Studio 5000 MSG instruction: path, setup and error codes

The MSG instruction is how one Logix controller reads or writes data in another device without the I/O tree doing it for you: another ControlLogix or CompactLogix, a PLC-5, an SLC 500 or MicroLogix, or a module's configuration. It is also where a lot of commissioning time goes, because the error codes are terse and the extended codes are not displayed at all.

Everything specific below comes from Rockwell: the Logix 5000 Controller Messages programming manual (1756-PM012), the general instructions reference that the 1756-RM003 link now serves as 1756-RM018A, and the Logix Designer online help.

What the MSG instruction does

MSG transfers a block of data asynchronously. The rung starts it; the transfer finishes some scans later while the program carries on. Rockwell calls it a transitional instruction: in ladder it executes when the rung goes from false to true, and in Structured Text you must condition it yourself so that it executes only on a transition.

Each MSG needs a control tag of type MESSAGE, and 1756-PM012 sets three rules for that tag: controller scope, not part of an array, and not part of a user-defined type.

Messages queue. An enabled MSG passes through a throttle with 16 positions into a message queue that holds 48. Enable more than 16 in the same moment and the rest wait, still enabled, until a position frees. Large polling programs therefore sequence their messages in groups rather than firing them all together; 1756-PM012 includes a message manager pattern for exactly that.

Choose the message type

With redundancy enabled on a ControlLogix 5580 or GuardLogix 5580, the PLC-5, SLC, MicroLogix, PLC-3, PLC-2 and block-transfer message types are not supported.

Source, destination and the rules that cause most errors

• Types must match. For CIP Data Table Read and Write, the online help says the source and destination types must match. A DINT array read into a REAL array fails.
• Base tags at the far end. Writing Logix to Logix, the destination in the remote controller must be a base tag, not an alias. Reading, the source in the remote controller must be a base tag. Aliases are fine on the local side.
• Scope. Tags referenced in the remote controller must be controller scoped. Locally, ControlLogix 5570 and CompactLogix 5370 families need controller-scope tags; 5380, 5580 and 5590 controllers at version 31 and later can also use program-scope tags.
• Not every type travels. Logix Designer's help says I/O structure tags and BOOLs are not supported for the source element; INT, DINT and the other data types can be used.
• Older controllers use their own addresses. For a PLC-5 or SLC, the remote element is written in that controller's syntax, such as N7:10. Rockwell recommends a buffer of INTs for the message and DINTs everywhere else in the Logix project, with a FAL to convert.
• Count elements, not bytes. For CIP and typed messages, an element is one element of the array you name as the source of a write or the destination of a read.

Build the communication path

The path is the route the message takes, written as pairs: a port to leave by, then the address on the far side of that port. The Logix Designer help gives the port numbers:

So to reach a controller in slot 0 of a remote chassis, through a 1756-EN2T in slot 2 of the local chassis and an Ethernet module at 192.168.1.20 in the remote one, the path is:

1, 2, 2, 192.168.1.20, 1, 0

Read it in pairs: backplane to slot 2; out of that module's Ethernet port to 192.168.1.20; across the remote backplane to slot 0. Rockwell's own example path is 1, 0, 2, 42, 1, 3. The keyword THIS is a path to the controller itself, used for unconnected messages to the local controller.

You do not have to type paths. 1756-PM012 recommends, though does not require, adding the local communication module, the remote module and the remote controller to the I/O configuration, after which Browse picks the destination. If only the local module is in the I/O tree, browse to it and type the rest.

Logic can also change the path at run time through the MESSAGE tag's .Path member, entered as hexadecimal bytes without commas: the path 1, 0, 2, 42, 1, 3 becomes $01$00$02$2A$01$03.

Connected, unconnected and cached

A connected message can cache its connection, controlled by the .EN_CC bit, so the connection stays open after the message completes. Rockwell's guidance in 1756-PM012 is direct: for messages that execute at high frequency to the same device, configure them connected and cached. Firmware 12.x and later can cache up to 32 connections. Messages to the same device can share one cached connection when they are not enabled in the same scan.

Unconnected messages, and the first execution of a connected one, use an unconnected buffer. On CompactLogix 5370, ControlLogix 5570 and their GuardLogix equivalents there are 10 to 40 of these, 10 by default, each using 1.2 KB; if none is free when a message leaves the queue, it errors and no data moves. Rockwell suggests starting at the number of unconnected and uncached messages enabled at once, plus five.

Timeouts: an unconnected message, or the attempt to open a connection, errors if no response arrives within .UnconnectedTimeout, 30 seconds by default. Once connected, the timeout is ConnectionRate times the TimeoutMultiplier factor; the defaults, 7.5 seconds and a factor of 4, also give 30 seconds.

Status bits, and a trigger that does not jam

Never write .EN, .EW, .ST, .DN or .ER, directly or by clearing the .FLAGS word. Rockwell warns the controller may suffer a non-recoverable fault and clear the project from memory. If logic tests the status bits in more than one place, copy .FLAGS once and test the copy, because the bits can change partway through a scan.

A polling pattern in neutral text, with the interlock Rockwell recommends (an XIO of the MSG's own .EN in series):

XIO(Poll_Timer.DN)TON(Poll_Timer,1000,0);
XIC(Poll_Timer.DN)XIO(Read_Line2.EN)MSG(Read_Line2);
XIC(Read_Line2.DN)MOV(0,Read_Fails);
XIC(Read_Line2.ER)ONS(Read_Err_OS)ADD(Read_Fails,1,Read_Fails);
GEQ(Read_Fails,3)OTE(Line2_Comms_Lost);

The timer gives a one-scan pulse every second, and the XIO stops a slow message being retriggered before it finishes. Errors are counted rather than alarmed on the first one. In Structured Text the trigger is an IF: IF Poll_Timer.DN AND NOT Read_Line2.EN THEN MSG(Read_Line2); END_IF;. The pulse timer and the edge are covered in TON, TOF and RTO and one-shot instructions. The LADX ladder simulator has no MSG instruction, but the trigger, counter and watchdog rungs can be practised there with ordinary bits standing in for .DN and .ER.

MSG error codes (.ERR)

When .ER sets, .ERR holds a hexadecimal code. The meanings are Rockwell's, from 1756-RM003; the checks are where each one usually leads.

Extended error codes (.EXERR)

Logix Designer shows no text for these, so read the number from the tag. They are grouped by the .ERR code they belong to.

Reading the ones that point at a specific mistake: 0204 under 0001 (nothing answered within the timeout: wrong IP, wrong slot, target off or unreachable); 0311 and 0312 (a port or address in the path that does not exist, often a slot number one out); 0315 (a malformed path); 2104 (asking for elements past the end of the remote array); 2107 (source and destination types differ).

PLC-5 and SLC error codes

Messages to PLC-5, SLC and MicroLogix controllers use PCCC, and from Logix firmware 10.x these errors get their own .ERR values, so .EXERR is no longer needed for them. Common ones: 1000 illegal command or format from the local processor; 3000 remote node missing, disconnected or shut down; 4000 processor connected but faulted; 7000 processor in Program mode; F006 address file does not exist in the target; F007 destination file too small for the number of words requested; F00B privilege error, access denied. The full table is in 1756-RM003.

A troubleshooting order

1. Read .ERR, and .EXERR from the tag monitor, not from the dialog.
2. Timeouts and 'not available' codes are path problems: check every port and address, ideally by browsing.
3. 0004, 0005 and 210B are naming problems: remote tag spelling, existence and scope.
4. 2104, 2107 and 0011 are size and type problems: compare both ends.
5. 0002, 0301 and a queue that never empties are resource problems: cache frequent messages and sequence the rest.

A structured way of working through faults like these is in the PLC troubleshooting method. If the data is heading for a database rather than another controller, getting PLC data into a database compares the options that do not load the controller with messages. For network choices, see EtherNet/IP versus PROFINET, and if a path refuses to work, ask in the LADX forum with the path, the .ERR and the .EXERR.