Ethernet/IP Explicit messaging to control a drive (Kinetix 350)

  • Francois77

    Francois77 - 2019-01-26


    I'm currently trying to send commands to an Ehternet/IP drive (Kinetix 350).
    I'd like use the most basic functions such as reset, speed set, move, stop.

    I've been able to read/write some parameters from CODESYS but it's basically been"brute forcing".

    As far as I know CIP is a common standard from ODVA which published a few profiles such as the motion one. I don't get why we can't find a list of all the classes, instances and attributes somewhere. At least the standard ones.

    Would anybody know where to find those information and does anyone have ever tried to control a drive over Ethernet/IP from CODESYS?
    Using the EDS file didn't work. I get the following error : "invalid network connection parameter". It looks like the Forward Open command fails.

    Any help would be appreciated.

  • vitovt1877

    vitovt1877 - 2019-01-29


    I worked on program to control PowerFlex 525 drive. Check this video on youtube.
    I used EDS file to control basic functions and explicit messaging to read/write parameters. There is a manual from AB with description for all required classes, instances, etc.
    I have not seen anything like this for Kinetix drive and I think we will never see it.
    I assume Kinetix also requires real time environment (like rt_preemt patch or Windows RTE).
    Try to use WireShark to see what messages are between Studio 5000 and drive during using Motion Direct Commands. You can capture messages for all motion instructions. Also you need to capture messages when it starts up to figure out how it registers session between PLC and drive.

    To use Kinetix servodrive with PLC usually you should have AB PLC with motion support and even network card used for communication if you have ControlLogix PLC should support motion. We are talking about really big difference in money when have motion vs non motion PLC or network card. I think cheapest configuration for CompactLogix with motion support in US will be >3k$ (I am not sure about Europe).

    P.S. I would like to see Kinetix 5700 running from Raspberry PI. It would be epic achievement and epic fail for somebody...

  • Francois77

    Francois77 - 2019-01-29

    Thanks for you reply. I'd seen your awesome video ^^. I was wondering how you connected the two. I'm glad to hear that it's not too much pain.

    I'd sniffed the traffic to figure out the commands including the start up sequence and catch the connection path.
    I've almost managed to replicate the Foward Open request but CODESYS sends one more item that I can't get rid of. It's called "socket address info".
    From what I've read from the standard it contains the IP/Port of the originator which I don't have with my CompactLogix.

    Now if I switch the connection type to be multicast I don't get that extra item which makes sense. It still doesn't work though. I wonder if that would be one of the root causes of the problem I'm having.
    One more difference between the Pi and the CompactLogix is that the connection priority is set to "Scheduled" for the Pi and "Urgent" for the CompactLogix but I can't see where I could change this parameter.
    Sending the commands from RSLogix didn't help as it seems it uses implicit messaging only. Using explicit messaging seems to be working but I basically don't know what I'm doing as I've used random classes, instances and attributes. I guess I could write some sort of brute force program but it sounds like more pain than it's worth it.

    Maybe there's some sort of filtering around stuff like the Vendor ID to keep the Kinetix away from non Rockwell PLC's.

  • vitovt1877

    vitovt1877 - 2019-01-31


    Thank you! I don't have two drives connected at the same time. It is possible to do, but main idea of this program is configure and test drives out of the box plus monitor it when it is running. You assign IP address, connect to this drive, change/download/upload parameters, check rotation in manual mode and switch to another drive. One drive is connected at a time, as soon you connect to another drive, old drive is faulting out with network loss fault.

    I searched online and found that you can get some info from CIP drive or do something using explicit messages
    - Retrieve Faults and Alarms
    - Change the Digital Inputs
    - Writing and Reading CIP Axis Drive attribute (not all, but some of them that can't be used with GSV/SSV functions)
    You can find these attributes in this manual
    https://literature.rockwellautomation.c ... _-en-p.pdf
    Let me know if you need additional information about it and also service codes, classes, instances to use above mentioned messages.
    That is about it for explicit messages. I could't find anything for motion instructions and it makes sense. It is controlled PLC by motion planner using implicit messages for real time updates.

    Thank you!


Log in to post a comment.