuits external to the programmable controller to ensure that the entire system operates safely even when a fault occurs in the external power supply or the programmable controller. Failure to do so may result in an accident due to an incorrect output or malfunction. (1) Emergency stop circuits, protection circuits, and protective interlock circuits for conflicting operations (such as forward/reverse rotations or upper/lower limit positioning) must be configured external to the programmable controller.
Page 5 [Design Precautions] WARNING ● When changing data from a peripheral device connected to the CPU module during operation, configure an interlock circuit in the program to ensure that the entire system will always operate safely. For other forms of control (such as program modification or operating status change) of a running programmable controller, read the relevant manuals carefully and ensure that the operation is safe before proceeding.
Page 6 [Installation Precautions] CAUTION ● Use the programmable controller in an environment that meets the general specifications in the MELSEC-L CPU Module User's Manual (Hardware Design, Maintenance and Inspection). Failure to do so may result in electric shock, fire, malfunction, or damage to or deterioration of the product. ●...
Page 7 Always ground the FG and LG terminals to the protective ground conductor. Failure to do so may cause malfunction. ● Mitsubishi programmable controllers must be installed in control panels. Connect the main power supply to the power supply module in the control panel through a relay terminal block.
Page 8 [Startup and Maintenance Precautions] CAUTION ● Before performing online operations (especially, program modification, forced output, and operating status change) for the running CPU module from the peripheral connected, read relevant manuals carefully and ensure the safety. Improper operation may damage machines or cause accidents. ●...
Page 9: Conditions Of Use For The Product
PRODUCT in one or more of the Prohibited Applications, provided that the usage of the PRODUCT is limited only for the specific applications agreed to by Mitsubishi and provided further that no special quality assurance or fail-safe, redundant or other safety features which exceed the general specifications of the PRODUCTs are required.
Page 10: Introduction
INTRODUCTION Thank you for purchasing the Mitsubishi MELSEC-L series programmable controllers. This manual describes the functions of the CPU module and programming necessary for Ethernet communication. Before using this product, please read this manual and the relevant manuals carefully and develop familiarity with the functions and performance of the MELSEC-L series programmable controller to handle the product correctly.
Page 11: Relevant Manuals
RELEVANT MANUALS (1) CPU module user's manual Manual name Description <manual number (model code)> Specifications of the CPU modules, power supply modules, display unit, MELSEC-L CPU Module User's Manual (Hardware Design, Maintenance and branch module, extension module, SD memory cards, and batteries, Inspection) information on how to establish a system, maintenance and inspection, <SH-080890ENG, 13JZ36>...
Page 12: Table Of Contents
CONTENTS CONTENTS SAFETY PRECAUTIONS ............. 1 CONDITIONS OF USE FOR THE PRODUCT .
Page 13 CHAPTER 7 SOCKET COMMUNICATION FUNCTION Communication Using TCP ........... 66 Communication Using UDP .
Page 14 11.3 Precautions............. . . 163 11.4 Detection of Unauthorized Access and Actions .
Page 15 INSTRUCTION INDEX REVISIONS ..............235 WARRANTY .
Page 16: Manual Page Organization
MANUAL PAGE ORGANIZATION In this manual, pages are organized and the symbols are used as shown below. The following illustration is for explanation purpose only, and should not be referred to as an actual documentation. "" is used for screen names and items. The chapter of the current page is shown.
Page 17 Pages describing instructions are organized as shown below. The following illustration is for explanation purpose only, and should not be referred to as an actual documentation. Instruction name Execution condition of the instruction Structure of the instruction in the ladder mode shows the devices applicable to the instruction Setting side...
Page 18 • Instructions can be executed under the following conditions. On the rising On the falling Execution condition Any time During on During off edge edge Symbol No symbol • The following devices can be used. Link direct Intelligent Internal device Index device Setting...
Page 19: Terms
Term Description Branch module The abbreviation for the MELSEC-L series branch module A generic term for the L02CPU, L02CPU-P, L06CPU, L06CPU-P, L26CPU, L26CPU-P, L26CPU-BT, and Built-in Ethernet port LCPU L26CPU-PBT CPU module The abbreviation for the MELSEC-L series CPU module...
Page 20: Chapter 1 Overview
CHAPTER 1 OVERVIEW The following describes the built-in Ethernet function of the CPU module. (1) Connection with programming tool and GOT ( Page 22, CHAPTER 3) • By using a hub, the CPU module can be connected to multiple programming tools and GOTs. Up to 16 external devices can be connected to a single CPU module at the same time.
Page 21 CHAPTER 1 OVERVIEW (8) File transfer function (FTP client) ( Page 139, CHAPTER 10) Each of the files stored in the CPU module can be read or written from the interfacing device with the FTP server function, and a large amount of data can be easily transferred. (9) Remote password ( Page 159, CHAPTER 11) Remote password setting can prevent unauthorized access from the outside and enhance the security of the...
Page 22: Chapter 2 Communication Specifications
CHAPTER 2 COMMUNICATION SPECIFICATIONS The following are the communication specifications of the built-in Ethernet port of the CPU module. Item Specifications Data transfer speed 100/10Mbps Communication mode Full-duplex or half-duplex Transmission method Base band Transmission Maximum distance between hub and 100m specifications node...
Page 23 CHAPTER 2 COMMUNICATION SPECIFICATIONS Remark TCP and UDP are defined as follows: ● TCP (Transmission Control Protocol) In communications among programmable controllers and networked devices, this protocol establishes a connection between port numbers of the two devices to perform reliable data communications. ●...
Page 24: Chapter 3 Connection With Programming Tool And Got
CHAPTER 3 CONNECTION WITH PROGRAMMING TOOL AND GOT This chapter describes how to connect the CPU module to a programming tool or GOT. CPU module CPU module Ethernet Programming Programming tool tool To start Ethernet communication, perform the following steps. Start Set PLC parameters using the programming tool.
Page 25: Setting Required For The Cpu Module
CHAPTER 3 CONNECTION WITH PROGRAMMING TOOL AND GOT Setting Required for the CPU Module (1) PLC parameter setting Select the "Built-in Ethernet Port Setting" tab and set the parameters. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] Set the IP address of the CPU module. Set MELSOFT connection.
Page 26 (2) Writing parameters to the CPU module From the "Write to PLC" window, write the parameters to the CPU module. [Online] [Write to PLC] After writing the parameters to the CPU module, power off and on or reset the CPU module to enable the parameters.
Page 27: Setting Required For The Programming Tool
CHAPTER 3 CONNECTION WITH PROGRAMMING TOOL AND GOT Setting Required for the Programming Tool Configure the settings in the "Transfer Setup" window. Connection Destination window [Connection1] Select "Ethernet Board" for "PC side I/F". In the "PC side IF Ethernet Board Setting" window, select a "TCP" or "UDP" protocol. Select the same protocol as the one set in the "Ethernet Conf."...
Page 28 Select "PLC Module" for "PLC side I/F". Enter the IP address or host name of the CPU module in the "PLC side I/F Detailed Setting of PLC   Module" window, as shown below. (For the host name, enter the name set in the Microsoft Windows hosts file.) Set "Other Station Setting".
Page 29: Searching Cpu Modules On The Network
CHAPTER 3 CONNECTION WITH PROGRAMMING TOOL AND GOT Searching CPU Modules on the Network In a configuration using a hub, clicking in the "PLC side I/F Detailed Setting of PLC Module" window will start searching for CPU modules connected to the hub where the programming tool is also connected, and display a list of them.
Page 30: Communication Via Routers
Communication via Routers From the built-in Ethernet port, access is available via routers on a network such as a corporate LAN. Router Corporate Factory Control room Personal computer CPU module The following functions do not support the communication via routers. ...
Page 31: Precautions
CHAPTER 3 CONNECTION WITH PROGRAMMING TOOL AND GOT Precautions (1) IP address duplication Check that the IP address is not duplicated when configuring a network or connecting a new device to a network. If the IP address is duplicated, a device may communicate with the wrong device. Check for the IP address duplication in the following ways.
Page 32 (5) MELSOFT connection over TCP or UDP For TCP or UDP communications with multiple MELSOFT devices, set the same number of connections as that of the connected MELSOFT devices in PLC parameter. CPU module Ethernet MELSOFT device MELSOFT device MELSOFT device Set the same number of protocols as that of MELSOFT devices.
Page 33: Chapter 4 Direct Connection To Programming Tool
CHAPTER 4 DIRECT CONNECTION TO PROGRAMMING TOOL (SIMPLE CONNECTION) CHAPTER 4 DIRECT CONNECTION TO PROGRAMMING TOOL (SIMPLE CONNECTION) The CPU module can be directly connected to the programming tool with an Ethernet cable, without using a hub (simple connection). For direct connection, the IP address and host name need not be specified in the connection target setting. (Simultaneous broadcast is used.) CPU module Ethernet cable...
Page 34: Setting Method
Setting Method Set the items on the "Transfer Setup" window. Connection Destination window [Connection1] Select "Ethernet Board" for "PC side I/F". Select "PLC Module" for "PLC side I/F". In the "PLC side IF Detailed Setting of PLC Module" window, select the Ethernet Port Direct Connection checkbox as shown below.
Page 35: Precautions
CHAPTER 4 DIRECT CONNECTION TO PROGRAMMING TOOL (SIMPLE CONNECTION) Precautions (1) Connection to LAN line When connecting the CPU module to a LAN line, do not set direct connection. Doing so will apply a load to the LAN line and adversely affect communications with other external devices. (2) Indirect connection •...
Page 36: Chapter 5 Mc Protocol Communication
CHAPTER 5 MC PROTOCOL COMMUNICATION The built-in Ethernet port allows MC protocol communication. Sending a Command from an External Device to the CPU Module From an external device such as a personal computer or HMI, device data of the CPU module can be read or written using MC protocol.
Page 37 CHAPTER 5 MC PROTOCOL COMMUNICATION Remark Access through routers is also available. When configuring the settings for it, set the subnet mask pattern and default router IP address. ( Page 28, Section 3.4)
Page 38: Setting Method
5.1.1 Setting Method Setting for communication using the MC protocol is described below. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] Select Binary or ASCII code as the communication data code used for MC protocol. Select the "Enable online change (FTP, MC Protocol)" checkbox to enable data to be written to the CPU module even in the RUN state.
Page 39 CHAPTER 5 MC PROTOCOL COMMUNICATION Set connections used for MC protocol communication. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] [Ethernet Conf.] or [Open Setting] button • For "Ethernet Conf.", drag and drop "SLMP Connection Module" from "Module List" to the left side on the window.
Page 40: Mc Protocol Commands
5.1.2 MC Protocol Commands (1) Command list The following commands are executable for MC protocol communication of the CPU module. : Available, : N/A CPU module status Number of Command Function Description processed (Subcommand) STOP Write Write points enabled disabled ASCII: 3584 In units 0401...
Page 41 ) after the character. For the L02CPU and L02CPU-P, devices of DX/DY400 or later number cannot be used. Use X/Y devices to access devices of X/Y400 or later. For the L06CPU, L06CPU-P, L26CPU, L26CPU-P, L26CPU-BT, and L26CPU-PBT, devices of DX/DY1000 or later number cannot be used. Use X/Y devices to access devices of X/Y1000 or later.
Page 42: Precautions
5.1.3 Precautions (1) Number of devices Only the external devices set in "Ethernet Conf." or "Open Setting" can be connected concurrently using MC protocol. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] [Ethernet Conf.] or [Open Setting] button (2) Data communication frame The QnA-compatible 3E frames only are applicable to CPU modules.
Page 43 CHAPTER 5 MC PROTOCOL COMMUNICATION (6) Receiving a response message The following shows an example of receive processing on the other device side. Communication processing on the other device side Request message, send processing Response message, receive processing Is TCP connection open? Received data within the time specified by the monitoring timer...
Page 44: Error Codes For Mc Protocol Communication
5.1.4 Error Codes for MC Protocol Communication When an error occurs during MC protocol communication, an error code is sent from the CPU module to the external device. The following table lists error codes, error descriptions, and actions to be taken. Error code Description Action...
Page 45: Sending A Command From The Cpu Module To An External Device
CHAPTER 5 MC PROTOCOL COMMUNICATION Sending a Command from the CPU Module to an External Device MC protocol messages (QnA-compatible 3E frame) can be sent from the CPU module to external devices on the Ethernet network. To send the messages, use the SLMP frame send instruction. External device CPU module Request message...
Page 46: Sending An Slmp Frame (Sp.slmpsnd)
5.2.1 Sending an SLMP frame (SP.SLMPSND) Command SP.SLMPSND SP.SLMPSND "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word                 ...
Page 47 CHAPTER 5 MC PROTOCOL COMMUNICATION (2) Control data Device Item Description Setting range Set by [1] Execution type • 0: Without arrival check (The instruction is regarded as completed when a request message is sent from the host station.) Execution/error •...
Page 48 Device Item Description Setting range Set by Request destination Fixed to 0000 0000 User multidrop station number The device becomes effective when the execution type specified by +0 is "1: With arrival check". ■Before instruction execution Specify the number of resends to be performed if the instruction is Number of 0 to 15 User/system...
Page 49 CHAPTER 5 MC PROTOCOL COMMUNICATION (3) Request frame Device Item Description Setting range Set by Request data Specify the data length from the monitoring timer to the request 1 to 2000 User length data. (In units of bytes) This timer sets the waiting time for the external device that received a request message to wait for the response after it issued a processing request to the access destination.
Page 50 (5) Function • This instruction sends the request frame in the device specified by and later to the external device specified by the external device IP address in the control data. When a response message is received from the external device, it is stored in the device specified by The following figures show the request data and the response data in normal/abnormal end.
Page 51 CHAPTER 5 MC PROTOCOL COMMUNICATION • The result of the SP.SLMPSND instruction can be checked with the completion device, +0 and • Completion device This device turns on at the END processing of the scan in which the SP.SLMPSND instruction is completed and turns off at the next END processing.
Page 52 (6) Error Each of the following events results in an operation error, and the error flag (SM0) turns on and an error code is stored in SD0. • An instruction is used in a CPU module with a serial number (first five digits) of "18111" or earlier. (Error code: 4002) •...
Page 53 CHAPTER 5 MC PROTOCOL COMMUNICATION (7) Precautions • Do not execute multiple SP.SLMPSND instructions concurrently. Multiple SP.SLMPSND instructions specifying the same channel cannot be used concurrently. • Specify the arrival monitoring time ( +11) of the control data and monitoring timer ( +1) of the request frame so that the arrival monitoring time ...
Page 54 (8) Program example When M4000 is turned on, this sample program sends "Batch read in word units (command: 0401 )" to the CPU module on another station for which the IP address has been set to 192.168.20.4, and reads the values in D100 to D101 (two words).
Page 55: Chapter 6 Data Communications Using The Predefined Protocol
CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL The predefined protocol function sends and receives packets predefined by using GX Works2, enabling easy communications with external devices (such as measuring instruments and bar code readers). Protocols can be either selected from the prepared predefined protocol library, or created and edited by users.
Page 56: Specifications
Specifications The following table lists the specifications. Item Description Up to 128 Number of protocols Protocol setting data Up to 256 Number of packets Up to 12288 bytes Packet area data size Available connection Connection No.1 to No.16 Protocol execution method SP.ECPRTCL instruction Communication data code Binary code...
Page 57: Setting Method
CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Setting Method The setting required for using the predefined protocol function is described below. Open the "Predefined Protocol Support Function" window. [Tool] [Predefined Protocol Support Function] [Built-in Ethernet] Create a new file. [File] [New] "Add"...
Page 58 Set the packet configuration. In the "Packet Setting" window, set the configuration of packets to be sent or received. "Protocol Setting" window" "Variable Unset" or "Element Unset"  Write the protocol setting data to the CPU module. In the "Writing Protocol Setting" window, specify the write-target drive in the CPU module and write the protocol setting data.
Page 59 CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Set the connection for connecting the predefined protocol. [PLC Parameter] [Built-in Ethernet Port Setting] [Open Setting] Item Description Protocol Select "TCP" or "UDP". Open System Select "Predefined Protocol". TCP Connection When "Protocol" is "TCP", select the connection method. ( Page 66, Section 7.1) Set the port number of the CPU module.
Page 60 When using the predefined protocol function, open setting in the Ethernet configuration window is not available. Do not select the "Set Open Setting in Ethernet Configuration Window" checkbox in "Built-in Ethernet Port Setting" tab. Create a program for starting data communications. In the case of Active open, create the program in which SP.SOCOPEN instruction is used to establish a connection.
Page 61 CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL (1) Start device to store the predefined protocol operation status In the open setting, set the start device where the predefined protocol operation status is to be stored. The following information is stored in the area of 19 words starting from the selected device. Start Device to Store Predefined Protocol Name...
Page 62: Setting Items Of Predefined Protocol Support Function
Setting Items of Predefined Protocol Support Function 6.3.1 Communication type There are three protocol communication types: "Send Only", "Receive Only", and "Send & Receive". For details on the protocol communication types, refer to the following. MELSEC-L Ethernet Interface Module User's Manual (Basic) 6.3.2 Packet elements set for "Packet Setting"...
Page 63: Predefined Protocol Function Instructions
CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Predefined Protocol Function Instructions The predefined protocol function instructions are provided for the CPU module to use the predefined protocol function. This section describes the predefined protocol function instructions. Instruction Description Reference Establishes a connection with the external device.
Page 64: Execution Conditions Of Predefined Protocol Function
Execution Conditions of Predefined Protocol Function The predefined protocol function can be executed when the protocol setting data is enabled and SM1354 (Predefined protocol ready) is on. The written protocol setting data will be enabled when • the CPU module is powered on or is reset, or •...
Page 65: Precautions
CHAPTER 6 DATA COMMUNICATIONS USING THE PREDEFINED PROTOCOL Precautions (1) Send/receive packet • When a message larger than 1460 bytes is sent from the external device using TCP, a packet may be divided. As a result, data may not be received as one message with the predefined protocol function. Keep the message less than 1460 bytes or use UDP.
Page 66: Chapter 7 Socket Communication Function
CHAPTER 7 SOCKET COMMUNICATION FUNCTION The socket communication function allows data communications with the devices on Ethernet by TCP or UDP using various dedicated instructions. Sending data SP.SOCSND instruction Socket communication receive area* Connection No.1 Program Connection No.2 SP.SOCRCV instruction Connection No.3 S.SOCRCVS instruction External device...
Page 67 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (1) Port numbers In socket communication, port numbers are used to identify respective communications and thereby multiple communications are available both on TCP and UDP. • For sending: Specify the port number of the CPU module from which data are sent, and the port number of the destination device.
Page 68: Communication Using Tcp
Communication Using TCP TCP (Transmission Control Protocol) establishes a connection to a device with a port number, and performs reliable data communications. To perform socket communication using TCP, confirm the following in advance. • IP address and port number of the target device •...
Page 69 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (2) Program example for Active open The following shows a communication flow of an Active open. Specify the port number of the external device waiting for Start TCP connection and open a connection by Active open. Open processing: SP.SOCOPEN instruction YES (Completed, or disconnected by the external device.)
Page 70 • For the "Open Setting" Item Description Protocol Open System Socket Communication TCP Connection Active Host Station Port No. 1000 (Setting range: 0001 to 1387 , 1392 to FFFE (1 to 4999, 5010 to 65534)) Destination IP Address 192.168.3.40 (Setting range: 0.0.0.1 to 223.255.255.254) 1000 (Setting range: 0001 to FFFE...
Page 71 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (b) Devices used in programs The following table lists the device numbers and applications used in the sample program. Device number Application M1000 Open direction D100 to D109 SP.SOCOPEN instruction control data M100 and M101 SP.SOCOPEN instruction completion device M1002 Normal open indication...
Page 72 (c) Sample program <<Fixed length mode setting>> Setting TCP receive mode to 1 Setting receive data size to 6 Changing TCP receive mode of Connection No.1 <<Connection No.1 open processing (Active)>> Setting Execution/completion type to 0 Connection No.1 open Normal completion Error completion <<Data sending>>...
Page 73 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (d) Precaution for Active open communication Configure an interlock circuit using the Open completion signal (SD1282) and Open request signal (SD1284) in the program. The following chart shows on/off timings of the Open completion signal and Open request signal. <When disconnected by the CPU module>...
Page 74 (3) Program example for Passive open The following shows a communication flow of a Passive open. Start Waiting for TCP connection in Passive open state. Send or receive? Send by the SP.SOCSND instruction, or receive by the SP.SOCRCV or S.SOCRCVS instruction. (a) Parameter setting The following parameters are set for the sample program.
Page 75 CHAPTER 7 SOCKET COMMUNICATION FUNCTION • For the "Open Setting" Item Description Protocol Open System Socket Communication TCP Connection Unpassive Host Station Port No. 1000 (Setting range: 0001 to 1387 , 1392 to FFFE (1 to 4999, 5010 to 65534)) Blank.
Page 76 (b) Devices used in programs The following table lists the device numbers and applications used in the sample program. Device number Application M3000 Send direction D3000 and D3001 SP.SOCSND instruction control data M300 and M301 SP.SOCSND instruction completion device Send data length and send data (6 bytes of 12 , 34 , 56 , 78...
Page 77 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (c) Sample program <<Fixed length mode setting>> Setting TCP receive mode to 1 Setting receive data size to 6 Changing TCP receive mode of Connection 1 <<Target checking>> Obtaining information of connected device <<Data sending>> Setting send data length Setting send data Sending data to Connection No.1...
Page 78 (d) Precaution for Passive open communication • Configure an interlock circuit using the Open completion signal (SD1282) and Open request signal (SD1284) in the program. The following chart shows on/off timings of the Open completion signal and Open request signal. TCP disconnection completed by the external device Open completion signal...
Page 79: Communication Using Udp
CHAPTER 7 SOCKET COMMUNICATION FUNCTION Communication Using UDP UDP (User Datagram Protocol) is a simple protocol that does not perform data sequencing and retransmission. To perform socket communication using UDP, confirm the following in advance. • IP address and port number of the target device •...
Page 80 (b) Devices used in programs The following table lists the device numbers and applications used in the sample program. Device number Application M3000 Send direction D3000 and D3001 SP.SOCSND instruction control data M300 and M301 SP.SOCSND instruction completion device Send data length and send data (6 bytes of 12 , 34 , 56 , 78...
Page 81 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (c) Sample program <<Target changing>> Setting target IP address Setting target port No. Changing setting of Connection No.1 <<Data sending>> Setting send data length Setting send data Sending data to Connection No.1 Normal completion Error completion <<Data receiving>>...
Page 82 (2) Simultaneous broadcast For simultaneous broadcast using UDP, set the parameters as follows. • Destination IP Address: FF.FF.FF.FF • Destination Port No.: FFFF CPU module (IP address: xx.xx.xx.xx, Subnet mask: 255.255.255.0) Ethernet Sending data from port No.A of the CPU module to each port No.N of all Port No.A External device 1 external devices.
Page 83 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (3) Precautions (a) Use of UDP Data may be lost, or may arrive out of order. Consider the application of TCP if any problem is expected. (b) Sending and receiving data Data sending process may be terminated even if the communication line between the CPU module and target device is not connected due to a reason such as cable disconnection.
Page 84 (i) Destination IP address of the message transferred by simultaneous broadcast Use a CPU module IP address of which all the bits corresponding to the host address are on. When the subnet musk pattern is specified, apply the pattern before using the above mentioned IP address. Example: CPU module IP address 168.
Page 85: Precautions For The Socket Communication Function
CHAPTER 7 SOCKET COMMUNICATION FUNCTION Precautions for the Socket Communication Function This section provides other precautions for the socket communication function. (1) Port number Host station port number, 0001 to 03FF , are assigned for reserved port numbers (WELL KNOWN PORT NUMBERS) and F000 to FFFE are for other communication functions.
Page 86 (6) Precautions for file access during communication The CPU module will perform file access processing prior to Ethernet communication processing. Because of this, processing of the socket communication function may be delayed if a file is accessed by FTP or a programming tool during the processing.
Page 87: Socket Communication Function Instructions
CHAPTER 7 SOCKET COMMUNICATION FUNCTION Socket Communication Function Instructions The socket communication function instructions are provided for the CPU module to use the socket communication function. This section describes the socket communication function instructions. The following is a list of the instructions. Instruction Description Reference...
Page 88: Establishing A Connection (Sp.socopen)
7.4.1 Establishing a connection (SP.SOCOPEN) Command SP.SOCOPEN SP.SOCOPEN "U0" Internal device J\ U\G Constant Setting data R, ZR Others  K, H Word Word              (Except   ...
Page 89 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (2) Control data Device Item Description Setting range Set by Specify which settings are used to open a connection, parameter settings configured by a programming tool or control data settings +2 to 0000 Execution/completion 0000 : Connection is opened according to the User type...
Page 90 The "Set by" column indicates the following. User: The data must be set before executing the SP.SOCOPEN instruction. System: The CPU module stores the execution result of the SP.SOCOPEN instruction. For the Unpassive open, the IP address and port number of the target device are ignored. Because host station port numbers, 0001 to 03FF , are assigned for generally reserved port numbers (WELL KNOWN...
Page 91 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (3) Function This instruction opens a connection specified in The set values used for the open processing is selected in The result of the SP.SOCOPEN instruction can be checked with the completion device, +0 and •...
Page 92 (5) Program examples (a) Opening a connection using parameter settings When M1000 is turned on, connection No.1 is opened using the parameters set in "Ethernet Conf." or "Open Setting" of PLC parameter. • Devices used Device number Application SD1282 Open completion signal SD1284 Open request signal SD1288...
Page 93 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (b) Opening a connection using control data settings When M1000 is turned on, connection No.1 is opened using control data. • Devices used Device number Application SD1282 Open completion signal SD1284 Open request signal SD1288 Connection state signal D100 SP.SOCOPEN instruction control data...
Page 94: Disconnecting A Connection (Sp.socclose)
7.4.2 Disconnecting a connection (SP.SOCCLOSE) Command SP.SOCCLOSE SP.SOCCLOSE "U0" Internal device J\ Constan Setting data R, ZR U\G Others Word Word K, H              (Except    ...
Page 95 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (3) Function This instruction closes a connection specified in . (Disconnection of a connection) The result of the SP.SOCCLOSE instruction can be checked with the completion device, +0 and • Completion device This device turns on during END processing of the scan where the SP.SOCCLOSE instruction completes, and turns off during the next END processing.
Page 96 (5) Program example When M1000 is turned on, connection No.1 is opened using the parameters set in "Ethernet Conf." or "Open Setting" of PLC parameter. • Devices used Device number Application SD1282 Open completion signal SD1284 Open request signal D200 SP.SOCCLOSE instruction control data M200 SP.SOCCLOSE instruction completion device...
Page 97: Reading Out Received Data In The End Processing (Sp.socrcv)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.3 Reading out received data in the END processing (SP.SOCRCV) Command SP.SOCRCV SP.SOCRCV "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word        ...
Page 98 (2) Control data Device Item Description Setting range Set by    System area Completion status is stored Completion 0000 : Completed normally  status Other than 0000 : Failed (Error code) The length of the data which were read out from Receive data System the Socket communication receive data area is...
Page 99 CHAPTER 7 SOCKET COMMUNICATION FUNCTION The following figure shows the timing of reception processing with the SP.SOCRCV instruction. Data Open Data read transmission processing processing processing Open completion signal (SD1282, n) processing processing processing Sequence program Reception status signal (SD1286, n) SP.SOCRCV instruction execution SP.SOCRCV instruction...
Page 100 (4) Error A detection of an operation error turns on the Error flag (SM0) and a corresponding error code is stored in SD0 when: • The connection number specified for is other than 1 to 16. (Error code: 4101) • The received data size exceeds the size of the receive data storage device. (Error code: 4101) •...
Page 101: Reading Out Received Data During Instruction Execution (S.socrcvs)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.4 Reading out received data during instruction execution (S.SOCRCVS) Command S.SOCRCVS S.SOCRCVS "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word         ...
Page 102 (3) Function This instruction reads out received data of the connection specified in from the Socket communication receive data area. CPU module Receive data D +0 length Socket communication Receive data D +1 receive data area D +2 Receive data Connection External device No.
Page 103 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (4) Error A detection of an operation error turns on the Error flag (SM0) and a corresponding error code is stored in SD0 when: • The connection number specified for is other than 1 to 16. (Error code: 4101) •...
Page 104: Sending Data (Sp.socsnd)
7.4.5 Sending data (SP.SOCSND) Command SP.SOCSND SP.SOCSND "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word                   ...
Page 105 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (2) Control data Device Item Description Setting range Set by System area    Completion status is stored Completion 0000 : Completed normally  System status Other than 0000 : Failed (Error code) Send data length The length of send data is specified (in bytes).
Page 106 The following figure shows the timing of reception processing with the SP.SOCRCV instruction. <Transmission control method> Data Open transmission processing processing Open completion signal (SD1282, n) processing processing processing Sequence program SP.SOCSND instruction execution SP.SOCSND instruction 1 scan Completion device Abnormal termination Completion D +1...
Page 107 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (5) Program example When M3000 is turned on, data (1234, 5678, and 8901) are sent to the target device using the socket communication function. • Devices used Device number Application SD1282 Open completion signal D3000 SP.SOCSND instruction control data D300 Send data length and send data storage location...
Page 108: Reading Out Connection Information (Sp.soccinf)
7.4.6 Reading out connection information (SP.SOCCINF) Command SP.SOCCINF SP.SOCCINF "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word                 ...
Page 109 CHAPTER 7 SOCKET COMMUNICATION FUNCTION (2) Control data Device Item Description Setting range Set by System area    Completion status is stored Completion 0000 : Completed normally  status Other than 0000 : Failed (Error code) Target device IP IP address of the target device is stored.
Page 110 (3) Function This instruction reads out connection information specified in (4) Error A detection of an operation error turns on the Error flag (SM0) and a corresponding error code is stored in SD0 when: • The connection number specified for is other than 1 to 16.
Page 111: Changing The Target Of A Connection (Udp/Ip) (Sp.soccset)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.7 Changing the target of a connection (UDP/IP) (SP.SOCCSET) Command SP.SOCCSET SP.SOCCSET "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word         ...
Page 112 (3) Function This instruction changes the IP address and port number of the target device of the connection specified in (Note that this instruction is available only for UDP/IP communications.) ● The target device can be changed without closing the connection by using the SP.SOCCSET instruction. ●...
Page 113: Changing The Receive Mode Of A Connection (Sp.socrmode)
CHAPTER 7 SOCKET COMMUNICATION FUNCTION 7.4.8 Changing the receive mode of a connection (SP.SOCRMODE) Command SP.SOCRMODE SP.SOCRMODE "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word         ...
Page 114 (a) TCP standard receive mode When data are received, they are stored in the Socket communication receive data area, and SD1286 turns on. If data are received exceeding the specified receive data size, the excess data are read out the next time. The receive data size is set to 300 bytes, and 500-byte data are received.
Page 115 CHAPTER 7 SOCKET COMMUNICATION FUNCTION Remark The set values will be enabled at the following timing of the SP.SOCRMODE instruction execution. • Before opening: Values will be enabled after opening a connection. • When there are data in the Socket communication receive data area: Values will be enabled after execution of the SP.SOCRCV or S.SOCRCVS instruction once after the S.SOCRMODE instruction.
Page 116: Socket Communication Receive Data Read (S(P).Socrdata)
7.4.9 Socket communication receive data read (S(P).SOCRDATA) Command S.SOCRDATA S.SOCRDATA "U0" SP.SOCRDATA SP.SOCRDATA "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word             ...
Page 117 CHAPTER 7 SOCKET COMMUNICATION FUNCTION ● Data of the receive data length can be read out by setting the number of read data to one word. This allows change of the device storing receive data, upon execution of the SP.SOCRCV or S.SOCRCVS instruction. ●...
Page 118: Chapter 8 Time Setting Function (Sntp Client)
CHAPTER 8 TIME SETTING FUNCTION (SNTP CLIENT) The CPU module collects time information from a time information server on LAN, and automatically sets its own time. With this time setting function, the CPU module queries the server for time information at the specified timing, and can set the time information sent from the server as its own clock data.
Page 119: Setting Method
CHAPTER 8 TIME SETTING FUNCTION (SNTP CLIENT) Setting Method Configure the time settings in the "Built-in Ethernet port" tab of PLC parameter. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] button Item Description Setting range SNTP Function Setting Select whether to use this function or not. Used or Not used 0.0.0.1 to SNTP Server IP Address...
Page 120: Precautions
Precautions (1) Communication timeout A communication timeout occurs when 20 seconds have elapsed without receiving any response after sending a time query. At the time of a communication timeout, the value in SD1270 is FFFF (2) Delay resulted from the time required for communication A delay occurs and affects the set time as a result of the time spent for communication with the SNTP server computer.
Page 121: Chapter 9 File Transfer Function (Ftp Server)
CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) The CPU module supports the server function for FTP (File Transfer Protocol) which is a protocol designed for file transfer to or from the connected device. The device with the FTP client function can directly access any files located in the CPU module.
Page 122: Setting For Ftp Communication
Setting for FTP Communication (1) Operation on the CPU module side Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] Set the IP address of the CPU module. Select "Enable online change (FTP, MC Protocol)" when data need to be written even while the CPU module is in RUN state.
Page 123 CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) (2) Operation on the connected device (FTP client) side The following describes the procedure and processing on the connected device side, which is required for using the FTP server function of the CPU module. Various FTP commands and how to enter each of them are also shown.
Page 124 (a) Logging in to the CPU module The following describes the operation flow from starting an FTP session until log-in to the CPU module.   Start up the FTP from the MS-DOS prompt of Microsoft Windows Start an FTP session. (FTP <ret>) Open a connection to the FTP server.
Page 125: Files That Can Be Transferred Using Ftp
CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) Files That Can Be Transferred Using FTP The following table lists the files that can be transferred using the file transfer function. : Available, : N/A Program Standard SD memory Standard File name and extension *2*3 memory card...
Page 126 The SP.FWRITE or SP.FREAD instruction in the program will write or read the file. For details, refer to the following. MELSEC-Q/L Programming Manual (Common Instruction) Files can be written to the program memory only when the CPU module is in the STOP state. Write destination is the program cache memory.
Page 127: Files That Can Be Deleted Using Ftp
CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) Files That Can Be Deleted Using FTP The following table lists the files that can be deleted using the file transfer function. : Deletable, : Not deletable in RUN state, : Not deletable, : Not writable Program Standard SD memory...
Page 128 The SP.FWRITE or SP.FREAD instruction in the program will write or read the file. For details, refer to the following. MELSEC-Q/L Programming Manual (Common Instruction) Files can be written to the program memory only when the CPU module is in the STOP state. Write destination is the program cache memory.
Page 129: Ftp Commands
CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) FTP Commands 9.4.1 List of FTP commands : Available, : N/A CPU module status Remote password Command Function STOP Write Write Unlocked Locked enabled disabled Notifies that the file will be transferred without conversion. ...
Page 130 (1) Subcommands usable with the "quote" command : Available, : N/A CPU module status Remote password Subcommand Function STOP Unlocked Locked Write Write enabled disabled change      Displays or changes the attribute of a file stored in the CPU module. ...
Page 131: How To Specify An Ftp Command
CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) 9.4.2 How to specify an FTP command This section describes how to specify a file with an FTP command on the FTP client (connected device), which is supported by the CPU module. (1) File specification A file can be specified for an FTP command on the FTP client side as follows: •...
Page 132: Details Of Ftp Commands
9.4.3 Details of FTP commands This section describes the FTP commands on the FTP client side supported by the CPU module, and the methods of using those commands. Note that some FTP commands may not function as described in this manual, depending on the FTP application used on the FTP client side.
Page 133 CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) Function Displays the names of the files stored in the CPU module. Specification ls [drive name:\] format Example When displaying the names of the files stored in the SD memory card: ls 2:\ Similar command Function...
Page 134 Function Stores the name of the file stored in the CPU module in the FTP client side file as log data. Specification mls "source drive name":\"destination file path name" format Example When storing the names of files stored in the SD memory card into the S990901F.LOG file: mls 2:\ S990901F.LOG •...
Page 135 CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) Function Displays the current directory of the CPU module. Specification format Note "\" is displayed as the execution result of the "pwd" command. Function Closes the connection with the FTP and quits the FTP. Specification quit quit...
Page 136 (2) CPU module dedicated subcommands The following table lists the CPU module dedicated subcommands that are added to the "quote" command and sent. Function Displays or changes the attribute of a file stored in the CPU module. Specification When displaying the file attribute: format 1 quote change"...
Page 137 CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) Function Locks the remote password set in the CPU module. Specification quote password-lock format The following is displayed as the execution result when the processing completes password-lock successfully. 200 Command 0key Example When locking the remote password: quote password-lock Use this command only when the FTP communication port is specified as a remote password check target.
Page 138 Function Transfers data in the program cache memory to the program memory. Specification quote pm-write format The following message is displayed as the execution result when the processing completes pm-write successfully. 200 Command successful Note Before writing data, set the CPU module to STOP. Function Sets, displays, or clears the read password (file password 32) registered in the file transfer target file.
Page 139: Precautions
CHAPTER 9 FILE TRANSFER FUNCTION (FTP SERVER) Precautions (1) FTP clients • Some FTP clients may have FTP command specifications different from those described in this manual. In such a case, check the functions and operation methods, referring to the manuals for the FTP client. ...
Page 140 (4) Writing files • An existing file cannot be overwritten. Delete or rename an existing file with the file delete command (delete, mdelete) or the file rename command (rename) before writing files. • A read-only file or a file locked by the function except for FTP cannot be written. If attempted, a write error occurs.
Page 141: Chapter 10 File Transfer Function (Ftp Client)
Sending a specified file An FTP server is required for using the file transfer function (FTP client). For details of servers, refer to server manuals. The FTP server of which the operation is ensured by Mitsubishi Electric Corporation are shown below. FTP server Compatible OS ...
Page 142: Transferrable Files
10.1 Transferrable Files The following table lists the files that can be transferred using the file transfer function. : Available, : N/A Program Standard Standard SD memory File name and memory card extension File type (Any name can be Drive 0 Drive 3 Drive 4 Drive 2...
Page 143: Setting Method
CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) 10.2 Setting Method 10.2.1 Parameter setting (1) Open setting Set the connection established with the FTP client. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] [Open Setting] Item Description Protocol Select "TCP". Open System Select "FTP Client".
Page 144 (2) FTP client setting Set FTP client parameters. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] [FTP Client Setting] Item Description Setting range Default Set the destination FTP server name 1 to 256 one-byte alphanumeric  FTP server name (domain name).
Page 145: Settings At Programming
CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) 10.2.2 Settings at programming This function executes the file transfer function using the following instructions. Instruction Description Reference SP.FTPPUT Sends the specified file to the FTP server. Page 146, Section 10.3.1 SP.FTPGET Obtains the specified file from the FTP server. Page 152, Section 10.3.2 (1) Wild card specification For an FTP command which can be used for multiple files, specify the file name and extension using a wild card...
Page 146 (3) File overwrite specification Specify the operation to be performed during file transfer if a file with the same name as one to be transferred exists in the transfer destination. Specify it in the argument of the file transfer function instruction. Specification item Description Do not overwrite...
Page 147 CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) Suppose "Take measures against power off" is specified and the same file as the transfer target file exists in the transfer destination. If the size of free space in the transfer destination is smaller than the size of the transfer file (temporary file), and error occurs even when "Overwrite all"...
Page 148: File Transfer Function Instruction
10.3 File Transfer Function Instruction 10.3.1 FTP client file transmission (SP.FTPPUT) Command SP.FTPPUT SP.FTPPUT "U0" Internal device J\ Constant Setting data R, ZR U\G Others Word Word              ...
Page 149 CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) (2) Control data Setting Device Item Description Set by range … [1] File overwrite setting Specify the operation to be performed if a file with the same name exists in the transfer destination. 0000 to 000A Execution type...
Page 150 (transfer file path) • In , specify the character string beginning from the drive No. (0, 2, 3, or 4) through to the file name including an extension. Use one-byte "\" or "/" for the delimiters of directory and file names. Up to 32 one- byte characters can be used in the specified string.
Page 151 CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) (transfer destination directory path) • In , specify the character string indicating the file transfer destination directory in the FTP server. (Any file name in the transfer destination cannot be specified.) • When using the FTP server function of the CPU module in place of the FTP server, specify the character string beginning from the drive number.
Page 152 • The SP.FTPPUT instruction runtime operation is as follows. Sequence scan Instruction execution SP.FTPPUT instruction Completion device Completed with an error Completion device File transfer FTP client connection status (SM1298) Total number of files to be processed (SD1256) Number of files processed (SD1257) (1) The total number of files to be processed is stored.
Page 153 CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) (5) Precautions • When executing the SP.FTPPUT instruction, turn on SM721 (file accessing flag) for interlocking. When SM721 is on, the SP.FTPPUT instruction performs no processing. • When executing the SP.FTPPUT instruction by specifying an SD memory card as the transfer source or transfer destination, turn on SM606 (SD memory card forced disable instruction) for interlocking.
Page 154: Ftp Client File Acquisition (Sp.ftpget)
10.3.2 FTP client file acquisition (SP.FTPGET) Command SP.FTPGET SP.FTPGET "U0" Internal device J\ Constant Setting data R, ZR U\G Others Word Word                   ...
Page 155 CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) (3) Function • The SP.FTPGET instruction gets the specified file from the FTP server to the CPU module. • The function connects to the FTP server specified by "FTP Client Setting", and gets the file specified by S2 S3 to the directory specified by .
Page 156 (transfer destination directory path) • In , specify the character string beginning from the drive No. (2 or 4) through to the transfer destination directory. (Any file name in the transfer destination cannot be specified.) • Use one-byte "\" or "/" for the delimiters of directory names. The delimiter at the end of string can be omitted. If the delimiter is omitted, "\"...
Page 157 CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) • The SP.FTPGET instruction runtime operation is as follows. Sequence scan Instruction execution SP.FTPGET instruction Completion device Completed with an error Completion device File transfer FTP client connection status (SM1298) Total number of files to be processed (SD1256) Number of files processed (SD1257)
Page 158 (5) Precautions • When executing the SP.FTPGET instruction, turn on SM721 (file accessing flag) for interlocking. When SM721 is on, the SP.FTPGET instruction performs no processing. • When executing the SP.FTPGET instruction by specifying an SD memory card as the transfer source or transfer destination, turn on SM606 (SD memory card forced disable instruction) for interlocking.
Page 159: Diagnostics
CHAPTER 10 FILE TRANSFER FUNCTION (FTP CLIENT) 10.4 Diagnostics The communication status of the simple PLC communication function can be checked in the "Status of Each Connection" tab in the "Ethernet Diagnostics" window. [Diagnostics] [Ethernet Diagnostics] For details on Ethernet diagnostics, refer to the following. GX Works2 Version 1 Operating Manual (Common) The connection number in which the states and errors of the connections used by this function are stored is the one with the smaller number of the two connections that are set in "FTP Client"...
Page 160: Precautions
10.5 Precautions This section provides precautions on using this function. (1) Precautions on the file transfer function (FTP client) (a) FTP server connection When a connection is set up with the FTP server, KeepAlive is used to verify the connection. An alive check message is sent five seconds after reception of the last message from the FTP server to check if the FTP server returns a response or not.
Page 161: Chapter 11 Remote Password
CHAPTER 11 REMOTE PASSWORD CHAPTER 11 REMOTE PASSWORD A remote password is checked when a connection is requested for the following. • Communication using a programming tool • Communication using MC protocol • File transfer (FTP) The remote password function is one of the preventive methods against unauthorized access (e.g. destruction of data and programs) from external devices.
Page 162: Communication Using Remote Password
11.1 Communication Using Remote Password Communication is performed in the order described below when a remote password is set for the CPU module. (1) Allowing access (unlock processing) On a communication device such as a personal computer, unlock the remote password set for the CPU module. If it is not unlocked, an error will occur on the connected device because the CPU module will prohibit any access.
Page 163: Remote Password Setting
CHAPTER 11 REMOTE PASSWORD 11.2 Remote Password Setting (1) Setting a remote password Set a remote password and a target connection in the programming tool, and write the data to the CPU module. Project window [Parameter] [Remote Password] Item Description Setting range Password Setting Up to four characters...
Page 164 (2) Writing to the CPU module Write the remote password to the CPU module from the "Write to PLC" window. [Online] [Write to PLC] After writing the parameters to the CPU module, power off and then on or reset the CPU module to enable the parameters.
Page 165: Precautions
CHAPTER 11 REMOTE PASSWORD 11.3 Precautions (1) When a remote password is set for UDP connections • Determine the external device to communicate with and exchange the data. (The communication target needs to be determined because, after unlocking of the remote password, communication is available with any other devices.) •...
Page 166: Detection Of Unauthorized Access And Actions
11.4 Detection of Unauthorized Access and Actions When the remote password mismatch count reaches the upper limit in unlock processing, "REMOTE PASS FAIL" (error code: 2700) is detected. If this occurs, unauthorized access from the outside of the system can be considered as a cause of the error.
Page 167: Chapter 12 Simple Plc Communication Function
CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION Remark When using the simple PLC communication function, check the versions of the CPU module and GX Works2. ( Page 222, Appendix 3) This function allows data communications between specified devices at the specified timing just by doing simple settings from a programming tool.
Page 168: Setting Method
12.1 Setting Method To use this function, configure the settings in "Simple PLC Communication Setting". Up to 64 devices can be set in "Simple PLC Communication Setting". Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] [Base Setting] [Extended Setting] Simple PLC Communication Setting consists of Base Setting (essential) and Extended Setting (optional).
Page 169 CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION (1) Communication Pattern Select the pattern from the following items. Setting Description item Read the data of the specified destination device (transmission source) to the specified device of the host Read station (transmission destination). Write the data of the specified device of the host station (transmission source) to the specified destination Write device (transmission destination).
Page 170 (3) Register Destination (a) Setting of devices for communications Set the devices for both transmission source and transmission destination. Up to 64 devices can be registered. This setting also can be done in the "Destination Setting List" window that will open by clicking button in the "Simple PLC Communication Setting"...
Page 171 CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION If the L/Q/QnA series modules are used for the simple PLC communication, F000 to FFFE is automatically selected for the port No. of the host station. Therefore, when using the simple PLC communication function, do not set F000 to FFFE to Host Station Port No.
Page 172 (c) Setting for each device for communications The settings vary depending on the device for communications. : Setting required, : Setting required if the password is set for destination device for communications, : Setting not required Setting item Device for communications Remote IP Address Network No.
Page 173 CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION (4) Settings for destination devices for communications If following devices are used as the destination devices for communications, the settings of these devices are also required. Necessary setting Destination device for DIP switch on the front of the Parameter Programming tool communications...
Page 174 The module has the setting by default to communicate with one device whose protocol is "UDP". To execute the simple PLC communication function when the CPU module (destination device for communications) is in RUN state, turn on this switch. If Ethernet module is in Automatic startup mode, turn on this switch. To execute the simple PLC communication function when the CPU module (destination device for communications) is in STOP state or in stop error state, turn on the bits.
Page 175 CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION (c) Timing of write or read of the device data The data of a bit device and a word device set for each setting No. are communicated in the END processing. Even so, depending on the destination device for communications, data communications for one setting may not be done completely, resulting in data inconsistency.
Page 176 (6) Request Contact Device to Stop Fixed Interval Communication Select the device from X, M, or B and specify it as Request Contact Device to Stop Fixed Interval Communication. If "Fixed Interval" is set for Communication Setting, the communications for the specified setting No.
Page 177 CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION (8) Status Save Destination Device Select the device from D, D (extended data register), W, W (extended link register), R, or ZR and specify it as a device to store the communication status. The values listed below indicate the communication status. Description Item Communication...
Page 178 (10)Time-out Time and Retry Count Setting item Description Setting range Set the time interval until an error is detected or the 10ms to 65535ms (in increments of Communication Time-out retry of communication is performed when the Time destination device for communications does not 1ms) respond or communications fail.
Page 179: Program To Check Communications
CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION (11)Comment Comment can be set by entering up to 32 one-byte characters (16 double-byte characters). (12)Latency Time By setting the latency time, the start timing in the communications can be switched in the following cases. •...
Page 180: Diagnostics
12.3 Diagnostics The communication status of the simple PLC communication function can be checked in the "Simple PLC Communication Status" tab of the "Ethernet Diagnostics" window. [Diagnostics] [Ethernet Diagnostics] For details on Ethernet diagnostics, refer to the following. GX Works2 Version 1 Operating Manual (Common) 12.4 Errors Related to the Simple PLC Communication Function...
Page 181: Precautions
CHAPTER 12 SIMPLE PLC COMMUNICATION FUNCTION (3) Operations after the error After the occurrence of the error, if the conditions are restored for proper communications, data communications are re-started at the following timing. • When "Fixed" is set for Communication Setting: At the timing of the execution interval •...
Page 182 (6) Errors at the destination device If an error related to this function occurs, following errors might be detected at the destination device. • When the destination device is Q/L series: Remote password mismatch error • When the destination device is A series: Device number specification error Also, an error might be detected depending on the settings of the destination device or the conditions of Ethernet communication.
Page 183: Chapter 13 Ip Address Change Function
CHAPTER 13 IP ADDRESS CHANGE FUNCTION CHAPTER 13 IP ADDRESS CHANGE FUNCTION This function changes the IP address of a built-in Ethernet port without changing the built-in Ethernet port settings in PLC parameter, by storing the values in the special relay and special register. 2) Store the IP address of the special register (SD) to the IP address storage area (flash ROM) by turning the special relay (SM) on.
Page 184: Ip Address Of The Built-In Ethernet Port
13.1 IP Address of the Built-in Ethernet Port For IP address of the built-in Ethernet port, a value of the built-in Ethernet port setting in PLC parameter is set at the initial processing of the CPU module. When this function is used, the value stored in the IP address storage area (flash ROM) will be set to the IP address of the built-in Ethernet port which is set during the initial processing of the CPU module, instead of the value set in the parameter.
Page 185: How To Use The Function
CHAPTER 13 IP ADDRESS CHANGE FUNCTION 13.2 How to Use the Function 13.2.1 Write operation This operation can be performed by storing the IP address to be changed in SD1292 to SD1297 and turning off and on SM1292 (IP address storage area write request). (1) Operating procedure The following shows the write operation flow.
Page 186 (2) Operations of special relay and special register The following shows the operations of special relay and special register during the operation of writing to the IP address storage area (flash ROM). (a) Operations of special relay and special register during the operation of writing to the IP address storage area (flash ROM) Write start Write complete...
Page 187 CHAPTER 13 IP ADDRESS CHANGE FUNCTION (4) Program example The following shows a program example of writing to the IP address storage area (flash ROM). (a) Devices used in programs Device number Application Device number Application M100 Write command SM1293 IP address storage area write complete IP address to be changed SM1294...
Page 188: Clear Operation
13.2.2 Clear operation This operation can be performed by turning off and on SM1295 (IP address storage area clear request). (1) Operating procedure The following shows the clear operation flow. Turn off and then on the IP address storage area clear request (SM1295). Clearing the IP address storage area (flash ROM).
Page 189 CHAPTER 13 IP ADDRESS CHANGE FUNCTION (2) Operations of special relay and special register The following shows the operations of special relay and special register during the operation of clearing the IP address storage area (flash ROM). (a) Operations of special relay and special register during the operation of clearing the IP address storage area (flash ROM) Clear start Clear complete...
Page 190 (4) Program example The following shows a program example of clearing the IP address storage area (flash ROM). (a) Devices used in programs Device number Application Device number Application M200 Clear command M201 Normal clear completion indication SM1295 IP address storage area clear request M202 Abnormal clear completion indication SM1296...
Page 191: Checking The Ip Address
CHAPTER 13 IP ADDRESS CHANGE FUNCTION 13.3 Checking the IP Address (1) Checking using the Ethernet diagnostics The IP address of the built-in Ethernet port can be checked with the Ethernet diagnostics. For details on the Ethernet diagnostics, refer to the following. GX Works2 Version 1 Operating Manual (Common) (2) Checking by the special relay and special register The IP address of the built-in Ethernet port can be checked using the special relay and special register.
Page 192: Precautions
13.4 Precautions The following describes precautions for the IP address change function. (1) Power-off and reset operations Do not power off or reset the CPU module while writing to or clearing the IP address storage area (flash ROM). Values may not be reflected to the IP address storage area (flash ROM). Check that SM1293 (IP address storage area write complete) and SM1296 (IP address storage area clear complete) turn on before powering off or resetting the CPU module.
Page 193: Chapter 14 Ip Packet Transfer Function
CHAPTER 14 IP PACKET TRANSFER FUNCTION CHAPTER 14 IP PACKET TRANSFER FUNCTION Remark When using the IP packet transfer function, check the versions of the CPU module and GX Works2. ( Page 222, Appendix 3) This function communicates data (using FTP or HTTP) through the built-in Ethernet ports from an Ethernet device (such as a personal computer) to the following IP-compatible devices connected via a CC-Link IE Field Network module.
Page 194 (1) How to use For the settings of IP packet transfer function or how to use the function, refer to the following. Manual for the CC-Link IE Field Network module used (2) Precautions • The data that are communicated using the IP packet transfer function are communicated separately by the following processing.
Page 195: Chapter 15 E-Mail Send/Receive Function
CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION The e-mail send/receive function enables the CPU module to send e-mail to and receive it from electronic devices such as mobile phones and personal computers. Personal computer Mobile phone Mail server Sending e-mail Ethernet Receiving e-mail...
Page 196: E-Mail Specifications
15.1 E-mail Specifications The e-mail specifications are listed below. Item Specifications Attachment Not permitted Data size Message body 4096 words (8192 bytes) Send Sending message body Data transfer method Receive Receiving message body Incoming mail format Text format only Subject Us-ASCII or ISO-2022-JP (Base 64) format MIME Version 1.0...
Page 197: Setting Method
CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION 15.2 Setting Method 15.2.1 Parameter setting (1) Open setting Set the connections to be used by the e-mail send/receive function. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] [Open Setting] Item Description Protocol Select "TCP". Open System Select "E-mail".
Page 198 (2) E-mail setting Set the parameters of the e-mail send/receive function. Project window [Parameter] [PLC Parameter] [Built-in Ethernet Port Setting] [E-mail Setting] Item Description Setting range Default 1 to 64 one-byte alphanumeric characters  Password Set the password for the mail server. and symbols 1 to 256 one-byte alphanumeric E-mail Address...
Page 199 CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION Item Description Setting range Default Set the POP server name of the receive 1 to 256 one-byte alphanumeric  POP Server Name destination. characters and symbols Receive Set the IP address of the receive destination POP Mail server.
Page 200: Settings At Programming
15.2.2 Settings at programming This function sends and receives e-mail using the following instructions. Instruction Description Reference SP.MLSEND Sends e-mail to the specified external device. Page 204, Section 15.4.1 SP.MLRECV Reads received e-mail from the mail server. Page 208, Section 15.4.2 (1) Special relay and special register The following table lists the special relay and special register used with this function.
Page 201: Function Details
CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION 15.3 Function Details 15.3.1 Function to read/write device when e-mail is received Writing an MC protocol command in the message body of incoming mail enables device reading and writing. After command execution, e-mail is returned to the send address to report the result of reading. When using this function, check "Enable MC Protocol Command"...
Page 202 (1) Request e-mail format (a) Subject Specify any subject. (b) Message body State the start/end of e-mail and the start/end of a command by enclosing the relevant item with the following header and footer. Header/footer name Header Footer Description Indicates the start and end of command e-mail. Start/end <MELMAIL>...
Page 203 CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION (d) How to use • Write a start header at the beginning of the message body. • Write an end header at the end of the message body. • Anything other than the start/end and command headers and footers can be written in any format. •...
Page 204 (d) Command examples A response mail is returned in response to the request mail requesting to read word device D100. • Ended normally (1995 is assumed stored in D100.) Subject Message body Re: Test command <MELRET>D000 00 FF 03FF 00 0014 0000 1995</MELRET> •...
Page 205: Send Destination E-Mail Address Edit Function
CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION 15.3.2 Send destination e-mail address edit function This function can edit, register, and delete e-mail addresses in the e-mail address table stored in the internal memory of the CPU module. Separately from the send e-mail address setting registered by PC parameters, this function targets 16 storage areas in the internal memory of the CPU module.
Page 206: E-Mail Send/Receive Function Instructions
15.4 E-mail Send/Receive Function Instructions 15.4.1 Send e-mail (SP.MLSEND) Command SP.MLSEND SP.MLSEND "U0" Internal device J\ Setting data R, ZR U\G Constant Others Word Word             Local devices cannot be used. (1) Setting data Setting data Description...
Page 207 CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION Setting Device Item Description Set by range Completion status is stored. • 0000 : Completed normally  Completion status System • Other than 0000 : Failed (error code) Specify the external device to send e-mail to, with the destination e-mail address setting number that is set by the PC Destination number 1 to 16...
Page 208 • When "E-mail address stored in CPU internal memory" is specified in the destination e-mail address S1 S1 specification in +0, e-mail is sent to the e-mail address registered in e-mail address send destination No. +2) stored in CPU internal memory. SP.MLSEND S1 S2 D Destination e-mail address...
Page 209 CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION (4) Error Each of the following events results in an operation error, and the error flag (SM0) turns on and an error code is stored in SD0. • An instruction is used in a CPU module with a serial number (first five digits) of "16111" or earlier. (Error code: 4002) •...
Page 210: Send E-Mail (Sp.mlrecv)
15.4.2 Send e-mail (SP.MLRECV) Command SP.MLRECV SP.MLRECV "U0" Internal device J\ Setting data R, ZR U\G Constant Others Word Word             Local devices cannot be used. (1) Setting data Setting data Description Set by...
Page 211 CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION Setting Device Item Description Set by range Specify the number of the e-mail to be read when multiple e-mails are E-mail number to be received. 0 to 65535 User read • 0: First e-mail • 1 to 65535: Specified e-mail +3 to ...
Page 212 When the header is "abcde" … … Header data length (NULL) 2nd character 1st character in message body in message body · • When the received mail is an MC protocol command mail, SM1659 (MC protocol command being processed flag) turns on. It turns off during the END processing where the return mail is sent after MC protocol command processing.
Page 213 CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION • The SP.MLRECV instruction runtime operation is as follows. Received mail presence flag (SM1662) MC protocol command being processed flag (SM1659) MC protocol command error flag (SM1660) MC protocol command error code (SD1660) **** (Error code) Instruction SP.MLRECV instruction Instruction execution...
Page 214 (5) Precautions • If an instruction is executed while another e-mail send/receive instruction is already being executed or while SM1659 (MC protocol command being processed flag) is on, the instruction executed later performs no processing. (6) Program example The sample program stores the e-mail (header + message body), which was received based on the control data stored in D0 to D15, in D100 and later.
Page 215: E-Mail Address Registration/Deletion (Sp.mlopeadr)
CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION 15.4.3 E-mail address registration/deletion (SP.MLOPEADR) Command SP.MLOPEADR SP.MLOPEADR "U0" Internal device J\ Constant Setting data R, ZR U\G Others Word Word K, H             ...
Page 216 (3) Function • This instruction registers/deletes the e-mail address specified in in the destination e-mail address setting number specified in of the e-mail address table. (The destination e-mail address setting number of the PC parameter is not applicable.) • The execution type specified in +0 specifies whether to register or delete an e-mail address.
Page 217 CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION (4) Error Each of the following events results in an operation error, and the error flag (SM0) turns on and an error code is stored in SD0. • An instruction is used in a CPU module with a serial number (first five digits) of "16111" or earlier. (Error code: 4002) •...
Page 218: E-Mail Address Acquisition (Sp.mlgetadr)
15.4.4 E-mail address acquisition (SP.MLGETADR) Command SP.MLGETADR SP.MLGETADR "U0" Internal device J\ Constant Setting data R, ZR U\G Others K, H Word Word                  ...
Page 219 CHAPTER 15 E-MAIL SEND/RECEIVE FUNCTION (3) Function • This instruction stores the e-mail address stored in the destination e-mail address setting number in selected by +0 in the device specified by and later. • If the e-mail address is not registered in the destination e-mail address setting number, "00 "...
Page 220: Diagnostics
15.5 Diagnostics The communication status of the simple PLC communication function can be checked in the "Status of Each Connection" tab in the "Ethernet Diagnostics" window. [Diagnostics] [Ethernet Diagnostics] For details on Ethernet diagnostics, refer to the following. GX Works2 Version 1 Operating Manual (Common) The connection number in which the states and errors of the connections used by this function are stored is the one with the smaller number of the two connections that are set in "E-mail"...
Page 221: Appendices
The table below indicates the operation processing times required for the instructions introduced in this manual. For details on the processing time, refer to the following. MELSEC-Q/L Programming Manual (Common Instruction) Processing time (s) L06CPU, L06CPU-P, Type Instruction Condition L02CPU, L02CPU-P L26CPU, L26CPU-P, L26CPU-BT, L26CPU-PBT Minimum Maximum Minimum Maximum Active Unpassive SP.SOCOPEN...
Page 222 Processing time (s) L06CPU, L06CPU-P, Type Instruction Condition L02CPU, L02CPU-P L26CPU, L26CPU-P, L26CPU-BT, L26CPU-PBT Minimum Maximum Minimum Maximum File name + server path string SP.FTPPUT 251.000 256.000 234.000 244.000 File transfer = 32 characters function File name + server path string instructions SP.FTPGET...
Page 223: Appendix 2 Port Numbers Used By Built-In Ethernet Port Lcpu
APPENDICES Appendix 2 Port Numbers Used by Built-in Ethernet Port LCPU Do not specify the following port numbers, because these numbers are used by the system. Port number Application For future extension (For Q series Ethernet modules, this port number is 1388 (5000) used for "Auto Open UDP Port".)
Page 224: Appendix 3 Added And Changed Functions
Appendix 3 Added and Changed Functions The following table shows the built-in Ethernet function, which is changed or added to the CPU module and GX Works2, as well as the serial number of the CPU module and the version of GX Works 2 that support the function. Serial No.
Page 225: Appendix 4 Performance List Of Simple Plc Communication Function
(Total 128 words)  10.0 37.8 256 words for each (Total 512 words) 10.0 18.2 31.0 32 words for each (Total 64 words) L02CPU, Write 10.0 18.3 31.1 64 words for each (Total 128 words) L02CPU-P  12.0 39.2 256 words for each (Total 512 words) 14.0...
Page 226 (Total 128 words)  11.0 37.4 256 words for each (Total 512 words) 10.0 18.1 30.7 32 words for each (Total 64 words) L02CPU, Write 11.0 18.2 31.0 64 words for each (Total 128 words) L02CPU-P  12.0 39.5 256 words for each (Total 512 words) 13.0...
Page 227: Appendix 5 Specifications Comparison With Ethernet Module
APPENDICES Appendix 5 Specifications Comparison with Ethernet Module (1) Specifications comparison with the Ethernet module The following table lists the comparison of specifications between the Built-in Ethernet port LCPU and the Ethernet module (LJ71E71-100). : Available, : Restricted, : Unavailable Availability Built-in Item...
Page 228 Availability Built-in Item Description Ethernet port LJ71E71-100 LCPU Checks the connection status of an external device by sending a Ping message (ICMP Echo) to an external   Check with Ping ("Use the Ping") device. Closes the corresponding connection if no Alive check function response message is received.
Page 229 APPENDICES Availability Built-in Item Description Ethernet port LJ71E71-100 LCPU Enables the Ethernet module to send/receive data to/from an external device by using the protocol for the external  Data communications using the predefined protocol device. The external device side protocol can be easily ...
Page 230 (2) Differences on MC protocol functions between the Built-in Ethernet port LCPU and Ethernet module Consequence of a Built-in Ethernet port Item LJ71E71-100 communication with the Built- Action LCPU in Ethernet port LCPU Data sending method on Data sending method is Perform the Data sending method is TCP when the response...
Page 231 APPENDICES (3) Differences between the socket communication and the nonprocedural communication using a fixed buffer of the Ethernet module Consequence of a Built-in Ethernet port Item LJ71E71-100 communication with the Action LCPU Built-in Ethernet port LCPU ZP.OPEN SP.SOCOPEN ZP.CLOSE SP.SOCCLOSE Instruction name ZP.BUFRCV SP.SOCRCV...
Page 232 Memo...
Page 233: Index
INDEX ......160 Lock processing ........131 .
Page 234 ........21 ....112 TCP fixed-length receive mode .
Page 235: Instruction Index
INSTRUCTION INDEX ......99 S.SOCRCVS ......114 S(P).SOCRDATA .
Page 236 Memo...
Page 237: Revisions
Addition Appendix 2 Addition of LCPU models July 2011 SH(NA)-080891ENG-D Model addition L02CPU-P, L26CPU-PBT Partial correction INTRODUCTION, Chapter 1, Section 5.2.2, 6.3, 6.4.1, 6.4.6, Appendix 1 Addition Chapter 10, Section 10.1, 10.2 10.3, 10.4, 10.5, Appendix 3, 4 September Partial correction...
Page 238 This manual confers no industrial property rights or any rights of any other kind, nor does it confer any patent licenses. Mitsubishi Electric Corporation cannot be held responsible for any problems involving industrial property rights which may  2010 MITSUBISHI ELECTRIC CORPORATION...
Page 239: Warranty
6. Failure caused by reasons unpredictable by scientific technology standards at time of shipment from Mitsubishi. 7. Any other failure found not to be the responsibility of Mitsubishi or that admitted not to be so by the user. 2. Onerous repair term after discontinuation of production (1) Mitsubishi shall accept onerous product repairs for seven (7) years after production of the product is discontinued.
Page 240: Trademarks
TRADEMARKS Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Ethernet is a registered trademark of Fuji Xerox Co., Ltd. in Japan. The company names, system names and product names mentioned in this manual are either registered trademarks or trademarks of their respective companies.
Page 242 SH(NA)-080891ENG-P(1701)MEE MODEL: LCPU-U-NE-E MODEL CODE: 13JZ37 HEAD OFFICE : TOKYO BUILDING, 2-7-3 MARUNOUCHI, CHIYODA-KU, TOKYO 100-8310, JAPAN NAGOYA WORKS : 1-14 , YADA-MINAMI 5-CHOME , HIGASHI-KU, NAGOYA , JAPAN When exported from Japan, this manual does not require application to the Ministry of Economy, Trade and Industry for service transaction permission.

This manual is also suitable for:

L26cpu-p L02cpu-p L26cpu-bt L26cpu-pbt L06cpu L06cpu-p ... Show all

Mitsubishi L02CPU User Manual

Chapter 1 Overview

Chapter 2 Communication Specifications

Chapter 3 Connection with Programming Tool and Got

Chapter 4 Direct Connection to Programming Tool

Chapter 5 MC Protocol Communication

Chapter 6 Data Communications Using the Predefined Protocol

Chapter 7 Socket Communication Function

Chapter 8 Time Setting Function (Sntp Client)

Chapter 9 File Transfer Function (Ftp Server)

Chapter 10 File Transfer Function (Ftp Client)

Chapter 11 Remote Password

Chapter 12 Simple Plc Communication Function

Chapter 13 Ip Address Change Function

Chapter 14 Ip Packet Transfer Function

Chapter 15 E-Mail Send/Receive Function

Appendix 1 Operation Processing Time for each Instruction

Appendix 2 Port Numbers Used by Built-In Ethernet Port LCPU

Appendix 3 Added and Changed Functions

Appendix 4 Performance List of Simple PLC Communication Function

Appendix 5 Specifications Comparison with Ethernet Module

Quick Links

Related Manuals for Mitsubishi L02CPU

Summary of Contents for Mitsubishi L02CPU

This manual is also suitable for:

Table of Contents